Medical Records Retention Laws by State (2026 Guide)

State law, not HIPAA, controls how long healthcare providers must keep patient medical records. Most state minimums run 5 to 10 years, but Washington now requires hospitals to retain records for 26 years under RCW 70.41.190. HIPAA under 45 CFR 164.530(j) governs only administrative compliance documents, not patient charts.

Medical records retention laws determine how long hospitals, doctors, and other healthcare providers must keep your health information on file. These laws vary significantly from state to state, from no state-mandated period at all in Wyoming to 26 years for hospitals in Washington.

This guide covers every state's requirements, federal rules under HIPAA and Medicare, special rules for minors and deceased patients, your rights as a patient, and what happens when records are destroyed.

Federal Requirements: What HIPAA Actually Says

One of the most common misconceptions in healthcare law is that HIPAA requires providers to keep medical records for a specific number of years. It does not.

HIPAA Documentation vs. Medical Records

HIPAA requires covered entities to retain HIPAA-related administrative documentation (privacy policies, procedures, training records, business associate agreements, complaint records) for 6 years from the date of creation or last effective date under 45 CFR 164.530(j).

This 6-year requirement applies to HIPAA compliance paperwork, not to patient medical records. How long actual patient records must be kept is determined by state law.

Medicare and Medicaid Requirements

Federal minimums for providers participating in Medicare or Medicaid come from several separate rules, and each one is narrower than it is usually described:

The three Medicare periods above are the only ones CMS states in its own record-retention guidance. CMS publishes no general seven-year rule for Medicare providers, despite how often one is quoted. If you have been told your practice owes Medicare seven years from the date of service, ask which authority sets it, because the agency's retention guidance does not.

Which Law Controls?

The stricter requirement always applies. If state law requires 10 years and the federal floor is 5 years, the provider must retain records for 10 years. If a Medicare Advantage organization owes 10 years and its state requires only 6, the 10-year period governs its records.

This is why the Wyoming repeal does not mean Wyoming records vanish after a year. A Wyoming hospital that participates in Medicare still owes the federal 5-year floor under 42 CFR 482.24 even though the state period is gone.

HIPAA Record Retention: What the Law Actually Requires

The phrase "HIPAA record retention" causes significant confusion among patients and providers alike. Many people believe HIPAA mandates keeping medical records for 7 years. This is incorrect, and so is the usual correction. The 7-year figure does not come from HIPAA, but it does not come from a general Medicare rule either. It comes from state law and from malpractice exposure.

The 6-Year HIPAA Rule

Under 45 CFR 164.530(j), HIPAA requires covered entities to retain only administrative compliance documents for 6 years. These documents include:

• Privacy and security policies and procedures
• Risk assessments and security incident reports
• Breach notification documentation
• Workforce training records and acknowledgments
• Business Associate Agreements (BAAs)
• Patient complaint records and their resolution
• Notices of Privacy Practices

This is a document retention rule, not a medical record retention rule. The distinction matters because many healthcare organizations conflate the two and apply the wrong standard.

Where the "7 Year" Myth Comes From

The widespread belief that "HIPAA requires 7 years" originates from three sources, none of them HIPAA:

State laws. A large share of states set a 7-year period, and several of the biggest set it for physician offices specifically, including Texas under 22 TAC 163.2, the Texas Medical Board rule. Count the 7-year entries in the 50-state table below and the pattern is obvious. When providers in those states hear "7 years," they assume it comes from HIPAA rather than from their own state.

Malpractice limitations periods. Most malpractice carriers and practice-management advisors recommend keeping records at least as long as the state's statute of limitations for a malpractice claim, plus a margin. In many states that arithmetic lands near seven years, which is why the number circulates as a rule of thumb even where no statute or regulation states it.

Incorrect compliance training. Some compliance training materials state "HIPAA requires 7 years" without distinguishing between HIPAA administrative documentation requirements and state medical record retention laws. Others attribute the number to Medicare. CMS retention guidance states a 6-year HIPAA documentation period, a 5-year period after a cost report closes, and 10 years for Medicare managed care. It states no 7-year period at all.

What Providers Should Actually Do

Healthcare providers must follow three overlapping rules and keep records for whichever period is longest:

1. HIPAA administrative documents: 6 years from creation or last effective date
2. State medical record law: Varies by state, from no state period at all in Wyoming to 26 years for Washington hospitals
3. Federal program participation: at least 5 years for hospitals under the Medicare Conditions of Participation, at least 5 years after a cost report closes for providers who file one, and 10 years for Medicare Advantage organizations and Part D sponsors

For most providers, state law is the longest of the three, not the federal floor. The AMA recommends a best practice of retaining all patient records for at least 10 years from the date of last treatment, regardless of state minimums.

