How Long Do Hospitals Keep Medical Records?

A records request is sent for a surgery performed nine years ago, and the hospital's HIM department responds that the file has been purged. The case hinges on operative notes that no longer exist. For PI and medical malpractice teams, the question is whether the records a case needs will still exist at the moment of request.

Two layers govern that availability. Federal and state retention statutes set a legal floor, while hospital policy and record-type variation create the operational ceiling. These layers diverge here: Most hospitals retain records well beyond statutory minimums, but certain profiles, including latent injury and pediatric malpractice matters, routinely encounter destroyed records before legal needs end.

This article covers the retention drivers, why hospital practice typically exceeds statute, where the gap creates case risk, record-type realities, and how to verify availability before the formal request.

What Federal and State Laws Govern Hospital Record Retention?

Three federal regulations establish the baseline for how long hospitals keep medical records, each applying to different provider types and document categories. State statutes layer on top, and hospital policy operates above both.

• 42 CFR § 482.24(b)(1) requires Medicare-participating hospitals to retain medical records for at least five years. The CMS Interpretive Guidelines confirm this is a floor: records must be kept "at least 5 years, or more if required by State or local laws."
• 45 CFR § 164.530(j)(2) sets a six-year retention period for HIPAA compliance documentation: policies, procedures, privacy notices, and complaint dispositions. This regulation does not govern patient medical records, a persistent source of confusion.
• 42 CFR § 422.504(d) requires Medicare Advantage organizations to retain records for 10 years, and extends that obligation to records held by related entities, contractors, and subcontractors. The 10-year rule matters for hospitals acting in MA contractual or downstream roles, not as a general hospital-wide default.

State statutory minimums vary widely by provider type and state framework, including three-year minimums in some Montana scenarios. A reference covering each state's minimum provides the jurisdictional floor. The statutory minimum is a compliance threshold, not a representation of what the hospital actually holds.

Why Do Hospital Retention Periods Usually Exceed Statutory Minimums?

Hospital retention policies regularly extend to 10, 20, or even 25-plus years, driven by forces unrelated to the statutory floor. These include:

• Malpractice liability tail: The Journal of Healthcare Risk Management identifies medical record retention as "the primary activity that hinges on the operation of a statute of limitations." Hospitals and their insurers recognize that malpractice claims surface years after care, and premature destruction can trigger spoliation liability. The American Academy of Pediatrics illustrates this: in a state with a two-year SOL that does not begin until the patient turns 18, a birth injury case could be filed 20 years after delivery.
• Accreditation standards: Joint Commission standard RC.11.03.01 delegates retention duration to "hospital policy, in accordance with law and regulation," setting no ceiling. AHIMA recommends 10 years after the most recent encounter for adult patient records, double the federal minimum.
• Post-EMR conversion inertia: A peer-reviewed EHR study describes legacy data conversion as "complex and stunningly expensive." Some health systems retain legacy EHR systems after migrating, rather than investing in a full conversion, thereby keeping older digital records accessible.

The University of Toledo Medical Center retains pediatric records for 25 years, with surgical and death registers kept indefinitely.

When Are Records Destroyed Before Legal Needs End?

Despite extended institutional policies, records are often lawfully destroyed before legal needs end. In some jurisdictions and for some provider types, the statutory retention period can expire before the malpractice claim window ends, particularly when tolling or discovery-rule extensions apply.

The following are examples where records are destroyed before legal needs end:

• Latent injury cases: Hospital retention schedules run from the date of last service, not from injury discovery. Mesothelioma symptoms generally do not appear for 20 or more years after exposure; OSHA's preservation rule mandates 30-year retention for occupational exposure records in response. A patient treated for respiratory symptoms in 2000 who is diagnosed with mesothelioma in 2020 may find the hospital lawfully destroyed records a decade earlier under a 10-year schedule.
• Pediatric malpractice with tolling: Many state retention statutes specify a fixed age cutoff like "until age 21" that may not account for the statute of limitations beginning to run at majority. In Ohio, some provider-type scenarios create a gap when the retention rule runs 10 years from the last encounter while the malpractice timing framework leaves the claim window running to age 19. Outcomes vary across providers, states, and case facts.
• Pre-EMR scanning losses: AHIMA's imaging guidance acknowledges that no set standards govern how long converted records are maintained after scanning. AHIMA's EHR integrity publication warns that hybrid records create the risk of documentation existing in paper but not online, or vice versa. Fetal monitoring strips lost during paper-to-digital conversion are a documented example.
• Retention-vs.-SOL structural mismatches: Montana's three-year retention period and the District of Columbia's three-year minimum are jurisdictions where records may be destroyed within the litigation horizon, depending on the governing statute, discovery rule, tolling, and facility policy. Arizona's six-year floor covers many adult cases but may not reach delayed-discovery scenarios identified at year five or later.

The assumption that "the hospital has it" can be wrong even within the legal life of a claim. AHIMA's spoliation practice brief states that destroying records pursuant to a proper retention program is not spoliation. A latent-injury plaintiff may have no viable spoliation remedy where destruction occurred lawfully before any duty to preserve arose.

