How Long Do Doctors’ Offices Keep Medical Records?

Most doctors’ offices keep medical records for roughly five to ten years after your last visit, and the exact number depends on the state where you were treated. There is no single federal deadline. HIPAA governs how your health information is protected, but the question of how long a provider must hold onto your chart is answered by state law, with a few federal floors layered on top for hospitals and certain programs.

Why HIPAA Doesn’t Set the Timeframe

It’s a common assumption that HIPAA tells doctors when they can throw records away. It doesn’t. HIPAA requires providers to retain administrative documents — privacy policies, training records, compliance procedures — for at least six years from the date they were created or last in effect.¹ That six-year rule is about the paperwork behind how a practice handles your information, not the clinical chart itself. For your actual medical records, state law controls.

Adult Records: Five to Ten Years Is Typical

State retention requirements for adult medical records generally fall between five and ten years, measured from the patient’s last visit or discharge. Some states sit at the shorter end. Others push to seven or ten. A handful set no specific minimum and leave providers to follow professional guidelines or the retention period tied to the state’s malpractice statute of limitations.

Because the rules vary widely, the cleanest way to find the exact number for your state is to check with your state medical board or state health department. If you think you might need older records — for a new specialist, a disability claim, a legal matter, or your own peace of mind — request them sooner rather than later. Once the retention period runs out, your provider has no obligation to keep the file.

Children’s Records Are Kept Much Longer

Pediatric records almost always carry extended retention. The reason is straightforward: a child can’t file a malpractice claim while still a minor, so the records need to outlast the statute of limitations that starts running when the child reaches adulthood. Most states require providers to keep a child’s records until the patient reaches the age of majority plus several additional years. In practice, that often means holding files until the patient turns 23, 25, or 28. A few states go to 30. Records from a toddler’s checkup can easily stay on file for more than two decades.

Hospitals and Medicare

Hospitals that participate in Medicare must meet federal Conditions of Participation, which require medical records to be retained for at least five years.² That floor applies to all patient records at those facilities, not just to Medicare patients. Many states impose longer periods, and where they do, the state requirement generally controls.

Medicare Advantage organizations have a stricter, separate obligation: they must maintain their books, records, and financial documents for ten years to support federal audits.³ That rule targets accounting and operational records rather than individual charts, but it can indirectly keep clinical documentation alive longer when that documentation supports billing or audits.

Things That Can Extend the Clock

Even after the standard retention period is up, certain circumstances keep records in place:

Ongoing or anticipated litigation. If a provider is in a lawsuit or reasonably expects one, all relevant records must be preserved until the matter is resolved. Normal disposal schedules are suspended for the duration of any litigation hold.⁴
Diagnostic imaging. X-rays, MRIs, and CT scans can carry their own retention schedules under state law or accreditation standards, often seven to ten years.
Ongoing treatment. As long as you remain an active patient at a practice, the retention clock generally hasn’t started. It begins running after your last encounter.

When Your Doctor Retires or the Practice Closes

A retiring physician or closing practice doesn’t erase the retention obligation. The provider must arrange for a custodian — another doctor, a medical group, or a professional records storage company — to take over the files and handle patient requests in a HIPAA-compliant way. A formal custodian agreement should cover how long records will be held, how transfer requests are processed, and what happens before any records are destroyed.

Practices closing their doors are generally expected to notify patients by mail and, for patients who can’t be reached directly, through a public notice such as a newspaper advertisement. The notification should tell you where to send a written request for your records, what identifying information to include, and any copying fees. Many professional guidelines suggest keeping a working phone number with recorded instructions active for at least six months after closure.

If you hear a practice is closing or your doctor is retiring, request your records promptly. Tracking down a records custodian years later is possible but a lot harder than getting copies while the handoff is still fresh.

How to Request Your Records Before They’re Gone

Under HIPAA’s Privacy Rule, you have a legal right to inspect and get copies of nearly all of the protected health information your provider holds about you. That covers medical charts, billing records, lab reports, imaging, clinical notes, and insurance information — the “designated record set.”⁵⁶

To make the request, put it in writing. Most offices have a form, but you’re not required to use one. Include your full legal name, date of birth, contact information, and the specific records or date range you want. Expect the provider to ask for a copy of a government-issued ID to verify your identity.

The provider must respond within 30 days of receiving your request. They can take one extension of up to 30 more days, but only if they notify you in writing with the reason for the delay and a date by which they’ll finish.⁵

If a provider ignores you, blows past the 60-day maximum, or charges improper fees, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints must be filed in writing within 180 days of when you learned about the violation, with extensions possible for good cause.⁷

What Copies Cost

Inspecting your records in person is free. If you want copies, the provider can charge a reasonable, cost-based fee limited to labor for copying, supplies like a USB drive or paper, and postage if you want them mailed. They cannot bill you for the time spent searching for or pulling your records together.⁵

For electronic copies of records the provider already stores electronically, per-page fees are off the table. The provider may instead charge a flat fee of no more than $6.50 total, covering labor, supplies, and postage combined. Per-page fees are only allowed when you’re requesting paper copies of records that are kept on paper.⁸

One important limit: these HIPAA fee caps apply only when you request copies of your own records for yourself. If you direct the provider to send records to a third party — an attorney, another doctor, an insurance company — the HIPAA cap doesn’t apply, and state law governs what can be charged. Third-party requests often carry higher per-page fees and administrative charges.⁹

1
eCFR. 45 CFR 164.530 – Administrative Requirements
2
GovInfo. 42 CFR 482.24 – Condition of Participation: Medical Record Services
3
eCFR. 42 CFR 422.504 – Contract Provisions
4
Department of Health and Human Services. Department of Health and Human Services Policy for Litigation Holds
5
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
6
Health Information Privacy (HHS.gov). What Personal Health Information Do Individuals Have a Right Under HIPAA to Access
7
HHS.gov. How to File a Health Information Privacy or Security Complaint
8
Health Information Privacy (HHS.gov). Individuals’ Right under HIPAA to Access their Health Information
9
HHS.gov. Important Notice Regarding Individuals’ Right of Access to Health Records