Medical Records Retention by State

The table below shows retention requirements for all 50 states and the District of Columbia. Click any state name to see that state's detailed retention law page.

How to read this table. Most states run two separate bodies of law: a hospital-licensing rule written by the state health department, and a physician-records rule written by the state medical board. The two periods frequently differ, and a summary that quotes only one of them can understate what actually applies to your chart. Where both periods have been confirmed, the row names which regime each figure comes from. Where only one figure appears, treat it as the rule under the authority cited beside it and confirm the other regime with the state's hospital licensing agency or medical board.

Verification note. The Kentucky, Minnesota, New York, Texas, Washington, and Wyoming rows were re-checked against their primary sources in August 2026, and every one of them was corrected. New York needed three passes: its minor-record figures were still misattributed after the second, because the age-22 rule in 8 NYCRR 29.2(a)(3) lists medicine but then excepts professions licensed under Education Law Articles 131 and 131-B (physicians and physician assistants) for any case arising after July 26, 1991, leaving physicians governed by Education Law 6530(32) and its age-19 endpoint. The remaining rows reflect the authority cited beside them and have not yet been re-checked to that standard, so confirm against the linked state page and the cited rule before relying on a figure.

States with the Longest Requirements

Several states require significantly longer retention periods than the national average.

Washington requires hospitals to retain and preserve all medical records for a minimum of 26 years from the date the record was created under RCW 70.41.190. The amendment that set that period took effect July 27, 2025, and it reaches records created before that date that hospitals still held on July 27, 2025, as well as everything created afterward. This is the longest fixed term any state sets. It is not the longest obligation in the country, because Minnesota's permanent-record rule below has no end date to compare against. The statute sets no separate minor-specific period, because the 26-year clock already runs from record creation for every patient.

Massachusetts requires hospitals and clinics to keep records for 20 years under Mass. Gen. Laws ch. 111, 70. The 7-year period commonly quoted for Massachusetts physician offices does not come from that statute, which by its own terms governs the records of hospitals and clinics. The physician-office period is set separately by the Board of Registration in Medicine. We have not been able to confirm the current text of that regulation, so confirm the physician-office period with the Board before relying on a number.

Minnesota requires hospitals to permanently retain what the commissioner of health defines as the "individual permanent medical record" under Minn. Stat. 145.32. Other portions of the record may be divested after 7 years, but core records must be kept indefinitely. Because that obligation is open-ended rather than a term of years, Minnesota, not Washington, is the state whose retention duty runs longest. The same statute also sets a minor period: all portions of a minor's hospital record must be kept for 7 years or until the individual reaches the age of majority, whichever occurs last.

North Carolina requires hospitals to retain records for 11 years after discharge under 10A NCAC 13B .3903. Records of minors must be kept until the patient's 30th birthday.

South Carolina requires physicians to retain records for 10 years, with an extended period of 13 years for records of minors under S.C. Code Ann. 44-115-120.

States with the Shortest Requirements

Wyoming no longer sets a state retention period at all. Wyo. Stat. 35-2-606 and the rest of the Hospital Records Act, sections 35-2-605 through 35-2-617, were repealed effective July 1, 2019 by 2019 Wyoming Session Laws ch. 78. Guides that still list Wyoming at 3 years are quoting repealed law. Wyoming hospitals that participate in Medicare remain subject to the federal 5-year floor under 42 CFR 482.24, and providers there generally set retention against malpractice-limitations exposure rather than a statute. Our Wyoming medical records retention page covers what applies in the absence of a state rule.

Florida, Nevada, Oklahoma, and Wisconsin all require only 5 years of retention for at least some provider types.

Nebraska does not impose a specific mandatory retention period in its statutes. However, providers may not destroy records after receiving a patient request under Neb. Rev. Stat. 71-8403.

West Virginia does not specify a duration but requires records to be preserved in their original form, microfilm, or electronic format.

Hospital vs. Physician Office Differences

Many states set different retention periods for hospitals and private physician offices, under different agencies and different bodies of rules. In some states, hospitals must keep records longer; in others, physician offices have the longer requirement. Reading only one of the two rules is the single most common way a retention summary goes wrong.

