For most medical records, keep your personal copies for at least seven to ten years after treatment ends. That window covers the longest IRS audit period, overlaps with the retention rules most states impose on providers, and leaves a cushion for health issues that surface later. Some records deserve a permanent place in your files, and others follow their own clock tied to a specific deadline. How long to keep medical records really comes down to which category a given document falls into.
The Seven-to-Ten-Year Baseline
Seven to ten years works well for routine documents: office visit notes, lab results, imaging reports, billing statements, and prescription histories. Once a condition is fully resolved and no financial or legal strings are attached, you can start the clock.
“Fully resolved” is the part people get wrong. If you’re still being treated for something, or the bills are still moving through your insurer, the retention period hasn’t started. And if a record touches any of the specific situations below, the baseline doesn’t apply. The longer deadline controls.
Records to Keep Permanently
Some records never lose their relevance and should stay in your files for life:
- Immunization history. Proof of vaccination comes up for school enrollment, healthcare employment, international travel, and sometimes immigration applications. Reconstructing a decades-old vaccine record is slow and unreliable.
- Major surgeries and hospitalizations. Surgical reports, operative notes, and discharge summaries provide context if complications surface years later or a new surgeon needs to understand your anatomy.
- Chronic disease diagnoses. Documentation of conditions like diabetes, heart disease, or autoimmune disorders follows you through every future medical encounter, insurance application, and disability evaluation.
- Medical implants and devices. Serial numbers, manufacturer details, and implant dates matter during recalls and when the device eventually needs replacement.
- Family medical history. Notes about hereditary conditions discussed with your doctor can inform genetic screening and preventive care for you and your children.
Digitally, these take up almost no space. The cost of keeping them is zero; the cost of not having them when you need them can be enormous.
Tax-Deductible Medical Expenses
If you deduct medical expenses on your federal return, the IRS expects receipts and proof of payment. The standard audit window is three years from the date you filed. If you underreport income by more than 25% of your gross income, the window stretches to six years. If you claim a loss from worthless securities or a bad debt deduction on the same return, the window is seven.1Internal Revenue Service. How Long Should I Keep Records Keeping medical expense records for seven years covers every scenario.
Medical expenses are only deductible to the extent they exceed 7.5% of your adjusted gross income, so the records that matter most are the ones that push you over that threshold: large hospital bills, dental work, surgery costs, and ongoing prescriptions.2Internal Revenue Service. Publication 502, Medical and Dental Expenses Keep the Explanation of Benefits statements from your insurer alongside your own receipts. They show what was paid and what you actually owed out of pocket.
Health Savings Accounts
HSAs carry a heavier documentation load than most people realize. The IRS requires you to keep records proving that every distribution was used for a qualified medical expense, that the expense wasn’t reimbursed from another source, and that you didn’t also claim it as an itemized deduction.3Internal Revenue Service. Publication 969, Health Savings Accounts and Other Tax-Favored Health Plans Because HSA funds roll over indefinitely, some people reimburse themselves years after paying a bill, which means you need the original receipt from the year the expense occurred, not just the year you took the distribution. The safest approach is to keep every HSA-related medical receipt until you’ve fully depleted the account, or for at least seven years after the tax return claiming the distribution, whichever is longer.
Children’s Medical Records
Keep a child’s medical records until at least age 20 or 21, a few years past the age of majority. Young adults often need their complete history when establishing care with new doctors, enrolling in college health plans, or joining the military. Childhood records also matter for documenting pre-existing conditions if they apply for individual health insurance or disability benefits later.
State laws on how long providers must retain pediatric records often tie the deadline to the child’s age of majority rather than the date of treatment. That extends the provider’s obligation, but you shouldn’t rely on the office still having the file when your child needs it at 22. Keep your own copies.
Work Injuries and Occupational Exposure
Workers’ compensation filing deadlines vary by state but typically fall in the one-to-three-year range from the date of injury. For occupational illnesses that develop slowly (hearing loss, repetitive strain, effects of chemical exposure), the clock often doesn’t start until you know the condition is work-related, which can push the window out much further. Hold onto medical documentation from a workplace injury for at least five to seven years to cover both the filing deadline and any long-term complications.
