Hospitals typically keep a deceased patient’s medical records for at least five to ten years after death, though the exact period depends on the state where the hospital operates and whether it participates in Medicare. No single federal law sets one nationwide deadline. HIPAA’s privacy protections for a deceased person’s health information last 50 years from the date of death, but that rule governs who is allowed to see the records, not how long the hospital must store them.
The Federal Floor
The clearest federal rule comes from Medicare. Any hospital that accepts Medicare patients must meet the Conditions of Participation, which require medical records to be kept in original or legally reproduced form for at least five years.1eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services Because nearly every hospital in the country participates in Medicare, this five-year floor applies almost universally. Hospitals that submit Medicare cost reports must keep patient records for at least five years after the cost report closes, and those participating in Medicare managed care programs face a ten-year requirement.2Centers for Medicare & Medicaid Services. Medical Record Retention and Media Format for Medical Records
People often assume HIPAA itself requires a six-year retention of medical records. It does not. The six-year rule at 45 CFR 164.530(j) applies to HIPAA administrative documents such as privacy policies, authorization forms, and internal compliance records, not to patient charts.3eCFR. 45 CFR 164.530 – Administrative Requirements Medicare and state law are what actually control how long the medical record stays on file.
What Your State Requires
Every state sets its own minimum retention period, and those minimums range from about five years at the low end to over ten years at the high end. Many states cluster around seven or ten years. Where a state’s minimum falls below the five-year Medicare floor, Medicare effectively controls for participating hospitals. Where the state demands more, the hospital must meet the longer timeline.
Here is where families often get tripped up: the retention clock usually does not start on the date of death. Most states measure the period from the date of last treatment, discharge, or record creation. Only a handful measure from the date of death. If your relative’s final hospital stay was three years before they died, three years may already have run off the clock by the time you start looking.
Records for children are treated separately. Several states require hospitals to keep a minor’s records until the child would have reached the age of majority, plus an additional period, commonly three years. This exists because minors generally cannot file legal claims on their own, and the clock on those claims does not begin until adulthood.
Given all this variation, the most useful thing you can do is call the hospital’s medical records or Health Information Management department and ask directly how long they keep records and whether the file you need still exists.
Who Is Allowed to Access the Records
HIPAA gives access rights to the deceased person’s “personal representative,” meaning whoever has legal authority to act for the decedent or the estate. In most cases that is the executor named in a will or an administrator appointed by a probate court.4HHS.gov. Health Information of Deceased Individuals The personal representative steps into the shoes of the deceased for HIPAA purposes and has the same authority to access records, authorize disclosures, or restrict use as the patient had while alive.5U.S. Department of Health & Human Services. Guidance: Personal Representatives
Family members who were involved in the deceased’s care or payment for care can sometimes receive limited information without being the personal representative. A hospital may share health information with a spouse, parent, child, or other relative when the disclosure is relevant to that person’s involvement in care or payment, and the deceased did not object while alive.4HHS.gov. Health Information of Deceased Individuals For the complete medical file, though, you almost always need formal legal authority as the personal representative.
These protections remain in force for 50 years after the date of death. After that, the information stops being protected health information under HIPAA and the privacy restrictions fall away.4HHS.gov. Health Information of Deceased Individuals
How to Request the Records
Start with the hospital’s Health Information Management or Medical Records department. Most hospitals list the department on their website, and a quick phone call will confirm how they want the request submitted, whether by mail, in person, fax, or an online portal.
Assemble everything before you submit. Missing documents are the single most common reason requests stall. You will generally need:
- A government-issued photo ID, such as a driver’s license or passport.
- Proof of legal authority, typically Letters Testamentary or Letters of Administration from the probate court naming you as executor or administrator.
- Identifying information for the deceased: full legal name, date of birth, Social Security number, and approximate dates of treatment.
- A certified copy of the death certificate.
- The hospital’s own “Authorization for Release of Health Information” form, completed and signed.
If you have not yet been appointed personal representative, you will need to open probate first, which can take weeks or months depending on the jurisdiction.
Response Times and Fees
Under HIPAA, the hospital has 30 calendar days from receipt to respond to your request. If it cannot meet that deadline, for example because the records are archived offsite, it may take one additional 30-day extension, and only if it sends you a written explanation of the delay and a date by which it will provide access. Only one extension is permitted.6HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524
Hospitals can charge a reasonable, cost-based fee for copies. Under HIPAA, that fee can cover only the labor of copying, supplies such as paper or a USB drive, and postage if you request mailing. It cannot include costs for searching and retrieving the record, maintaining data systems, or verifying your identity.6HHS.gov. Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 Many states add their own fee caps on top, and per-page rates vary widely. Requesting an electronic copy rather than paper is usually cheaper and often eliminates per-page charges altogether.
If the Hospital Says No
Denials happen, and the reasons are not always sound. Legitimate ones include incomplete proof of your legal authority, a documented preference by the deceased against disclosure, or a request that reaches into psychotherapy notes, which are separately protected. Not legitimate: the hospital claiming records cannot be released simply because the patient is deceased.
If you think the denial is wrong, ask the hospital’s Privacy Officer for a written explanation identifying the specific HIPAA provision being relied on. HIPAA requires a written denial with that information.
If that does not fix it, file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which enforces HIPAA. You can file through the OCR Complaint Portal online, by email at OCRComplaint@hhs.gov, or by mail. The deadline is 180 days from when you learned about the denial, though OCR can extend it for good cause.7HHS. How to File a Health Information Privacy or Security Complaint
If the Hospital Has Closed
A hospital shutting down does not mean its records vanish. When a facility closes, it remains responsible for making sure patient records are properly stored for the rest of the legal retention period. In practice, records are usually transferred to another healthcare provider that agrees to take custody, or archived with a commercial storage firm that handles medical records. Some states require the hospital to notify the state health department of where the records will be kept and who the custodian will be.
If you need records from a hospital that no longer exists, start with your state’s health department or hospital licensing agency. They can often point you to the current custodian. Some states maintain a registry of closed facilities and their successor custodians. If the hospital was acquired or merged, the acquiring system usually inherits the records.
Act Before the Records Are Gone
Once the retention period runs, hospitals lawfully destroy records, and there is no way to recover them afterward. If you have any reason to think you might need a deceased relative’s chart, whether for probate, a life insurance claim, a suspected medical malpractice question, or family medical history, submit the request as soon as you have the legal authority to do so. Waiting is the one mistake with no remedy.