Medical record retention periods vary significantly across jurisdictions; state law, not federal regulation, governs how long hospitals and physicians must preserve patient records. These distinctions affect record availability timelines and retrieval costs by state.
Retention periods range from three years to indefinite preservation depending on state, provider type, and patient age at treatment. The triggering event for calculating retention—discharge, last encounter, or record creation—also varies by jurisdiction.
This article covers retention requirements for all 50 states and D.C., federal baseline rules, and minor versus adult distinctions.
What Are Medical Record Retention Laws?
Medical record retention laws establish minimum preservation periods for patient records. These statutes create obligations based on multiple factors relevant to case preparation and discovery.
Core components include provider type (hospitals vs. physicians), patient age (adult vs. minor), record category, and triggering event (discharge, last encounter, or record creation).
Federal law establishes baseline requirements but does not preempt longer state periods. HIPAA requires covered entities to retain compliance documentation for six years under 45 CFR 164.316(b)(2)(i). CMS Conditions of Participation require hospitals participating in Medicare to retain records for at least five years per 42 CFR 482.24(b)(1). State statutes impose specific requirements that vary substantially by jurisdiction, as detailed in the following section.
State-by-State Medical Record Retention Requirements
The following table provides the primary statutory reference for medical record retention across all U.S. jurisdictions. Requirements differ between hospital and physician settings, with additional provisions for minor patients.
All statutes verified as of January 2026. Confirm current status with state health departments or licensing boards before relying on specific timelines.
Iowa provides Medicaid-specific guidance only. Michigan requires 15 years for certain sensitive records per MCL 333.16213.§Pennsylvania's majority age of 21 creates 28-year retention.
Federal Retention Requirements and HIPAA
Federal law establishes baseline requirements that interact with, but do not replace, state retention obligations. These federal minimums apply across all states, with longer state periods controlling when conflicts arise:
- HIPAA Documentation (6 years): Applies to compliance documentation per 45 CFR 164.316(b)(2)(i)—not clinical patient records.
- Medicare Conditions of Participation (5 years): Per 42 CFR 482.24(b)(1).
- OSHA Employee Records: 30 years plus employment duration per 29 CFR 1910.1020
- CLIA Laboratory Records: 2 years minimum per 42 CFR 493.1105.
When state law requires a longer retention period than federal minimums, the longer period controls.
Retention Periods for Minor and Deceased Patient Records
Minor patient records carry extended retention obligations in most states, with age thresholds ranging from 18 to 28 years.
Minor Patient Records
Most states require retention until the patient reaches age of majority plus additional years:
- Age 28: Colorado, Nebraska, Pennsylvania (which defines majority as age 21).
- Age 25: Maryland, Michigan, Mississippi.
- Age 23: District of Columbia, Idaho, Illinois, Indiana, Rhode Island.
Deceased Patient Records
Retention periods apply regardless of patient death. HIPAA protects decedent information for 50 years per 45 CFR 164.502(f). Texas uniquely measures retention from date of death. Record availability affects wrongful death case preparation, particularly in states maintaining statutory damages caps.
Statute of Limitations Considerations
In California, Florida, Iowa, Minnesota, New Jersey, Utah, Virginia, and Wisconsin, malpractice filing deadlines for minors may not begin until majority, extending the relevant retention analysis.
Recent Legislative and Regulatory Developments (2025–2026)
Several states enacted or proposed changes to medical record retention requirements during 2025-2026.
Texas Electronic Health Records Storage (Effective January 1, 2026): Texas now requires EHR storage within the United States per Senate Bill 1188, applying retroactively to all records. Texas also maintains a ten-year statute of repose that intersects with its retention framework.
New York Senate Bill S1468 (Pending — Committee): Introduced in the Senate (January 2025) and Assembly as A8905 (June 2025), this bill would expand the definition of medical records to include "all health-related records," potentially broadening retention scope. Versions of this bill have been introduced in multiple prior sessions (2015–2024) without passage.
Multi-State Retention Compliance
State-specific retention requirements create distinct obligations affecting records availability. Hospital periods range from 5 years (Montana) to permanent (New Mexico); physician periods range from 5 years (Nevada, Oklahoma) to 10 years (Arkansas, Georgia, Kansas, Montana, South Carolina). Retention periods determine record availability timelines.
Applicable retention periods determine record availability for timely record retrieval. AI-powered legal tools support medical record retrieval and documentation workflows across jurisdictions.
To learn more, request a demo.
.webp)
.webp)
