Most healthcare providers must keep adult medical records for somewhere between five and ten years after your last date of treatment, but how long medical records need to be kept is set by the state where the care was provided, not by federal law. Records for children are held much longer, often until years after the patient turns 18. Hospitals that participate in Medicare face a separate five-year federal minimum, and a handful of states require indefinite retention or have no explicit rule at all.
HIPAA Does Not Set a Retention Period for Your Chart
The Health Insurance Portability and Accountability Act protects the privacy and security of your health information, but it does not tell providers how many years to keep your medical chart. The Department of Health and Human Services has said this plainly: “the HIPAA Privacy Rule does not include medical record retention requirements” and “State laws generally govern how long medical records are to be retained.”1U.S. Department of Health & Human Services. Does the HIPAA Privacy Rule Require Covered Entities to Keep Patients’ Medical Records for Any Period of Time?
One federal HIPAA rule gets confused with clinical retention and shouldn’t be. Covered entities must keep their own compliance documentation, meaning internal policies, procedures, and records of Privacy Rule actions, for at least six years.2eCFR. 45 CFR 164.530 – Administrative Requirements That six-year clock covers a provider’s administrative paperwork. It does not cover your medical chart, and there is no federal six-year floor for clinical records.
Why the Retention Period Depends on the State
Because HIPAA leaves the question open, each state sets its own minimum through statute or regulation. Those timeframes track closely with the state’s statute of limitations for medical malpractice, and for a straightforward reason: if a patient has a certain number of years to sue after an injury, the provider needs the record on hand at least that long to defend the case. Malpractice limitation periods vary widely by state, so retention rules do too.
Many states also apply a “discovery rule” that extends the effective retention window when the patient couldn’t have reasonably known about the injury right away. On top of that, providers who participate in federal programs or carry professional liability insurance may face requirements that exceed the state minimum. In practice, providers follow the longest applicable rule, whether it comes from state law, a federal program, or their insurer.
How Long Adult Records Are Typically Kept
For adult patients, the most common minimum sits between five and ten years after the patient’s last visit, discharge, or treatment. The clock starts from that last interaction, not from the day the record was first created. Someone who saw a doctor regularly for a decade and then stopped would have the retention period begin on the date of the final appointment.
Some states cluster near the shorter end of that range, others near the longer end. A small number require indefinite retention or have no explicit statute, which effectively leaves the decision to the provider’s own policy. The rule that applies to your records is set by the state where the care was provided, not the state where you now live. If you moved and need old records, check the retention law in the state where you were treated.
Children’s Records Are Kept Much Longer
Records for minor patients are held far longer than adult records because the malpractice statute of limitations usually does not begin to run while the patient is still a child. In most states, the clock starts when the minor reaches the age of majority, which is 18 in most states and 21 in a few. The provider then adds the standard adult retention period on top of that.
The math can produce surprisingly long requirements. In a state with a two-year malpractice statute, a record created at birth might need to be retained for 20 years: 18 years until the child reaches adulthood, plus two more for the limitation period. The same reasoning applies to patients who were mentally incapacitated at the time of treatment, since the malpractice clock does not start until the incapacity ends. Pediatric practices tend to err heavily on the side of longer retention as a result.
The Medicare Five-Year Floor for Hospitals
Hospitals that participate in Medicare face a separate federal minimum. The Centers for Medicare and Medicaid Services Conditions of Participation require hospitals to retain medical records “in their original or legally reproduced form for a period of at least 5 years.”3eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services This floor applies to Medicare-participating hospitals; many states impose longer periods that override it.
Medicaid and other federal healthcare programs can impose their own retention obligations, and providers who bill those programs must comply on top of state law. In a state with a ten-year retention statute, a hospital in both Medicare and Medicaid would still follow the ten-year rule because it’s the longest applicable one. The federal five-year floor matters most in the handful of states where the state period is shorter or where no state retention statute exists.
What Happens When a Practice Closes
When a physician retires or a practice shuts down, the records don’t disappear. Someone has to take custody. Usually the retiring physician, a successor practice, or a designated custodian holds the records through the remainder of the required retention period.
Professional guidelines recommend that closing practices notify patients at least 60 days before the closure date, though some states set different notice periods. The notice should include the closure date, instructions for transferring records to a new provider, and contact information for whoever will store the records going forward. Patients in active treatment or managing serious conditions should get priority notice.
If you’re trying to track down records from a practice that no longer exists, start with the state medical board or state health department. Many states require retiring physicians to tell the licensing board who will hold the records. Local or county medical societies sometimes keep lists of record custodians. If the physician was part of a hospital system, the hospital may have absorbed the records at closure.
How Records Must Be Destroyed at the End of the Retention Period
Once the retention period runs out, providers cannot just throw files away. HIPAA requires that protected health information be rendered “essentially unreadable, indecipherable, and otherwise cannot be reconstructed” before disposal. For paper records, acceptable methods include shredding, burning, or pulping. For electronic records on hard drives or other media, providers must overwrite the data with software, degauss the media with a strong magnetic field, or physically destroy the storage device.4U.S. Department of Health and Human Services. Frequently Asked Questions About the Disposal of Protected Health Information A provider can hire an outside vendor to handle destruction, but the provider remains responsible for making sure the job is done properly.
Penalties for mishandling health information, including improper disposal, fall under HIPAA’s civil monetary penalty framework, and the severity depends on the level of negligence. Violations the provider didn’t know about and couldn’t reasonably have known about carry a minimum of $145 per violation in 2026. Willful neglect that isn’t corrected within 30 days carries a minimum of $73,011 per violation, with a calendar-year cap of $2,190,294 for all violations of the same provision. Criminal penalties are also possible for knowing misuse of health information.
If Your Records Have Already Been Destroyed
If you go looking for old records and learn they were destroyed after the retention period ran out, the provider has not done anything wrong. That still leaves you needing information, whether for a disability claim, a lawsuit, or ongoing care. Several other sources may hold pieces of your medical history:
- Health insurance claims. Your insurer keeps records of every claim filed on your behalf, including dates of service, diagnosis codes, and procedures. These often go back years and can reconstruct a basic treatment timeline.
- Pharmacy records. Pharmacies typically keep prescription histories for several years, documenting what you were prescribed and when.
- Specialists and labs. If your primary care records are gone, specialists or labs you were referred to may still have their own copies, since each provider keeps records independently.
- Patient portals. If you ever used one, old messages, test results, and visit summaries may still be sitting in your account or in emailed summaries.
None of these replaces a complete chart, but together they can fill in significant gaps. For disability applications or legal claims, gather everything you can from these secondary sources and work with your current provider to document your history as thoroughly as possible.