How Long Do Hospitals Keep Medical Records? (2026)

Hospitals keep medical records for 5 to 10 years after discharge in most states, and far longer in a few. Washington raised its hospital minimum to 26 years in 2025, and Massachusetts allows destruction only after 20 years. There is no single federal retention period; state law controls the minimum, and records for minors are kept longer in nearly every state.

How long a hospital keeps your medical records depends primarily on which state the hospital operates in. Federal law sets a baseline of 5 years for Medicare-participating hospitals, but most states require longer retention periods.

This guide explains the federal requirements, how state laws vary, what types of records hospitals maintain, how to access your old records, and what happens when a hospital closes.

The Short Answer

Most hospitals keep medical records for 5 to 10 years after your last discharge or visit. The exact period depends on your state. Hospitals participating in Medicare must keep records for at least 5 years under federal regulations, but state law often requires a longer period. When state and federal requirements differ, the hospital must follow whichever rule is stricter.

For a complete breakdown of every state's requirements, see our Medical Records Retention Laws by State guide.

Federal Requirements

Medicare Hospital Minimum: 5 Years

42 CFR 482.24(b)(1) requires hospitals participating in Medicare to retain medical records "in their original or legally reproduced form for a period of at least 5 years."

The same standard opens by requiring that "the hospital must maintain a medical record for each inpatient and outpatient," so the 5-year floor covers both categories.

Medicare Provider Requirement: 7 Years

Separately, 42 CFR 424.516(f) requires a provider or supplier that furnishes covered ordered, certified, referred, or prescribed Part A or B services, items or drugs to maintain the related documentation for 7 years from the date of service, and to give CMS or a Medicare contractor access to it on request.

The rule reaches written and electronic documents relating to written orders, certifications, referrals, prescriptions, and requests for payment. Where it applies, its 7-year clock runs longer than the 5-year hospital floor, so it drives the retention schedule for that documentation.

Noncompliance carries a real penalty. CMS may revoke Medicare enrollment when a provider or supplier fails to meet the 424.516(f) documentation or access requirements, for a period of up to 1 year for each act of noncompliance (42 CFR 424.535(a)(10)).

Hospice Records: 6 Years

42 CFR 418.104(d) requires that hospice patient clinical records "be retained for 6 years after the death or discharge of the patient, unless State law stipulates a longer period of time."

If a hospice discontinues operation, its policies must provide for retention and storage of the clinical records, and it must tell its State agency and its CMS regional office where the records will be stored and how they may be accessed.

HIPAA Does Not Set a Retention Period

A common misconception: HIPAA does not require hospitals to keep patient medical records for any specific number of years.

HIPAA does require covered entities to keep their own compliance paperwork for 6 years from the date of creation or the date it was last in effect, whichever is later. Two separate provisions set that clock. Under the Privacy Rule, a covered entity "must retain the documentation required by paragraph (j)(1) of this section for six years," which covers its privacy policies and procedures, any communication the rule requires in writing, and any action the rule requires it to document (45 CFR 164.530(j)(2)). Under the Security Rule, the same 6-year period applies to the policies and procedures a covered entity implements to protect electronic health information (45 CFR 164.316(b)(2)(i)).

Both are documentation rules, not patient-record rules. State law controls how long actual patient medical records must be retained.

How Long by State

Retention periods for hospital records vary significantly by state.

Every row below names the hospital rule it comes from, and we read each of those rules in the state's own published text before listing it. That is why this table is shorter than the ones you will find elsewhere. An earlier version of this page carried more states, sourced to a federal summary table that has since been taken offline, and when we went back to the underlying state law several of those figures turned out to be wrong or out of date. States we could not confirm against a current, readable primary source are not listed rather than guessed at.

Washington now sits at the top of the national range, and the change is recent enough that older summaries still show its previous, much shorter figure. Its statute reads that a hospital "shall retain and preserve all medical records for a minimum period of 26 years from the date the record was created," and it applies both to records created on or after July 27, 2025 and to records the hospital still held on that date (RCW 70.41.190). The statute sets no separate rule for minors, so the same 26-year floor covers them.

Massachusetts is next, by statute: a hospital or clinic record "may be destroyed 20 years after the discharge or the final treatment therein of the patient to whom it relates" (M.G.L. c. 111, § 70).

Texas sets its hospital period in statute rather than in a licensing-board rule. A hospital "may authorize the disposal of any medical record on or after the 10th anniversary of the date on which the patient who is the subject of the record was last treated in the hospital." Where the patient was younger than 18 at that last treatment, disposal is allowed only on or after the patient's 20th birthday or the 10th anniversary of last treatment, whichever date is later (Tex. Health & Safety Code § 241.103).

The same Texas section carries a protection worth knowing if you are in a dispute with a hospital. It "may not destroy medical records that relate to any matter that is involved in litigation if the hospital knows the litigation has not been finally resolved," so a pending case freezes the ordinary clock.

