How long medical facilities must keep records on minors is set by state law, and most states require the chart to be held until several years past the age of majority. The most common cutoff is age 21, but some states push it to 28 or beyond depending on the record type. For a child treated at age two, that can mean anywhere from about 18 years to more than 25 years from the date of care.
Why State Law Controls the Answer
There is no single federal retention period for a child’s clinical chart. HIPAA sets national privacy standards but explicitly does not tell providers how long to keep records. The U.S. Department of Health and Human Services has stated directly that “the HIPAA Privacy Rule does not include medical record retention requirements” and that “state laws generally govern how long medical records are to be retained.”1U.S. Department of Health & Human Services. Does the HIPAA Privacy Rule Require Covered Entities to Keep Patients Medical Records for Any Period of Time?
HIPAA does require a six-year retention period, but only for internal compliance paperwork like privacy policies and records of actions taken under the Privacy Rule.2eCFR. 45 CFR 164.530 – Administrative Requirements That has nothing to do with your child’s clinical chart.
One federal floor does apply to most hospitals. Medicare’s Conditions of Participation require participating hospitals to retain medical records “for a period of at least 5 years.”3eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services Since nearly every U.S. hospital accepts Medicare, that five-year minimum acts as a practical baseline for hospital records. For a minor, state law almost always requires a longer period, so the state rule is the one that matters. Independent physician offices and outpatient clinics that don’t take Medicare aren’t bound by the federal floor at all and follow state law entirely.
How the Retention Math Works
Two state-law concepts drive every retention formula. The first is the age of majority, which is 18 in most states, 19 in Alabama and Nebraska, and 21 in Mississippi.4Legal Information Institute. Age of Majority The second is the statute of limitations for medical malpractice or personal injury. For minors, that limitations clock is typically paused until the child reaches the age of majority and then runs for an additional period, often two or three years. States build their retention rules to keep records available through that entire window, so that a young adult who later discovers childhood harm can still get the documentation.
Across the 50 states, the range works out to roughly one to thirteen years past the age of majority. The most common requirement keeps records until the former minor turns 21.
Many states use a “whichever is later” formula that combines two independent minimums. A rule might require records to be kept for ten years from the last visit or until the patient turns 21, whichever comes later. That clause matters most for very young children. A four-year-old treated under a straight ten-year rule would have records destroyed at 14, well before they could make their own legal decisions. The “whichever is later” phrasing pushes the deadline out to 21. Some states go further and require retention until 28 or longer for certain record types.
The trigger date varies too. Some states start counting from the date of the last treatment, others from the date of discharge, and a few from the date the record was created. That distinction can move the destruction date by months or years.
Records That Are Kept Longer
Immunization Records
Immunization records usually outlast the rest of the chart. Many states require them to be kept longer, and most states also run immunization information systems (IIS), which are population-based databases that capture doses administered by participating providers.5Centers for Disease Control and Prevention. IIS Frequently Asked Questions These registries function as a near-permanent vaccination record for school, employment, and international travel long after the original provider’s file is gone. The practical advice: treat your child’s immunization record as permanent and keep your own copy, because reconstructing it later can be difficult or impossible.
Mental Health Records
Mental health records for minors often carry stricter retention and access rules. Some states impose longer retention periods, and access can be tighter even while the child is still a minor. Under HIPAA, if a minor lawfully consented to their own mental health treatment without needing parental permission, the provider may restrict parental access to those specific records.6HHS.gov. Personal Representatives and Minors Many states allow adolescents, often those 12 and older, to consent independently to mental health or substance use care, which can create a subset of the chart parents cannot see.
When a Practice Closes or a Doctor Retires
A retirement or clinic closure does not erase the retention obligation. Records still have to be held for whatever period state law requires, and someone has to be responsible for them. Most states require the departing provider to designate a custodian, whether a colleague, a successor practice, or a third-party storage company, to store the records, respond to patient requests, and meet the retention deadline.
Many states also require advance notice to patients, typically 30 to 60 days before closing, through direct mail, office signage, a website notice, or a local newspaper announcement. The notice should explain when the practice is closing, how to request copies or transfers, and how to reach the new custodian. Some states also require the provider to file a record disposition plan with the licensing agency.
This is where childhood records are most vulnerable. A solo practitioner who retires when your child is eight might hand records to a storage company that later goes out of business or loses track of them. If a provider announces a closure, request a complete copy of your child’s records right away rather than counting on the custodian chain to hold up for another decade.
After a Minor Dies
If a minor dies before reaching the age of majority, the records don’t become fair game for immediate destruction. HIPAA’s privacy protections continue to apply to a deceased person’s health information for 50 years after death.7eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules An executor, administrator, or other person with legal authority over the child’s estate is treated as the personal representative who can access and authorize release of the records.8U.S. Department of Health & Human Services. Health Information of Deceased Individuals
The 50-year rule is a privacy protection, not a retention mandate. It governs how the records must be protected if they still exist. How long the facility is actually required to keep them still depends on state law, and in most states the retention period for a deceased minor runs from the date of the last encounter or the date of death rather than a future age-of-majority date that will never arrive. Request copies promptly if you may need them.
Getting Copies of Your Child’s Records
While Your Child Is a Minor
While the child is an unemancipated minor, HIPAA generally treats a parent, guardian, or person acting in that role as the child’s “personal representative,” with the right to access the health information and authorize its release.7eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules There are exceptions. A provider may deny access when the minor lawfully consented to care on their own, when the care was court-ordered, or when the parent agreed to a confidential provider-patient relationship for the child. State law can also block disclosure in specific situations, and HIPAA defers to those state restrictions.
Once Your Child Turns 18
When the child reaches the age of majority, every right over the record transfers to the now-adult patient. The former minor gains full authority over records created during childhood, including who else gets to see them.6HHS.gov. Personal Representatives and Minors Parents lose access at that point regardless of who paid for insurance or brought the child to appointments, and providers are legally required to deny parental requests without the adult child’s written authorization.
Timeline and Fees
Whether you’re a parent asking for a minor child’s records or an adult asking for your own childhood records, HIPAA gives you a legally enforceable right of access. A covered entity must respond within 30 calendar days. If the records are archived offsite or otherwise not readily available, the facility can take one 30-day extension, but it has to notify you in writing of the delay and the expected completion date.9U.S. Department of Health & Human Services. Individuals Right Under HIPAA to Access Their Health Information
Facilities can charge a reasonable, cost-based fee, but only for copy labor, supplies like a CD or USB drive, and postage if you want copies mailed. For electronic copies of records already maintained electronically, many facilities use HIPAA’s flat-fee option, which caps the total charge at $6.50 inclusive of labor, supplies, and postage.9U.S. Department of Health & Human Services. Individuals Right Under HIPAA to Access Their Health Information State laws sometimes set their own per-page fee caps for paper copies, and those vary widely. Request electronic copies when you can. They’re cheaper and easier to keep.
Keep Your Own Copies
Retention rules protect a window of access, not a guarantee. Storage companies fail, custodians move, and a chart that met every legal requirement can still be gone when you go looking for it fifteen years later. Ask for copies of the important documents while the practice is still open and easy to reach, especially surgical reports, hospital discharge summaries, imaging results, birth records, and anything related to an adverse reaction or complication. Once those are in your own file, the state’s retention deadline stops being your problem.