Medical Records Retention Laws by State (2026 Guide)
Independently fact-checked against primary sources (last audited August 18, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 18, 2026. · 9 primary sources cited on this page. How we verify our legal content
No single federal law sets how long doctors and hospitals must keep patient records. State law controls retention, and the spread is wide: Wyoming repealed its hospital records statute in 2019 and no longer sets a fixed retention period by statute, while Washington requires 26 years. HIPAA's 6-year rule covers only compliance documentation, not patient records.
Medical records retention laws determine how long hospitals, doctors, and other healthcare providers must keep your health information. These laws vary significantly from state to state.
Treat any nationwide range as a snapshot rather than a fixed rule. The figures on this page come from the individual state statutes and rules we opened and verified, not from a 50-state sweep, and the numbers move: Washington's 26-year requirement took effect on July 27, 2025, and Wyoming's statutory period disappeared in 2019.
A repealed statute does not mean records may simply be discarded. Wyoming no longer fixes a period by statute, but its hospital licensing rules still require public hospitals to preserve records on schedules set by the Wyoming State Archives and the State Records Committee, and any hospital participating in Medicare must keep records for at least 5 years under 42 CFR 482.24(b)(1), or at least 6 years from the date of last entry if it is certified as a critical access hospital under 42 CFR 485.638(c). Check the current rule in your own state before assuming a record no longer exists.
State-by-State Medical Records Retention Laws
Select your state for a detailed guide covering hospital and physician retention periods, minor patient records, HIPAA interaction, patient access rights, copy fees, destruction rules, and practice closure procedures.
Northeast states
The table below covers 3 states in the Northeast.
Midwest states
The table below covers 7 states in the Midwest.
| State | State |
|---|---|
| Illinois | Rhode Island |
| Indiana | South Carolina |
| Iowa | South Dakota |
| Kansas | Tennessee |
| Michigan | West Virginia |
| Minnesota | Wisconsin |
| Missouri |
Southern states
The table below covers 9 states in the South, plus the District of Columbia.
| State | State |
|---|---|
| Alabama | Montana |
| Arkansas | New Hampshire |
| Delaware | North Carolina |
| D.C. | North Dakota |
| Florida | Ohio |
| Georgia | Oklahoma |
| Kentucky | Texas |
| Louisiana | Utah |
| Maryland | Virginia |
| Mississippi | Wyoming |
Western states
The table below covers 6 states in the West.
| State | State |
|---|---|
| Alaska | Nebraska |
| Arizona | Nevada |
| California | New Jersey |
| Colorado | New Mexico |
| Hawaii | Oregon |
| Idaho | Pennsylvania |
Frequently Asked Questions
How long do hospitals keep medical records?
It depends on the state. Washington requires hospitals to retain records for a minimum of 26 years from the date the record was created under RCW 70.41.190. Massachusetts permits destruction 20 years after the patient's discharge or final treatment under M.G.L. c. 111, s. 70. Wyoming repealed its hospital records statute effective July 1, 2019 and no longer sets a fixed number of years, though its hospital licensing rules still require public hospitals to preserve records on retention schedules approved by the Wyoming State Archives and the State Records Committee. Hospitals participating in Medicare must retain records for at least 5 years under 42 CFR 482.24(b)(1), and critical access hospitals, which are certified under a separate set of federal rules, must retain them for at least 6 years from the date of last entry under 42 CFR 485.638(c). Those federal rules act as a floor where state law is silent.
Does HIPAA require records to be kept for a certain time?
No. HIPAA does not set a retention period for patient medical records. Under 45 CFR 164.316, HIPAA requires retention of administrative compliance documentation for 6 years. State law, and Medicare rules for participating providers, control how long actual patient records must be kept.
How long are records kept for minors?
Many states extend retention for minors beyond the general period, commonly tied to the patient reaching adulthood. North Carolina requires a hospital to keep records created while the patient was a minor until the patient's 30th birthday under 10A NCAC 13B .3903(b). Not every state does this: Washington applies the same 26-year period to every record under RCW 70.41.190. Check your state page above for the specific rule, because the trigger and the length both vary.
Can I access my old medical records?
Yes, if the records still exist within the applicable retention period. HIPAA gives you a right of access under 45 CFR 164.524. The provider must act on your request within 30 days and may take one additional 30-day extension with written notice. It may charge a reasonable, cost-based fee covering only labor for copying, supplies, postage, and preparing any summary you agreed to. The regulation itself sets no fixed dollar cap, so the amount varies by provider and by state.
