How Long Do Hospitals Keep Medical Records? (2026)

How long a hospital keeps your medical records depends primarily on which state the hospital operates in. Federal law sets a baseline of 5 years for Medicare-participating hospitals, but most states require longer retention periods ranging from 5 to 20 years.

This guide explains the federal requirements, how state laws vary, what types of records hospitals maintain, how to access your old records, and what happens when a hospital closes.

The Short Answer

Most hospitals keep medical records for 5 to 10 years after your last discharge or visit. The exact period depends on your state. Hospitals participating in Medicare must keep records for at least 5 years under federal regulations, but state law often requires a longer period. When state and federal requirements conflict, the hospital must follow whichever rule is stricter.

For a complete breakdown of every state's requirements, see our Medical Records Retention Laws by State guide.

Federal Requirements

Medicare Hospital Minimum: 5 Years

42 CFR 482.24(b) requires hospitals participating in Medicare to retain medical records "in their original or legally reproduced form for a period of at least 5 years." This applies to records of both inpatients and outpatients.

Medicare Provider Requirement: 7 Years

Separately, 42 CFR 424.516(f) requires Medicare providers to maintain documentation supporting Medicare billing for 7 years from the date of service. Failure to comply can result in revocation of Medicare enrollment. In practice, this 7-year requirement is the operative federal floor for most hospitals.

Hospice Records: 6 Years

Hospice programs must retain clinical records for 6 years after the death or discharge of the patient under 42 CFR 418.104, unless state law requires longer.

HIPAA Does Not Set a Retention Period

A common misconception: HIPAA does not require hospitals to keep medical records for any specific number of years. HIPAA requires retention of administrative documentation (privacy policies, training records, business associate agreements) for 6 years, but that is separate from patient records. State law controls how long actual patient medical records must be retained.

How Long by State

Retention periods for hospital records vary significantly by state.

State	Hospital Retention	Minor Records
Alabama	5 years	5 yrs after age 19
Alaska	7 years	2 yrs after age 19 or 7 yrs
Arizona	6 years	3 yrs after age 18 or 6 yrs
Arkansas	10 years	10 yrs or 2 yrs after age 18
California	7 years	1 yr after age 18 (min 7 yrs)
Colorado	10 years	Until age 28
Connecticut	10 years	Same as adult
Florida	5 years	Same as adult
Illinois	10 years	Not specified
Kansas	10 years	1 yr after majority
Kentucky	5 years	Until age 21
Louisiana	10 years	Not specified
Massachusetts	20 years	Not specified
Minnesota	Permanent (core)	Not specified
New Jersey	10 years	Until age 23
New York	6 years	Until age 19 or 6 yrs
North Carolina	11 years	Until age 30
Oregon	10 years	Not specified
Pennsylvania	7 years	Until age 19
Texas	7 years	Until age 21 or 7 yrs
Washington	10 years	Until age 21 or 10 yrs
Wisconsin	5 years	Not specified
Wyoming	3 years	Not specified

For all 50 states, see our complete Medical Records Retention Laws by State guide.

Types of Hospital Records

Hospitals maintain several categories of medical records. Retention requirements generally apply to all categories, but some record types have additional rules.

Inpatient Records

These include history and physical exams, discharge summaries, operative reports, nursing notes, and progress notes. Studies show that 44% of hospitals retain inpatient records for 15 years or longer, well beyond most states' minimums.

Outpatient Records

Clinic visits, same-day procedures, and emergency department records. In most states, outpatient records follow the same retention period as inpatient records. However, studies indicate that 56% of hospitals retain outpatient records for less than 5 years in practice.

Lab Results

Laboratory records are subject to CLIA (Clinical Laboratory Improvement Amendments) requirements. Some states impose longer retention for specific lab results. Illinois, for example, requires cytology slides showing malignancy to be stored for 10 years.

Imaging and Radiology

The federal standard requires at least 5 years of retention for imaging records. Mammography records have special requirements under the Mammography Quality Standards Act (MQSA). Facilities must maintain mammography records and arrange for patient access even upon closure.

