Medical record retention periods vary significantly across jurisdictions; state law, not federal regulation, governs how long hospitals and physicians must preserve patient records. These distinctions affect record availability timelines and retrieval costs by state.
Retention periods range from three years to indefinite preservation depending on state, provider type, and patient age at treatment. The triggering event for calculating retention, whether discharge, last encounter, or record creation, also varies by jurisdiction.
This article covers retention requirements for all 50 states and D.C., federal baseline rules, and minor versus adult distinctions.
What Are Medical Record Retention Laws?
Medical record retention laws establish minimum preservation periods for patient records. These statutes create obligations based on multiple factors relevant to case preparation and discovery.
Core components include provider type (hospitals vs. physicians), patient age (adult vs. minor), record category, and triggering event (discharge, last encounter, or record creation).
Federal law establishes baseline requirements but does not preempt longer state periods. HIPAA requires covered entities to retain compliance documentation for six years under 45 CFR 164.316(b)(2)(i). CMS Conditions of Participation require hospitals participating in Medicare to retain records for at least five years per 42 CFR 482.24(b)(1). State statutes impose specific requirements that vary substantially by jurisdiction, as detailed in the following section.
State-by-State Medical Record Retention Requirements
The following table provides the primary statutory reference for medical record retention across all U.S. jurisdictions. Requirements differ between hospital and physician settings, with additional provisions for minor patients.
All statutes verified as of June 2026. Confirm current status with state health departments or licensing boards before relying on specific timelines.
†Iowa provides Medicaid-specific guidance only. ‡Michigan requires 15 years for certain sensitive records per MCL 333.16213. §Pennsylvania's majority age of 21 creates 28-year retention.
Federal Requirements and HIPAA
Federal law establishes baseline requirements that interact with, but do not replace, state retention obligations. These federal minimums apply across all states, with longer state periods controlling when conflicts arise:
- HIPAA Documentation (6 years): Applies to compliance documentation per 45 CFR 164.316(b)(2)(i), not clinical patient records.
- Medicare Conditions of Participation (5 years): Per 42 CFR 482.24(b)(1).
- OSHA Employee Records: 30 years plus employment duration per 29 CFR 1910.1020.
- CLIA Laboratory Records: 2 years minimum per 42 CFR 493.1105.
When state law requires a longer retention period than federal minimums, the longer period controls.
Retention Periods for Minor and Deceased Patient Records
Minor patient records carry extended retention obligations in most states, with age thresholds ranging from 18 to 28 years.
Minor Patient Records
Most states require retention until the patient reaches age of majority plus additional years:
- Age 28: Colorado, Nebraska, Pennsylvania (which defines majority as age 21).
- Age 25: Maryland, Michigan, Mississippi.
- Age 23: District of Columbia, Idaho, Illinois, Indiana, Rhode Island.
Deceased Patient Records
Retention periods apply regardless of patient death. HIPAA protects decedent information for 50 years per 45 CFR 164.502(f). Texas uniquely measures retention from date of death. Record availability affects wrongful death case preparation, particularly in states maintaining statutory damages caps.
Statute of Limitations Considerations
In California, Florida, Iowa, Minnesota, New Jersey, Utah, Virginia, and Wisconsin, malpractice filing deadlines for minors may not begin until majority, extending the relevant retention analysis.
Recent Legislative and Regulatory Developments (2025–2026)
Several states and federal agencies enacted or proposed changes affecting medical record retention requirements during 2025-2026.
Washington Hospital Record Retention (Effective July 27, 2025): Washington now requires hospitals to retain all medical records for a minimum of 26 years from the date each record was created, regardless of patient age, under amended RCW 70.41.190. The rule replaces the prior standard of 10 years after discharge (or 3 years past a minor reaching age 18, whichever was longer) and resolved an open-ended requirement that forced indefinite storage when no discharge date existed. Records lawfully destroyed under the prior rule before the effective date are unaffected.
Texas Electronic Health Records Storage (Effective January 1, 2026): Texas now requires EHR storage within the United States per Senate Bill 1188, applying retroactively to all records. Other provisions of the bill, including role-based access controls and parental access to a minor's electronic records, took effect September 1, 2025. Texas also maintains a ten-year statute of repose that intersects with its retention framework.