Illinois builds a similar hold into its rule, with a procedure attached. If an attorney notifies the hospital in writing before the 10 years run out that the record is possible evidence in pending litigation, the hospital must keep it until the attorneys confirm the case has concluded, or for 12 years from the date the record was produced, whichever comes first (77 Ill. Adm. Code 250.1510).

New York's hospital rule sets three floors in a single sentence. Records "shall be retained in their original or legally reproduced form for a period of at least six years from the date of discharge or three years after the patient's age of majority (18 years), whichever is longer, or at least six years after death" (10 NYCRR 405.10(a)(4)). Three years past age 18 is age 21, so a parent asking for a child's hospital record has longer to do it than the headline 6-year figure suggests.

One caution about reading any table like this one. The periods above are hospital rules. A private physician's office in the same state frequently answers to a different rule with a different number, which is why the same state can be described as both a 7-year and a 10-year state depending on who is holding the chart. Texas is the clearest case: hospitals follow the 10-year statute above, while the Texas Medical Board rule gives physicians 7 years and runs the minor clock to age 21.

For all 50 states, including the physician rules alongside the hospital rules, see our complete Medical Records Retention Laws by State guide and the state-by-state detail pages.

Types of Hospital Records

Hospitals maintain several categories of medical records. Retention requirements generally apply to all categories, but some record types have additional rules.

Inpatient Records

These include history and physical exams, discharge summaries, operative reports, nursing notes, and progress notes. Under 42 CFR 482.24(b), a Medicare-participating hospital must maintain a medical record for each inpatient and retain it for at least 5 years, with state law setting the longer period where one applies.

Outpatient Records

Clinic visits, same-day procedures, and emergency department records. The same federal provision covers them, because 42 CFR 482.24(b) requires a medical record for each inpatient and outpatient. The 5-year federal floor and your state's retention period both apply to outpatient records.

Lab Results

Laboratory records fall under CLIA (the Clinical Laboratory Improvement Amendments) in addition to hospital retention rules. 42 CFR 493.1105 sets the federal minimums by record type:

• Test requisitions and authorizations: at least 2 years
• Test procedures: at least 2 years after the procedure is discontinued
• Quality control and patient test records: at least 2 years
• Test reports: at least 2 years after the date of reporting
• Pathology test reports: at least 10 years after the date of reporting
• Cytology slide preparations: at least 5 years from the date of examination
• Histopathology slides: at least 10 years from the date of examination
• Pathology specimen blocks: at least 2 years from the date of examination

State law can require longer retention for specific lab records, and where it does, the longer period governs.

Imaging and Radiology

Imaging that forms part of the hospital medical record falls under the same 5-year floor in 42 CFR 482.24(b)(1). Mammography is the exception, with its own federal rule.

Under the Mammography Quality Standards Act regulations at 21 CFR 900.12(c)(4), a facility must keep the original mammograms and mammography reports for the longest of three periods: not less than 5 years, not less than 10 years if no additional mammograms of the patient are performed at that facility, or any longer period state or local law requires.

Two practical rules follow from the same regulation. On request by or on behalf of the patient, the facility must transfer the original mammograms and copies of the reports within 15 calendar days. Before it closes or stops providing mammography services, it must arrange continued access for patients and healthcare providers, notify its accreditation body and certification agency in writing, and make reasonable efforts to notify all affected patients.

How to Access Your Hospital Records

HIPAA gives you the legal right to access and obtain copies of your medical records from any hospital or healthcare provider (45 CFR 164.524).

How to Request Records

Submit a written request to the hospital's medical records department. Most hospitals accept requests by form, email, letter, or fax. Many hospitals also offer access through an online patient portal.

How Long the Hospital Has to Respond

The hospital must act on your request no later than 30 days after it receives the request (45 CFR 164.524(b)(2)(i)). It may extend that deadline once, by no more than 30 additional days, and only if it gives you a written statement of the reason for the delay and the date it will finish (45 CFR 164.524(b)(2)(ii)).

HHS publishes guidance on the individual right of access that explains how the deadline applies to common request types.

What the Hospital Can Charge

Fees must be "reasonable, cost-based" and may include only the cost of copying labor, supplies for the paper copy or portable electronic media, postage when you ask for the copy to be mailed, and preparing an explanation or summary if you agreed to one (45 CFR 164.524(c)(4)).

The hospital cannot charge you for searching for or retrieving your records. For electronic copies of records the hospital maintains electronically, HHS allows a flat fee of $6.50 or less covering all of those costs.

That $6.50 figure is not a ceiling, and HHS says so directly. Asked whether $6.50 is the maximum a covered entity may charge, HHS answers "No," and explains that the flat fee is "an option available to entities that do not want to go through the process of calculating actual or average allowable costs" (HHS FAQ 2030). A hospital that calculates its actual or average allowable costs instead may lawfully charge more, so long as the fee stays reasonable and covers only the cost categories the rule permits.

