How long doctors have to keep medical records depends mostly on state law, and for adult patients the typical minimum runs from five to ten years after your last visit. Seven years is the most common state floor, and if your doctor bills Medicare, federal rules push the practical minimum to at least seven years regardless of where you live. Records for children are held much longer, and privacy protections for a deceased patient’s information last 50 years. There is no single national retention period, and HIPAA, despite what many people assume, does not set one.
State Minimums for Adult Records
The main rules on how long a doctor keeps your chart come from state law. Every state sets its own minimum, and the numbers vary based on the type of provider (hospital versus private physician), the event that starts the clock (last visit, discharge, or the date the record was created), and whether the patient is an adult or a minor. State medical boards and departments of health enforce these requirements.
For adult patients, seven years from the last patient encounter is the most common minimum. A handful of states set the floor at five years. A few require ten years or more. New Mexico requires permanent retention of hospital records. Some states also apply longer requirements to hospitals than to private practices.
These are minimums, not ceilings. Many providers keep records well beyond the legal floor because malpractice insurers recommend it and because destroying a record that might later be needed in a lawsuit is a risk few doctors want to take. To confirm the rule where you received care, check with your state medical board or department of health, since these timelines are updated periodically.
Medicare Providers Face a Federal Floor
Doctors and hospitals that bill Medicare have to follow a separate layer of federal record-keeping rules, and the timelines depend on the type of Medicare program involved.
- Anyone who furnishes or orders Medicare Part A or Part B services must keep documentation for seven years from the date of service and produce it upon CMS request.1eCFR. 42 CFR 424.516 – Additional Provider and Supplier Requirements
- Providers who submit cost reports must retain patient records for at least five years after the cost report closes.2Centers for Medicare & Medicaid Services. Medical Record Retention and Media Format for Medical Records
- Medicare Advantage organizations must maintain books, records, and documents for ten years, and CMS’s audit rights extend through ten years from the end of the final contract period or completion of an audit, whichever is later.3eCFR. 42 CFR 422.504 – Contract Provisions
The upshot for most adult patients: if your doctor takes Medicare, your records are almost certainly held for at least seven years, no matter what the state minimum says.
Records for Children Are Held Much Longer
Pediatric records get the longest retention. States recognize that a child treated at age three may not need the record until decades later, so the standard approach is to keep the chart until the patient reaches the age of majority (usually 18) plus a set number of additional years. A common formula is age 18 plus seven more, meaning the record cannot be destroyed before the patient turns 25.
This lines up with medical malpractice statutes of limitations. In most states, the clock for a minor to file a malpractice claim does not start until they turn 18. A two-year limitations period would allow a claim to be filed as late as age 20, and the record has to be intact to defend against it. Some malpractice insurers recommend keeping pediatric records even longer to account for state discovery rules that can push filing deadlines further out.
After a Patient Dies
A patient’s death does not end the privacy protections on their records. Under HIPAA, a deceased person’s health information stays protected for 50 years after the date of death.4HHS.gov. Health Information of Deceased Individuals After that, the information is no longer considered protected health information.
During those 50 years, a personal representative of the deceased, typically the executor of the estate or someone authorized under state law to act for the estate, can exercise the same access rights the patient would have had, including requesting copies.4HHS.gov. Health Information of Deceased Individuals The Privacy Rule also lets providers share relevant information with family members who were involved in the patient’s care before death, unless the patient had previously said otherwise.
One important limit: the 50-year HIPAA rule is about privacy, not storage. A provider is not required to hold the physical records for 50 years. The state retention minimum still governs how long the chart itself must exist. If the record does still exist during that window, HIPAA’s protections continue to apply.
What HIPAA Does and Does Not Require
A common misconception is that HIPAA tells doctors how long to hold your medical chart. It does not. The HIPAA Privacy Rule protects the privacy and security of health information for as long as a provider happens to hold it, but it sets no minimum retention period for the medical record itself.5HHS.gov. Does HIPAA Require Covered Entities to Keep Medical Records for Any Period
HIPAA does impose a six-year clock on the administrative side. Providers must keep their HIPAA policies, procedures, and written communications (things like signed patient authorizations) for six years from the date of creation or the date the document was last in effect, whichever is later.6eCFR. 45 CFR 164.530 – Administrative Requirements That rule applies to compliance paperwork, not to the clinical notes and test results in your chart.
What Happens When a Practice Closes
Doctors cannot walk away from patient records when they shut down a practice. Professional ethics and most state medical board rules require them to keep the records accessible for the full retention period that applies.
In practice, a closing provider will do one or more of the following: transfer the records to a physician taking over the practice, hire a commercial records storage company as custodian, or arrange for a local hospital system to hold them. The provider must notify patients in advance, usually at least 60 days before closing, with instructions on how to obtain copies and where the originals will be stored.
If a doctor disappears without warning and you cannot find your records, contact your state medical board. Boards must be notified of anticipated closures and can often point you to the current custodian. Your state or local department of health may also have information. Persistence matters here. Records rarely vanish completely; someone almost always ends up holding them.
Getting a Copy While the Records Still Exist
As long as the retention period has not expired, you have a right to request your records. Start with the provider’s office or the hospital’s health information management department. Most facilities will ask you to complete a written authorization form with your full name, date of birth, and the specific dates of service you need. The more specific your request, the faster it moves.
Under HIPAA, the provider must respond within 30 calendar days. If they cannot meet that deadline, they may extend once by another 30 days, but they must notify you in writing within the original 30 days with the reason and a new deadline.7HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information Only one extension is allowed per request.
If a provider refuses to give you your records, ignores your request, or charges fees that look unreasonable, you can file a complaint with the HHS Office for Civil Rights through its online portal or in writing.8HHS.gov. Filing a Health Information Privacy Complaint Before going that route, it often helps to put your request in writing, cite HIPAA’s 30-day deadline, and ask to speak with the office’s privacy officer. Many denials come from administrative confusion rather than a real refusal, and a clear written request that references your federal rights usually resolves it.