By law, healthcare providers generally have to keep your medical records for at least five to ten years after your last visit, with the exact number set by the state where you received care. There is no single federal rule that answers how long you have to keep medical records by law across the board, and several federal programs add their own longer floors on top of state minimums. For your own personal copies, no law sets a minimum at all.
State Law Sets the Baseline for Providers
State law is the primary authority telling doctors, hospitals, and other licensed providers how long to hold onto patient records. Every state sets its own minimum, and most land somewhere between five and ten years after the provider’s last contact with the patient.1Triage Cancer. Accessing State Laws: Medical Records Some states start the clock at the last visit; others start it at the last entry in the chart.
These rules live in each state’s public health code, medical board regulations, or administrative rules, and they often set different timelines for hospitals, individual physicians, nursing homes, and surgical centers. A provider operating in more than one state has to comply with each state’s rule for records created there. The only reliable way to pin down the exact number for a specific record is to check the law in the state where care was delivered.
Federal Rules That Extend Retention
Federal law usually doesn’t set a universal retention period for the patient chart itself, but several federal programs impose their own floors that frequently outlast whatever the state requires.
The HIPAA Six-Year Myth
A common misconception is that HIPAA requires six years of record retention. It doesn’t. The six-year HIPAA rule applies to the provider’s own compliance paperwork: privacy policies, breach notification logs, training records, and similar administrative documents.2eCFR. 45 CFR 164.530 – Administrative Requirements It says nothing about how long the actual medical chart must be stored. That job belongs to state law.
Medicare and Medicaid: Seven Years
Providers who bill Medicare Part A or Part B must keep documentation related to those services for at least seven years from the date of service.3eCFR. 42 CFR 424.516 – Additional Provider and Supplier Requirements That covers orders, certifications, referrals, prescriptions, and payment requests for covered items, services, or drugs. Because Medicare patients tend to be older and their care often spans years, the seven-year federal floor frequently outlasts what state law would have required on its own.4Centers for Medicare & Medicaid Services. Medical Record Maintenance and Access Requirements
OSHA Workplace Records: Employment Plus 30 Years
If your medical records were created through a workplace health program, retention runs much longer. OSHA requires employers to preserve employee medical and exposure records for the duration of employment plus 30 years.5Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records It applies to records of workplace chemical exposures, biological monitoring, and medical exams tied to occupational hazards. Minor first-aid records kept separately are exempt, and records for employees who worked less than a year can be handed to the employee at termination instead of stored.
Clinical Trial Records
Investigators running FDA-regulated clinical trials must retain participant records for at least two years after a marketing application is approved for the drug being studied. If no application is filed or the application is denied, records must be kept for two years after the investigation ends and the FDA is notified.6eCFR. 21 CFR 312.62 – Investigator Recordkeeping and Record Retention If you participated in a trial, those records may outlast your regular care records.
When Retention Runs Longer Than the Baseline
Records for Children
A child’s chart almost always carries a longer requirement than an adult’s. Most states require providers to keep a minor’s records until the child reaches the age of majority (18 in most states, 21 in a few) plus the state’s standard retention period or its medical malpractice statute of limitations, whichever produces the later date.1Triage Cancer. Accessing State Laws: Medical Records The American Academy of Pediatrics recommends retaining pediatric records for at least 10 years or until the age of majority plus the applicable statute of limitations, whichever is longer.7American Academy of Pediatrics. Medical Record Retention A newborn’s file might need to stay on the shelf for two decades or more.
Records After a Patient Dies
The clock doesn’t stop the moment a patient dies. Most states require providers to keep a deceased patient’s records for the same period that would have applied had the patient remained alive, measured from the date of death. In practice, that means five to ten years after death in most jurisdictions, though the exact number depends on state law.
Malpractice Exposure and the Discovery Rule
Many providers hold records past the statutory minimum to guard against malpractice claims. States typically give patients one to four years to file, but under the discovery rule used in most states, the clock starts when the patient discovers (or reasonably should have discovered) both the injury and its link to the provider’s care. A retained surgical instrument or a missed diagnosis that surfaces years later can push the filing deadline well past the standard retention period, and providers who know this often keep records considerably longer than the statutory floor.
How Long You Should Keep Your Own Records
No law tells you how long to keep your personal medical records. Providers can and do destroy records once their retention obligation expires, and you cannot always count on getting copies later. Your own file is the best hedge against that.
Some records are worth keeping permanently:
- Vaccination records, which can be required for school enrollment, travel, or employment decades after the shots were given.
- Surgical and hospitalization reports, so future providers know about prior procedures, implants, and serious illnesses.
- Major diagnoses and pathology reports for conditions like cancer, cardiac events, or chronic disease.
- Family medical history documentation, useful for genetic screening and risk assessment for you and your children.
Routine office visit notes, lab work from annual physicals, and billing statements can usually be trimmed after a few years. The exception is anything tied to an ongoing insurance claim, a legal case, or a workers’ compensation matter. Keep those until the matter is fully resolved and any appeal window has closed.
Medical Records for Tax Purposes
If you deduct medical expenses on your federal return, the IRS expects you to keep receipts and supporting records for at least three years from the date you filed the return claiming the deduction. That three-year window is the general audit period. If you underreported income by more than 25%, the IRS has six years to assess additional tax, and there is no time limit at all if a return was fraudulent or never filed.8Internal Revenue Service. Topic No. 305, Recordkeeping Keeping medical receipts and explanation-of-benefits statements for at least six years is a reasonable middle ground.
What Happens When a Practice Closes
Retention obligations don’t end when a doctor retires or a practice shuts down. State medical boards generally require departing providers to give patients reasonable advance notice, often at least 30 days, so patients can request records or transfer them. Active patients should receive direct notification by letter, and many boards also recommend public announcements through websites, local newspapers, or office postings.
The closing provider stays responsible for storing records through the end of the state’s required retention period, even after the doors close. Some transfer unclaimed records to another practice, a medical records storage company, or a state medical board archive. If a former provider has closed and you need records, the state medical board or department of health can often tell you where the records ended up.
A Note on Disposal
Once the retention period ends, providers cannot simply throw records away. HIPAA requires that protected health information be rendered unreadable and unreconstructable before disposal, whether through shredding, burning, pulverizing, or securely wiping electronic media.9HHS. Frequently Asked Questions About the Disposal of Protected Health Information So while records may eventually be destroyed, they should never surface in a dumpster or on a resold hard drive.