Federal OSHA regulations impose a separate, much longer obligation on employers. Under 29 CFR 1910.1020, employers who maintain exposure or medical records for employees working with toxic substances or harmful physical agents must preserve those records for the duration of employment plus 30 years.4Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records If you worked around hazardous materials, your employer is required to give you access to those records at no cost.5eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records Request copies before you leave a job. Tracking down a former employer decades later is far harder than filing them now.
Legal Claims and Insurance Disputes
When medical records are tied to a legal matter (a personal injury lawsuit, a long-term disability claim, or a dispute with your insurer) keep everything until the case is fully and finally resolved. That means through any settlement, judgment, and the expiration of every appeal deadline. For long-term disability policies that pay ongoing benefits, keep records for the entire benefit period, since the insurer can request updated medical documentation at any time.
Medical Malpractice
Medical malpractice statutes of limitations range from one to six years depending on the state, but the real complication is the discovery rule. In most states, the clock doesn’t start until you knew or reasonably should have known that a provider’s negligence caused your injury. A misdiagnosis you discover five years after the fact, or a surgical instrument found inside your body a decade later, can reset the timeline. Some states impose an outer limit (a “statute of repose”) even with the discovery rule, but that limit can extend to ten years or more. If you have any reason to suspect a past medical error, keep every related record until a lawyer tells you the window has definitively closed.
Life Insurance Underwriting
Life insurance underwriters typically request five years of medical history during the application process. Having your records organized speeds up underwriting and helps you avoid surprises if the insurer’s records check turns up something you forgot to disclose. If you’re planning to apply for coverage soon, hold onto at least five years of doctor visit summaries, prescription lists, and any specialist reports.
Social Security Disability Claims
Filing for Social Security Disability Insurance is a long process, and the strength of your medical evidence often determines whether you’re approved or denied. The SSA develops a claimant’s medical history for at least 12 months before the application date, but it may look further back if there’s reason to believe the disability began earlier.6Social Security Administration. Code of Federal Regulations 404-1512 – Responsibility for Evidence
Your obligation to provide evidence is ongoing. At every level of the appeals process, you’re expected to submit all evidence you’re aware of that relates to whether you’re disabled.7Social Security Administration. Disability Evaluation Under Social Security – Part II, Evidentiary Requirements Appeals can drag on for two to three years, and the SSA needs evidence showing how long you’ve experienced your condition. Keep every medical record from the onset of symptoms forward. Gaps in treatment history are one of the most common reasons claims get denied.
If You’ve Already Thrown Records Away
Losing your own copies isn’t catastrophic as long as your provider still has them, but you can’t count on that indefinitely. State laws require healthcare providers to retain adult patient records for somewhere between three and ten years after the last encounter, with seven years being the most common benchmark. Practices close, merge, change ownership, and migrate to new electronic systems. Once a provider’s retention obligation expires and the records are destroyed, they’re gone.
While the records still exist, federal law gives you the right to access and obtain copies of your protected health information, including medical records, billing records, lab results, clinical notes, and insurance claims data.8U.S. Department of Health and Human Services. What Personal Health Information Do Individuals Have a Right Under HIPAA to Access from Their Health Care Providers and Health Plans Contact the provider’s medical records department; most facilities require a written request or a specific release form. The provider must respond within 30 days.9eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information If you’ve been meaning to request copies of old records, do it sooner rather than later.
Disposing of Records You No Longer Need
When a record has outlived its usefulness, don’t just toss it. Medical identity theft can result in a stranger’s health information getting mixed into your medical file, which can affect the care you receive, exhaust your insurance benefits, or land you with debt collection notices for services you never had.10Consumer Advice (FTC). What to Know About Medical Identity Theft Cleaning up a corrupted medical record is extraordinarily difficult because providers are reluctant to alter clinical documentation.
For paper records, use a cross-cut shredder. Strip-cut shredders produce long ribbons that can be reassembled with enough patience. Many communities hold periodic shredding events, and some office supply stores offer the service for a small fee.
Digital records take more deliberate destruction. Deleting a file from your computer doesn’t erase the underlying data; it just removes the pointer to it. Use disk-wiping software that overwrites the data multiple times. For old hard drives, USB sticks, or CDs you’re discarding, physical destruction is the only guarantee.