What happens to records when a doctor retires?
Closing a practice does not reset the retention clock, so the records must be preserved for the remainder of the applicable period. Many states also impose patient notification and record custodian requirements through their medical board or health department. These procedures are set state by state, so check your state page above for the rule that applies to you.
Updates
Corrected the Washington entry to reflect that RCW 70.41.190 applies a flat 26-year retention period with no separate rule for minors, and added the 6-year Critical Access Hospital retention rule under 42 CFR 485.638(c) alongside the 5-year Medicare hospital floor.
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Governing law re-checked for recent changes
Corrected the state retention figures: Wyoming repealed its hospital records statute in 2019 and no longer sets a fixed number of years by statute, though its hospital licensing rules still require public hospitals to preserve records on approved archival schedules, and Washington now requires 26 years, which is longer than the 20-year Massachusetts figure this page previously gave as the maximum. Also corrected the records-request fee section, which described a $6.50 cap that the HIPAA access rule does not actually impose, and added the North Carolina and Wyoming rule citations.
Independently fact-checked against the cited primary sources
Reviewed and approved by an editor
State-by-state comparison
Each state guide below is paired with the governing statute our editors adjudicated for it, held in our own legal record and verified against the official source.
Each statute shown is the same adjudicated anchor its state guide renders, independently verified against primary sources. A dash means not yet adjudicated in our record — never that no law exists.
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Code of Federal Regulations Title 45
§ 164.524Access of individuals to protected health information.In forcecited in 31 of our articles
(a) Standard: Access to protected health information —(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for: (i) Psychotherapy notes; and (ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. (2) Unreviewable grounds for denial. A covered entity may deny an individual access without providing the individual an opportunity for review, in the following circumstances. (i) The protected health information is excepted from the right of access by paragraph (a)(1) of this section.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 88 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Webb v. Smart Document Solutions, LLC (2007) held the reduced, cost-based fee in section 164.524(c)(4) applies only when the individual himself requests his records, not a law firm acting as his agent. Ciox Health, LLC v. Hargan (2020) vacated 2016 guidance that extended that patient rate to third-party directives.
Opinions citing this section in our collection:
- Webb v. Smart Document Solutions, LLC (Court of Appeals for the Ninth Circuit 2007, 499 F.3d 1078)✓A law firm ordered its client's hospital records and was billed a copying company's higher third-party rate; the Ninth Circuit held Section 164.524(c)(4)'s cost-based fee limit applies only when the individual or a personal representative asks, not an attorney acting as agent.
- Evenson v. Hartford Life & Annuity Insurance (District Court, M.D. Florida 2007, 244 F.R.D. 666)✓A therapist refused a subpoena for her psychotherapy notes, citing Section 164.524(a)(1)'s exclusion of those notes from a patient's right of access; the court held that exclusion governs only individual access, not discovery, and ordered the notes produced.
- Ciox Health, LLC v. Hargan (District Court, District of Columbia 2020)“…fee that can be charged for such production. See generally 45 C.F.R. § 164.524. For requests brought by an individual…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How Long Do Hospitals Keep Medical Records? (2026), How to Find Old Medical Records Online, North Carolina Medical Recording Laws: Patient Rights and Provider Rules
§ 164.316Policies and procedures and documentation requirements.In forcecited in 7 of our articles
A covered entity or business associate must, in accordance with § 164.306: (a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart. (b)(1) Standard: Documentation. (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and (ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment. (2) Implementation specifications: (i) Time limit (Required).
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 1 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Deisy Granados v. Pan American Life Insurance Co. (New Jersey Superior Court Appellate Division 2026)“…authorized members of its workforce." She further claimed 45 C.F.R. § 164.316 bars defendants from "retaliating agai…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: HIPAA Compliance Companies: Top Platforms Compared (2026), Minnesota Medical Records Retention Laws (2026 Guide), Oklahoma Medical Records Retention Laws (2026 Guide)
Code of Federal Regulations Title 42
§ 482.24Condition of participation: Medical record services.In forcecited in 53 of our articles
The hospital must have a medical record service that has administrative responsibility for medical records. A medical record must be maintained for every individual evaluated or treated in the hospital. (a) Standard: Organization and staffing. The organization of the medical record service must be appropriate to the scope and complexity of the services performed. The hospital must employ adequate personnel to ensure prompt completion, filing, and retrieval of records. (b) Standard: Form and retention of record. The hospital must maintain a medical record for each inpatient and outpatient. Medical records must be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must use a system of author identification and record maintenance that ensures the integrity of the authentification and protects the security of all record entries. (1) Medical records must be retained in their original or legally reproduced form for a period of at least 5 years. (2) The hospital must have a system of coding and indexing medical records. The system must allow for timely retrieval by diagnosis and procedure, in order to support medical care evaluation studies.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 18 court opinions in our collectionLatest citing opinion in our collection: 2024
In the courts (editorial summary, independently checked):United States ex rel. Janssen v. Lawrence Memorial Hospital (2020) held the accurate medical record duty in 42 C.F.R. 482.24 is a generic regulatory requirement that does not establish False Claims Act materiality. United States Ex Rel. El-Amin v. George Washington University (2008) applied 482.24(c) to record completion evidence.