Watch out: Texas is the clearest example of why the distinction matters. The widely quoted Texas figure, 7 years, comes from 22 TAC 163.2, which sits in Title 22, Part 9 of the Texas Administrative Code, the Texas Medical Board's rules. It binds physicians. A Texas hospital answers to Tex. Health & Safety Code 241.103 instead, which requires 10 years after the patient was last treated, and for a patient under 18 at last treatment, permits disposal only on or after the patient's 20th birthday or the 10th anniversary of last treatment, whichever is later.

We cite 22 TAC 163.2 by rule number rather than by link. The Texas Secretary of State retired the Administrative Code website that previously served a stable URL for each rule, and the replacement portal does not expose one. To read the rule, search the Texas Administrative Code for Title 22, Part 9, Chapter 163, Rule 163.2.

Pediatric and Minor Patient Records

Children's medical records receive special protection in most states. Because minors cannot file legal claims on their own behalf, many states extend the retention period until well after the child reaches the age of majority. This section pulls together all minor-specific retention requirements from the 50-state table above.

Why Pediatric Records Are Kept Longer

Two legal principles drive longer retention for pediatric records:

Statute of limitations tolling. In most states, the statute of limitations for medical malpractice does not begin to run until the minor reaches the age of majority (typically 18). A child injured at birth may have until age 20 or 21 to file a claim, depending on the state's limitations period.

Continuity of care. Pediatric vaccination records, growth charts, developmental assessments, and childhood illness histories all inform adult medical decisions. The American Academy of Pediatrics recommends that pediatric medical records be retained, at a minimum, for 10 years or the age of majority plus the applicable state statute of limitations, whichever is longer.

Minor Retention Requirements by State (Longest to Shortest)

The table below shows every state with a specific minor retention requirement, sorted from the longest to shortest period.

States not listed above (Connecticut, Delaware, Florida, Idaho, Illinois, Indiana, Louisiana, Massachusetts, Michigan, Mississippi, Ohio, Oklahoma, Oregon, South Dakota, Vermont, West Virginia, Wisconsin) either apply the same retention period as adult records or do not specify a separate minor retention requirement.

New York is the clearest illustration of why a single number per state misleads. It runs three regimes that produce three different answers for the same child. A physician's office may close the chart six years after the last visit or one year after the patient turns 18, whichever is later (Education Law 6530(32)). A hospital must hold its record until six years have run from discharge or the patient has been 18 for three years, whichever is later (10 NYCRR 405.10(a)(4)). And most other licensed health professions, from physical therapy to psychology, must keep the same child's record for six years and until one year after the patient turns 21 (8 NYCRR 29.2(a)(3), which lists medicine but then excepts physicians and physician assistants for any case arising after July 26, 1991). One state, three endpoints: 19, 21, and 22.

Two states sit outside the pattern entirely. Washington sets no separate minor period because RCW 70.41.190 already runs 26 years from record creation for every patient, which for a newborn reaches past age 25 on its own. Wyoming sets no minor period because it sets no state retention period at all following the 2019 repeal.

How Long Do Pediatricians Keep Records?

Pediatricians follow the same state retention laws as other physicians, but practical considerations often push them to retain records longer. The AAP's stated minimum is 10 years, or the age of majority plus the applicable state statute of limitations for medical malpractice, whichever of the two is longer. In a state with a 2-year limitations period, the second branch of that test means keeping records until the former patient turns 20, and the 10-year branch governs whenever it reaches further.

For pediatric specialties (pediatric surgery, pediatric cardiology, neonatology), the risk profile leads many practices to keep key records well beyond that minimum. That is a practice decision rather than a legal requirement.

How Long to Keep Medical Records After a Patient Dies

A patient's death does not end the legal obligation to retain their medical records. Providers must continue to follow both state retention laws and federal rules for deceased patients.

State Retention Rules Still Apply

In most states, the retention clock is based on the date of last treatment or discharge, not the date of death. If a patient was last treated in 2020 and the state requires 7 years of retention, the records must be kept until 2027 regardless of whether the patient dies in 2021 or 2025.

Some states attach a separate minimum to the date of death. New York hospitals, for example, must keep a medical record for at least 6 years after the patient's death under 10 NYCRR 405.10(a)(4), independent of the 6-year-from-discharge period.

Other states are sometimes described as measuring retention from the date of death, but the trigger date is exactly the kind of detail that varies between a state's hospital rule and its medical board rule. Check the linked state page and the rule it cites before assuming your state's clock started at discharge rather than at death.