Federal SUD Records Rule (Compliance Required February 16, 2026): The HHS final rule modifying the Confidentiality of Substance Use Disorder Patient Records regulations at 42 CFR Part 2 reached its compliance deadline on February 16, 2026, with the Office for Civil Rights now accepting complaints and enforcing the rule. The rule aligns Part 2 more closely with HIPAA but preserves the protection that substance use disorder records cannot be used in civil, criminal, administrative, or legislative proceedings against a patient without written consent or a court order, a point of significance for litigation involving substance-use treatment records.
New York Senate Bill S1468 / Assembly Bill A8905 (Pending): This bill would amend Public Health Law §§ 17 and 18 and the Mental Hygiene Law to expand the definition of medical records to "all health-related records," broaden which providers are covered, and limit certain copying fees. As an access-and-definition measure rather than a change to retention periods, it could indirectly widen the universe of records subject to retention if enacted. As of 2026 both versions remain referred to their respective Health Committees, with S1468 reintroduced in the 2025-2026 session and A8905 introduced in June 2025. Neither has been enacted, and versions of this bill have been introduced in multiple prior sessions without passage.
Accessing Records and Response Timelines
Retention rules govern how long records survive; a separate body of federal law governs how quickly a provider must produce them once retained. For litigation teams, the practical question is often not whether a record still exists but how fast it can be obtained, and the HIPAA right of access sets the controlling timeline.
Under 45 CFR 164.524, a covered entity must act on a request for access no later than 30 calendar days after receipt. The rule permits a single extension of up to 30 additional days, but only if the entity provides written notice of the reason for the delay and a completion date within the original 30-day window. The Office for Civil Rights treats 30 days as an outer limit rather than a target, and notes that records stored offsite or held by a records vendor do not excuse the deadline.
Fees are limited to reasonable, cost-based charges for copying labor, supplies, and postage, and may not include search or retrieval time. For electronic copies of records maintained electronically, a provider may instead charge a flat fee not to exceed $6.50. A patient or personal representative may also direct a provider to send records to a third party, such as counsel, in a signed written request, which keeps the cost-based fee limit in place.
How Medical Records May Be Destroyed
Once a record has passed its retention period and no legal hold applies, it may be destroyed, but federal law dictates how. The HIPAA Privacy Rule at 45 CFR 164.530(c) and the Security Rule at 45 CFR 164.310(d)(2) require that disposal render the information essentially unreadable, indecipherable, and unable to be reconstructed. The rules do not mandate a single method, only that the result meet that standard.
The Office for Civil Rights recognizes different approaches depending on the medium:
- Paper records: shredding (cross-cut or micro-cut), burning, pulping, or pulverizing. Strip-cut shredding alone is generally insufficient because the strips can be reassembled.
- Electronic media: clearing or purging through overwriting or degaussing, or physical destruction of the device by disintegration, pulverization, melting, incineration, or shredding. Simple deletion or reformatting leaves data recoverable and does not satisfy the standard.
Two qualifications carry particular weight for litigation. First, records subject to an open investigation, audit, or pending or anticipated litigation must not be destroyed until the matter closes, regardless of whether the retention period has lapsed; destroying them can expose a party to spoliation or obstruction claims. Second, when an outside vendor performs destruction, that vendor becomes a business associate and a signed business associate agreement must be in place before any records change hands.
Multi-State Retention Compliance
State-specific retention requirements create distinct obligations affecting records availability. Hospital periods range from 5 years (Florida, Idaho, Wyoming) to permanent (New Mexico), with Massachusetts requiring 20 years and Washington 26 years; physician periods range from 5 years (Nevada, Oklahoma) to 10 years (Arkansas, Georgia, Kansas, Montana, South Carolina). Retention periods determine record availability timelines.
Applicable retention periods determine record availability for timely record retrieval. AI-powered legal tools support medical record retrieval and documentation workflows across jurisdictions.
To learn more, book a demo.