Which Records Have Different Retention Realities Than General Hospital Policy?

A general inquiry about "records from 2015" may yield different results depending on the record category. Retention timelines and destruction risks vary significantly by type.

Radiology Imaging Studies

42 CFR § 482.26(d) requires hospitals to retain radiology images for five years. DICOM files are far more expensive to store than text-based records, creating institutional pressure to purge at the regulatory minimum, and PACS platform migrations can result in incomplete transfer of older studies. A SIIM 2024 abstract found that providers accessed over 201,000 imaging studies older than 10 years during a two-year period, confirming clinical use beyond typical retention floors.

Pathology Records and Tissue Slides

Federal CLIA standards at 42 CFR § 493.1105 impose 10-year retention for pathology test reports and histopathology slides, but only two years for specimen blocks. The diagnostic artifact outlasts the physical specimen by eight years.

Mental Health and SUD Records

42 CFR Part 2 governs substance use disorder records. In February 2024, HHS issued a final rule aligning certain aspects of Part 2 more closely with HIPAA, with compliance mandatory February 16, 2026. Part 2 operates primarily as a confidentiality framework rather than a retention schedule, so retention length depends on state law, provider setting, and record category. Federal CoPs also do not specify a separate psychiatric record retention period.

Obstetric and Fetal Monitoring Records

AHIMA recommends retaining fetal heart monitor records for 10 years past majority, reflecting the extended tail of birth injury litigation.

Cancer Registry Records

State tumor registries, mandated by statutes like the Texas Cancer Reporting Act, retain data indefinitely for epidemiological purposes. Hospital-based registry records follow shorter schedules, but state-level data persists as an independent source.

How Can Legal Teams Verify Record Availability Before Sending a Request?

A pre-request inquiry to the hospital's HIM department is the most cost-effective step for cases with older injury dates. Confirming a patient's presence in the master patient index establishes that the patient was treated; it does not confirm that the record still exists. Both questions must be asked separately.

Frame the call as a pre-request availability inquiry, not a formal records submission. This prevents triggering the release-of-information workflow while allowing HIM staff to answer administrative questions. Areas to cover:

• Whether the master patient index has a record for the patient at the relevant date range
• Whether records from that period are still available, archived, or destroyed
• Whether the facility converted from paper to electronic records and, if so, whether pre-conversion records are accessible
• Which record types are available for that date range: operative reports, nursing notes, radiology images, discharge summaries
• Whether radiology images require a separate request to a different department

Document every call in a structured log: date, staff member contacted, MPI confirmation status, record types confirmed, format, and authorization requirements. That record may become useful documentation if discovery later reveals gaps in production.

For intake on cases with older injury dates or latent-injury profiles, build verification into the workflow before authorizations are prepared. Record retrieval timelines extend further when pre-EHR records require off-site storage retrieval; confirming this during the pre-request call prevents delays after the formal request is submitted.

What Should a Firm Do When Hospital Records Have Been Destroyed?

Confirmed destruction does not end the evidentiary path. Parallel sources hold information that reconstructs the treatment timeline independently of the hospital chart.

Hospital Billing Records

Patient Financial Services maintains billing data on a separate, often longer retention schedule than clinical records. Itemized bills contain ICD diagnosis codes, CPT procedure codes, dates of service, and NPI numbers for every clinician involved. Each NPI creates a path to that provider's independent records. Send a separate HIPAA authorization to billing; it operates independently from HIM.

Pharmacy Records

Prescription records document prescribing physicians, medications, dosages, and dispensing dates. These are maintained independently by each pharmacy and are not subject to hospital retention schedules. State prescription drug monitoring programs maintain controlled substance records as independent databases.

Referring Provider Files

Discharge summaries and operative reports are routinely transmitted to referring physicians at discharge. These copies are not subject to the hospital's destruction authority and may survive long after the hospital purges its own records.

Health Insurer Claims Data

EOBs, pre-authorization records, and utilization review files are often retained independently for seven to 10 years, though actual retention depends on payer policy. Pre-authorization records may contain clinical summaries the hospital submitted to justify care. For Medicare beneficiaries, CMS maintains claims records accessible through a FOIA/Privacy Act request.

State Health Information Exchanges

HIEs may hold copies or summary records transmitted between providers before destruction, but availability depends on provider participation and the applicable consent model. Gaps may reflect nonparticipation or summary-level exchange rather than absence of care.

Request an affidavit of records destruction from the hospital's HIM custodian. AHIMA's ROI Toolkit confirms that HIM professionals may provide information in affidavit form for legal proceedings. When third-party custodians require formal process, subpoena procedures under 45 CFR 164.512(e) govern production from covered entities.

Statute, Policy, and the Records That Survive

Statute sets the floor, hospital policy sets the practical ceiling, and the gap between them determines whether the records a case needs will exist at the time of request. Risk concentrates in latent injury, pediatric malpractice, and pre-EMR-era matters. Pre-request verification and record-type-specific planning make that risk manageable rather than terminal.

Tavrn's retrieval workflow platform helps PI and medical malpractice teams track record requests across facilities, flag availability gaps at intake, and reduce the cycle time between request and case-ready documentation.

Request a demo.