Medicare Records for Deceased Patients

Hospitals participating in Medicare must keep records for at least 5 years under 42 CFR 482.24(b)(1). Providers who file cost reports keep patient records at least 5 years after the cost report closes, and Medicare Advantage organizations and Part D sponsors keep their records for 10 years. None of these federal periods changes when a patient dies, and none of them is measured from the date of death.

Because the federal floor is short and carries no death-based trigger, the operative deadline after a patient dies is almost always the state one. Check the state rule, and check which regime it belongs to, before assuming a chart can be destroyed.

The 50-Year HIPAA Privacy Rule

HIPAA protects the individually identifiable health information of a deceased person for 50 years following the date of death under 45 CFR 164.502(f). During this period, the same HIPAA privacy protections apply as for a living patient.

This 50-year rule is a privacy protection, not a retention requirement. Providers are not required to keep records for 50 years. They must follow their state's retention schedule for how long to keep the records. But as long as the records exist within that 50-year window, they must be treated as protected health information.

After 50 years, the deceased individual's health information is no longer considered PHI and may be used or disclosed without regard to HIPAA restrictions.

Estate and Legal Considerations

Executors and personal representatives of a deceased patient have the same right to access medical records as the patient did. Under HIPAA, a personal representative of a deceased individual is anyone authorized under state law to act on behalf of the decedent or the estate.

Providers should retain records beyond the minimum retention period if:

• A wrongful death or malpractice lawsuit is pending or anticipated
• The estate is still being administered
• Insurance claims related to the patient's treatment are unresolved
• An investigation by a government agency is underway

Your Right to Access Medical Records

HIPAA gives patients (and their personal representatives) the legal right to access and obtain copies of their protected health information.

Response Time

Providers must act on a records request within 30 calendar days of receipt. They may extend by an additional 30 days with written notice explaining the delay. HHS encourages providers to respond as quickly as possible, noting that 30 days is the outer limit.

Fees

Providers may charge only "reasonable, cost-based" fees for copies. The fee may include the cost of labor for copying, supplies, and postage. It may not include the cost of searching for records, retrieving records, or maintaining records systems.

For electronic copies of records maintained electronically, providers may charge a flat fee of $6.50 or less (inclusive of all labor, supplies, and postage). This flat fee is an alternative to calculating actual costs, not a cap on every request.

What Providers Cannot Deny

Providers cannot deny access to your medical records because you have an unpaid bill, because the records are old, or because the request is inconvenient. Limited exceptions exist for psychotherapy notes, information compiled for legal proceedings, and certain lab results.

Information Blocking

The 21st Century Cures Act prohibits providers from engaging in "information blocking," defined as practices likely to interfere with access to, exchange of, or use of electronic health information. Penalties reach up to $1 million per violation for health IT developers. Provider-specific disincentives were finalized by HHS in June 2024.

What Happens When a Practice Closes

When a physician retires, relocates, or closes a practice, the provider must still ensure patient records are preserved for the required retention period. The American Medical Association recommends the following steps:

1. Notify patients at least 60 days before closure
2. Offer patients the option to transfer records to another provider
3. Offer patients the option to receive a personal copy
4. Notify the state medical board
5. Arrange for a custodian to maintain records for the remaining retention period
6. Destroy any records that have exceeded the retention period using HIPAA-compliant methods

Some states have specific closure requirements. North Carolina requires hospitals that discontinue operations to store records with a retrieval-service business for 11 years. Georgia requires providers who retire or sell their practice to give patients notice under O.C.G.A. 31-33-2.

Medical Record Retention and Destruction Policy

Every healthcare organization should have a written record retention and destruction policy. Without one, staff have no clear guidance on when records can be destroyed, which increases the risk of both premature destruction and indefinite accumulation of records.

What a Retention and Destruction Policy Should Cover

A compliant policy should address each of the following areas:

Retention schedule. List every record type (patient charts, billing records, radiology images, lab results, consent forms) and the retention period for each. Base retention periods on the applicable state law, federal requirements, and the organization's malpractice insurance recommendations.

Regime mapping. Identify which state rule actually binds the entity: the hospital licensing rule, the medical board rule, or both for a system that operates hospitals and employed physician practices. Applying one regime's clock to the other entity's records is a common and expensive error.

Legal holds. Define the process for suspending destruction when records are subject to litigation, government investigation, or audit. Records under legal hold must not be destroyed regardless of their age.