Opinions citing this section in our collection:
- United States ex rel. Janssen v. Lawrence Memorial Hospital (Court of Appeals for the Tenth Circuit 2020, 949 F.3d 533)✓A relator alleged the hospital falsified patient arrival times to raise its Medicare quality-program payments. The court held the general duty to keep accurate medical records under 42 C.F.R. 482.24 does not address those programs and cannot show False Claims Act materiality.
- United States Ex Rel. El-Amin v. George Washington University (District Court, District of Columbia 2008, 533 F. Supp. 2d 12)✓Nurse anesthetists claimed the hospital billed Medicare as though anesthesiologists performed whole procedures. Citing the 30-day rule in 42 C.F.R. 482.24(c)(2), the court excluded late-signing evidence, and excluded mass-signing evidence too though (c)(1) made it probative.
- NATIONAL ASS'N OF PSYCHIATRIC HEALTH SYSTEM v. Shalala (District Court, District of Columbia 2000, 120 F. Supp. 2d 33)“…to preexisting recordkeeping requirements, as specified in 42 C.F.R. § 482.24 . 7 . Proposed Rul…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Medical Records Retention Laws by State (2026 Guide), Alabama Medical Records Retention Laws (2026 Guide), Alaska Medical Records Retention Laws (2026 Guide)
§ 424.516Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program.In forcecited in 18 of our articles
(a) Certifying compliance. CMS enrolls and maintains an active enrollment status for a provider or supplier when that provider or supplier certifies that it meets, and continues to meet, and CMS verifies that it meets, and continues to meet, all of the following requirements: (1) Compliance with title XVIII of the Act and applicable Medicare regulations. (2) Compliance with Federal and State licensure, certification, and regulatory requirements, as required, based on the type of services or supplies the provider or supplier type will furnish and bill Medicare. (3) Not employing or contracting with individuals or entities that meet either of the following conditions: (i) Excluded from participation in any Federal health care programs, for the provision of items and services covered under the programs, in violation of section 1128A(a)(6) of the Act. (ii) Debarred by the General Services Administration (GSA) from any other Executive Branch procurement or nonprocurement programs or activities, in accordance with the Federal Acquisition and Streamlining Act of 1994, and with the HHS Common Rule at 45 CFR part 76.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 7 court opinions in our collectionLatest citing opinion in our collection: 2024
Opinions citing this section in our collection:
- United States Ex Rel. Westmoreland v. Amgen, Inc. (District Court, D. Massachusetts 2011, 812 F. Supp. 2d 39)“…recon *52 dition of payment can be found in 42 C.F.R. § 424.516 (a)(1), which states that “CMS enrolls…”
- Johnson v. Kelly (District Court, W.D. Oklahoma 2024)“…care laws, regulations, and program instructions. Id. ¶ 22; 42 C.F.R. § 424.516(a). To that end, a healthcare provider…”
- LILIA GOROVITS, M.D., P.C. v. AZAR (District Court, E.D. Pennsylvania 2021)“…2 Pursuant to 42 C.F.R. § 424.516(d)(1)(ii), Medicare physicians are requ…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Arizona Medical Records Retention Laws (2026 Guide), Arkansas Medical Records Retention Laws (2026 Guide), Florida Medical Records Retention Laws (2026 Guide)
§ 485.638Conditions of participation: Clinical records.In forcecited in 5 of our articles
(a) Standard: Records system —(1) The CAH maintains a clinical records system in accordance with written policies and procedures. (2) The records are legible, complete, accurately documented, readily accessible, and systematically organized. (3) A designated member of the professional staff is responsible for maintaining the records and for ensuring that they are completely and accurately documented, readily accessible, and systematically organized. (4) For each patient receiving health care services, the CAH maintains a record that includes, as applicable— (i) Identification and social data, evidence of properly executed informed consent forms, pertinent medical history, assessment of the health status and health care needs of the patient, and a brief summary of the episode, disposition, and instructions to the patient; (ii) Reports of physical examinations, diagnostic and laboratory test results, including clinical laboratory services, and consultative findings; (iii) All orders of doctors of medicine or osteopathy or other practitioners, reports of treatments and medications, nursing notes and documentation of complications, and other pertinent information necessary to monitor…