How to Access Your Hospital Records

HIPAA gives you the legal right to access and obtain copies of your medical records from any hospital or healthcare provider.

How to Request Records

Submit a written request to the hospital's medical records department. Most hospitals accept requests by form, email, letter, or fax. Many hospitals also offer access through an online patient portal.

How Long the Hospital Has to Respond

The hospital must act on your request within 30 calendar days. It may extend by an additional 30 days with written notice explaining the delay. HHS encourages providers to respond as quickly as possible.

What the Hospital Can Charge

Fees must be "reasonable, cost-based" and may cover only copying labor, supplies, and postage. The hospital cannot charge for searching or retrieving records. For electronic copies of electronically maintained records, the hospital may charge a flat fee of $6.50 or less.

What the Hospital Cannot Do

A hospital cannot deny access because you have an unpaid bill, because the records are old, or because the request is inconvenient. If a hospital refuses your request, you can file a complaint with the HHS Office for Civil Rights.

Records Past the Retention Period

If the retention period has expired and records have been properly destroyed, the hospital is not required to produce them. However, any summary abstracts created during destruction should still be available in some states.

What Happens When a Hospital Closes

When a hospital ceases operations, your medical records do not disappear. The hospital must follow specific procedures to protect patient information.

Required Steps

1. Notify the state health department in writing with the location where records will be stored and the name of the records custodian
2. Notify patients in advance of closure and offer the opportunity to obtain copies or designate a new provider
3. Appoint a records custodian who becomes legally responsible for maintaining, safeguarding, and providing access to records
4. Maintain records for the full remaining retention period, even after the hospital closes

Where Closed Hospital Records Go

Records from closed hospitals typically transfer to one of these custodians:

• A successor hospital or acquiring healthcare system
• Another healthcare provider willing to accept custody
• The state health department or state archives
• A commercial records storage company

North Carolina requires hospitals that discontinue operations to store records with a retrieval-service business for 11 years after closure.

Finding Records from a Closed Hospital

Contact your state health department first. They typically maintain a record of which entity assumed custody of records from closed facilities. You can also check with any hospital that may have acquired the closed facility.

Digital vs. Paper Records

The shift from paper to electronic health records (EHR) does not change retention requirements. CMS confirms that electronic documents must meet the same retention periods as paper records.

Digital records offer advantages for long-term retention: they eliminate physical storage constraints, allow easier backup and redundancy, and enable faster retrieval for patient requests.

However, digital records create unique challenges. NIST is researching how to preserve electronic health records over decades as software formats and hardware evolve. When hospitals switch EHR systems, migrating old records accurately is expensive and carries data integrity risks.

Special Categories

Minor Patients

Nearly every state extends the retention period for records of patients who were minors. The most common approach is to retain records until the child reaches age 18 plus the standard adult retention period. North Carolina has the longest minor-specific requirement: records must be kept until the patient's 30th birthday.

Mental Health Records

Psychotherapy notes receive special HIPAA protection. They may only be disclosed with specific patient authorization, separate from general medical records consent. Patients do not have a right to access their own psychotherapy notes under HIPAA, unlike regular medical records.

Substance Abuse Records

42 CFR Part 2 provides heightened confidentiality protections for records of patients receiving substance use disorder treatment. A major 2024 update aligned these protections more closely with HIPAA, with compliance required by February 16, 2026.

How Records Are Destroyed

When hospital records reach the end of their retention period, HIPAA requires that they be destroyed in a way that makes them unreadable and impossible to reconstruct.

Acceptable methods for paper records include shredding, burning, and pulverizing. Electronic records must be cleared (overwritten), degaussed (exposed to a strong magnetic field), or physically destroyed.

Records may never be thrown in dumpsters, recycling bins, or other publicly accessible containers. Hospitals may hire a business associate to handle disposal, but a business associate agreement must be in place.

Some states require patient notification before destruction. Mississippi requires 6 months' notice. Massachusetts requires hospitals to notify the Department of Public Health.