Destruction methods. Specify approved methods: shredding, burning, or pulverizing for paper records; clearing, purging/degaussing, or physical destruction for electronic media.

Destruction documentation. Require a destruction log that records the date, method, description of records destroyed, and the name of the person who performed or witnessed the destruction.

Business associate requirements. If a third party handles destruction, the policy must require a Business Associate Agreement and verification that the vendor follows HIPAA-compliant destruction methods.

Employee training. Staff must be trained on the policy at hire and at regular intervals. Training records must be retained for 6 years under HIPAA.

When Can Medical Records Be Destroyed?

Medical records can be destroyed only after all of the following conditions are met:

1. The state-mandated retention period has expired
2. Any applicable federal retention period (Medicare, OSHA) has expired
3. No legal hold is in effect for those records
4. No pending patient request for records exists
5. The statute of limitations for malpractice claims has expired

If all five conditions are satisfied, records may be destroyed using approved methods.

Proper Destruction Methods

HIPAA requires that medical records be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed" when destroyed.

Paper records: shredding, burning, or pulverizing.

Electronic records: clearing (overwriting with non-sensitive data), purging/degaussing (using a strong magnetic field), or physical destruction of the storage media.

Records may never be placed in dumpsters, recycling bins, or other publicly accessible receptacles. Providers may hire a business associate to handle disposal, but a business associate agreement must be in place.

State Notification Requirements

Most states do not require notification before destroying records that have exceeded the retention period. Notable exceptions include Mississippi, which requires 6 months' notice to patients before destruction, and Massachusetts, which requires hospitals to notify the Department of Public Health.

Penalties for Improper Destruction

HIPAA civil money penalties for improper disposal of protected health information range from $145 to $2,190,294 per violation, depending on the level of culpability. Those are the 2025 adjusted amounts in the right-most column of the penalty table at 45 CFR 102.3, which HHS adjusts for inflation every year. The floor of $145 is the minimum for a violation the covered entity did not know about and could not have known about with reasonable diligence; the ceiling of $2,190,294 applies to a violation caused by willful neglect that was not corrected, and is also the annual cap on penalties for repeated identical violations. Criminal penalties for knowing violations can reach $250,000 and 10 years imprisonment.

For scale, HHS reports a cumulative $144,878,972 collected across 152 HIPAA settlements and civil money penalties since the Privacy Rule compliance date in 2003. That total covers every category of HIPAA violation across more than two decades, not disposal cases alone, so it is a measure of the program's overall size rather than a per-issue benchmark.

Recent Changes (2024-2026)

Washington's 26-Year Hospital Retention Rule

Washington amended RCW 70.41.190 in 2025 to require hospitals to retain and preserve all medical records for a minimum of 26 years from the date the record was created. The change took effect July 27, 2025 and applies both to records created on or after that date and to records created earlier that hospitals still held on that date. Any Washington retention schedule built on the older 10-year figure needs rewriting.

Wyoming Has No Retention Statute

Wyoming's Hospital Records Act, Wyo. Stat. 35-2-605 through 35-2-617, was repealed effective July 1, 2019 by 2019 Wyoming Session Laws ch. 78. Wyoming has had no state-mandated medical record retention period since. Many retention charts published after 2019 still list the repealed 3-year figure.

Texas EHR Storage Requirement

Texas SB 1188 took effect September 1, 2025, the date set by SECTION 4 of the enrolled bill. It adds Chapter 183 to the Health and Safety Code, and new Section 183.002(a) requires a covered entity to ensure that electronic health records under its control that contain patient information are "physically maintained in the United States or a territory of the United States," including records held by a third-party or cloud computing provider.

January 1, 2026 is a separate applicability date, not the effective date. SECTION 2(a) applies the new chapter only to records prepared on or after September 1, 2025, but SECTION 2(b) applies the storage requirement to the storage of an electronic health record on or after January 1, 2026 regardless of when the record was prepared. From that date the residency rule reaches a Texas covered entity's older records too. This is a rule about where records live, not about how long they must be kept.

Substance Use Disorder Records

The 42 CFR Part 2 final rule, effective April 16, 2024 with compliance required by February 16, 2026, aligns substance use disorder patient record protections with HIPAA.

HIPAA Security Rule Update

In December 2024, HHS published a proposed rule to strengthen cybersecurity requirements for electronic protected health information. The proposal would eliminate the distinction between "required" and "addressable" implementation specifications, making all security measures mandatory.