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Also relied on in: Delaware Medical Records Retention Laws (2026 Guide), Illinois Medical Records Retention Laws (2026 Guide), Wyoming Medical Records Retention Laws (2026 Guide)
Revised Code of Washington
§ 70.41.190Medical records of patients—Retention and preservation.In forcecited in 4 of our articles
(1) A hospital shall retain and preserve all medical records for a minimum period of 26 years from the date the record was created. A hospital may retain medical records on paper, microfilm, electronically, or on other media. (a) This subsection applies to: (i) Medical records created prior to July 27, 2025, and retained or preserved by the hospital on July 27, 2025; and (ii) Medical records created on or after July 27, 2025. (b) This subsection does not apply to medical records no longer retained and preserved by the hospital on July 27, 2025, if the hospital complied with this section as it existed prior to July 27, 2025, when it destroyed or otherwise disposed of the records. (c) This subsection does not exempt hospitals from compliance with any other record retention requirements. (2) All information collected at each unique visit is considered a medical record for the purposes of this section. (3) If a hospital ceases operations, it shall make immediate arrangements, as approved by the department, for preservation of its records.
Official text (excerpt) · last checked 2026-09-07 · Read the full text in our law library · Verify at app.leg.wa.gov
Cited in 2 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- Debra Stevens, Appellant/cr-respondent V. Craig Jonov, M.d., Respondent/cr-appellants (Court of Appeals of Washington 2025)“…information when a practice is sold or acquired. See, e.g., RCW 70.41.190 (providing that hospitals “shall retain…”
- Lumumba v. Pierce County (District Court, W.D. Washington 2025)“…ical 2 records as it was already required to do so under RCW 70.41.190. Dkt. 28 at 2. Ms. Lumumba 3 replied…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Washington Medical Records Retention Laws (2026 Guide)
Sources and References
- 45 CFR 164.316: HIPAA documentation and record retention requirements, including the 6-year retention period for required compliance documentation(ecfr.gov).gov
- 45 CFR 164.524: HIPAA right of individuals to access protected health information, including the 30-day response deadline and the reasonable cost-based fee standard(ecfr.gov).gov
- 42 CFR 482.24(b)(1): Medicare hospital Conditions of Participation requiring medical records to be retained for at least 5 years(ecfr.gov).gov
- 42 CFR 424.516: Medicare requirement to maintain documentation for ordered, certified, referred, or prescribed Part A and B services for 7 years from the date of service(ecfr.gov).gov
- Wyoming SF0096, Enrolled Act No. 53 (2019): Section 3 repeals W.S. 35-2-605 through 35-2-617, the Hospital Records and Information Act, effective July 1, 2019(wyoleg.gov).gov
- RCW 70.41.190: Washington hospitals must retain medical records a minimum of 26 years from the date the record was created (amended by 2025 c 131 s 1, effective July 27, 2025)(app.leg.wa.gov).gov
- M.G.L. c. 111, s. 70: Massachusetts hospital records may be destroyed 20 years after the discharge or final treatment of the patient(malegislature.gov).gov
- Wyoming Department of Health, Healthcare Licensing and Surveys, Chapter 12 (Licensure of Hospitals), effective March 1, 2023, Section 23(c): records of public hospitals shall be preserved for a period determined by the hospital administrator based on the retention schedules established by the Wyoming State Archives and the State Records Committee(health.wyo.gov).gov
- 10A NCAC 13B .3903(b) (readopted effective August 1, 2023): North Carolina hospitals must maintain medical records created when the patient was a minor until the patient's 30th birthday(reports.oah.state.nc.us).gov
- 42 CFR 485.638(c): Medicare Critical Access Hospital condition of participation requiring clinical records to be retained for at least 6 years from the date of last entry, and longer if required by state statute or needed in a pending proceeding(ecfr.gov)