Hospitals have to keep medical records for at least five years under federal Medicare rules, and most states push that window to somewhere between six and ten years after your last visit or discharge. Records created when the patient was a child are held much longer, usually until the patient reaches adulthood plus additional years on top. How long do hospitals have to keep medical records in your specific situation depends on the state, the patient’s age at the time of care, and whether the patient is still living.
The Federal Five-Year Floor
Any hospital that participates in Medicare, which covers nearly every hospital in the country, must keep each patient’s medical record for at least five years. That requirement comes from the Centers for Medicare and Medicaid Services as a condition of participating in the program.1eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services The five-year floor applies to records for every inpatient and outpatient, not only patients who were themselves on Medicare.
HIPAA is often assumed to set the retention period, but it does not. HIPAA’s six-year rule covers administrative paperwork such as privacy policies, authorization forms, complaint records, and business associate agreements. It says nothing about how long the clinical chart itself has to survive. The chart retention rule is the CMS one.
State Rules Usually Go Longer
State law is where the actual retention period lives for most patients, and state requirements almost always exceed the federal five years. Six to ten years after the patient’s last encounter or discharge is the common range for adult records. A handful of states set shorter or longer windows. Because the numbers vary so much from one jurisdiction to the next, the reliable way to find your state’s exact requirement is to ask the state department of health or medical licensing board.
Records for Minors
Every state extends the retention period for records created when the patient was a child. The typical structure is to require the hospital to hold the record until the patient reaches the age of majority, which is 18 in most states and 21 in a few, plus an additional stretch of years on top, often the same period that would apply to an adult record. The reason is legal: the statute of limitations for medical malpractice and similar claims usually does not start running until a minor becomes a legal adult, so the underlying records have to survive long enough to support or defend those claims.
Records for Deceased Patients
When a patient dies, the retention clock generally resets. States commonly require hospitals to keep a deceased patient’s records for a set number of years after the date of death, with periods often running from three to ten years. That window is meant to let executors, personal representatives, and family members reach the records for estate administration, insurance claims, and wrongful death litigation.
What Happens When the Retention Period Ends
Once a hospital has held records for the legally required period, it has no obligation to keep them any longer, and hospitals do destroy records after the window closes. HIPAA does not dictate the retention period itself, but it does require that any destruction method leave the information unreadable and unrecoverable. For paper records, that means shredding or incineration. For electronic records, it means clearing, purging, or physically destroying the storage media.
This is the practical reason to request copies well before the period runs out. If the records have already been lawfully destroyed, the hospital has no obligation to recreate them, and there is no appeal. Anyone involved in ongoing or possible legal matters should pull copies early, because proving a claim years later without supporting documentation is far harder.
Requesting Copies While Records Still Exist
You have the right to inspect and obtain a copy of your own protected health information for as long as the hospital maintains it. That right covers your designated record set: clinical notes, lab results, imaging reports, billing records, and insurance information. Psychotherapy notes are the main exception, and a provider can deny access to those without review.2eCFR. 45 CFR 164.524 – Access to Protected Health Information
To start, complete an authorization form (sometimes called an Authorization for Disclosure of Protected Health Information) and submit it to the hospital’s Health Information Management or Medical Records department. Most hospitals accept requests through an online patient portal, by mail, or by fax. The form asks for your full name, date of birth, and the approximate dates you received care. Specify which records you want and where you want them sent, and include a copy of a government-issued photo ID.
Hospitals must fulfill your request within 30 calendar days.3U.S. Department of Health & Human Services. Individuals’ Right under HIPAA to Access their Health Information One 30-day extension is allowed if the hospital notifies you in writing within the original window, explains the delay, and gives you a specific date for delivery.4U.S. Department of Health & Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI? Some states impose shorter deadlines that override the federal one.
If you are requesting records for a child, an incapacitated family member, or a deceased relative, expect to provide additional legal documentation such as a power of attorney, guardianship papers, a court order, or paperwork naming you as executor or personal representative. The records department will verify your legal authority before releasing anything.
If the Hospital Has Closed
A hospital that closes does not get to walk away from its records. It remains legally responsible for storing patient files securely and keeping them accessible for the rest of the retention period. In practice, records are usually transferred to another hospital in the area, a commercial storage company, or a state agency.
Finding them takes some work. Check the closed hospital’s old website first, since it sometimes survives with a notice pointing to the current custodian. Your state’s department of health or medical licensing board often keeps a list of closed facilities and where their records went. If those routes come up empty, your insurance company may have claims data and provider information that can help trace the chain of custody.
If a Hospital Ignores Your Request
If a hospital misses the 30-day deadline without a written extension notice, charges fees it is not permitted to charge, or denies access without a valid legal basis, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.5U.S. Department of Health & Human Services. Filing a Health Information Privacy Complaint Complaints go through the OCR Complaint Portal or in writing. OCR investigates HIPAA violations and can impose corrective action plans and financial penalties on hospitals that fail to comply with access rules.