What the Hospital Cannot Do

A hospital cannot deny access because you have an unpaid bill, because the records are old, or because the request is inconvenient.

If a hospital refuses your request, you can file a complaint with the HHS Office for Civil Rights. HHS explains that process in its consumer guidance on your medical records.

Records Past the Retention Period

If the retention period has expired and the records were properly destroyed, the hospital is not required to produce them.

Some states require a hospital to keep a summary or abstract of a record after the full file is destroyed, but that rule is not uniform. Kansas is a clear example of a state that does: its hospital rule requires a summary of destroyed medical records to be kept on file for at least 25 years, listing the patient's name, age and date of birth, the nearest relative, the attending and consulting practitioners, any surgical procedure and its date, and the final diagnosis (K.A.R. 28-34-9a). That is far less than the full chart, but it is often enough to establish that treatment happened and who provided it.

Ask the hospital's medical records department what survived destruction, and check with your state health department for the rule that applies where you were treated.

What Happens When a Hospital Closes

When a hospital ceases operations, your medical records do not disappear. The hospital must follow specific procedures to protect patient information.

Required Steps

Closure duties come mostly from state hospital licensure rules, so the exact steps and deadlines vary by state. The pattern below is the common one, and your state health department can confirm what applies locally.

1. Notify the state health department in writing with the location where records will be stored and the name of the records custodian
2. Notify patients in advance of closure and offer the opportunity to obtain copies or designate a new provider
3. Appoint a records custodian who becomes legally responsible for maintaining, safeguarding, and providing access to records
4. Maintain records for the full remaining retention period, even after the hospital closes

Where Closed Hospital Records Go

Records from closed hospitals typically transfer to one of these custodians:

• A successor hospital or acquiring healthcare system
• Another healthcare provider willing to accept custody
• The state health department or state archives
• A commercial records storage company

Some states put the duty directly in statute. In Massachusetts, on the permanent closing of a hospital or clinic, the facility "shall arrange for preservation of such medical records for the time required herein" (M.G.L. c. 111, § 70). Washington puts the same duty in its retention statute: if a hospital ceases operations, "it shall make immediate arrangements, as approved by the department, for preservation of its records" (RCW 70.41.190).

Pennsylvania adds a step most states leave out. A closing hospital must tell the Department where its records are stored, the records "are to be stored in a facility offering retrieval services for at least 5 years after the closure date," and before anything is destroyed the hospital must run public notice in two forms, a legal notice and a display advertisement in a newspaper of general circulation, so former patients can claim their own records (28 Pa. Code § 115.23). North Carolina puts the duty in its hospital licensure rule: a hospital that discontinues operation "shall make known to the Division where its records are stored," and those records "shall be stored in a business offering retrieval services for 11 years after the closure date," or until a minor patient's 30th birthday if the patient was a minor (10A NCAC 13B .3903).

Finding Records from a Closed Hospital

Contact your state health department first. They typically maintain a record of which entity assumed custody of records from closed facilities. You can also check with any hospital that may have acquired the closed facility.

Digital vs. Paper Records

The shift from paper to electronic health records (EHR) does not change retention requirements. CMS confirms that electronic documents must meet the same retention periods as paper records.

Digital records offer advantages for long-term retention: they eliminate physical storage constraints, allow easier backup and redundancy, and enable faster retrieval for patient requests.

Long-term digital preservation still has open problems. NIST ran a research program on preserving electronic health records over decades as software formats and hardware change, though its project page now notes the initiative is no longer actively maintained, so treat it as background rather than current federal guidance. The practical issue it addressed is still live: when a hospital replaces its EHR system, records created in the old system have to stay retrievable for the rest of the retention period.

Special Categories

Minor Patients

Nearly every state extends the retention period for records of patients who were minors. The most common approach is to retain records until the child reaches age 18 plus the standard adult retention period.

North Carolina has the longest minor-specific requirement in the table above. Its hospital rule directs the manager of medical records to keep records created when the patient was a minor "until the patient's 30th birthday," and to switch back to the ordinary 11-year adult clock if that minor is later readmitted as an adult (10A NCAC 13B .3903).

Mental Health Records

Psychotherapy notes receive special HIPAA treatment. The individual right of access in 45 CFR 164.524(a)(1)(i) expressly excludes psychotherapy notes, so patients do not have the same right to obtain those notes that they have for the rest of their record. Disclosure of psychotherapy notes generally requires a specific patient authorization, separate from general medical records consent.

Substance Abuse Records

42 CFR Part 2 provides heightened confidentiality protections for records of patients receiving substance use disorder treatment. A major 2024 update aligned these protections more closely with HIPAA, with compliance required by February 16, 2026.

How Records Are Destroyed

When hospital records reach the end of their retention period, they cannot simply be thrown out. The HIPAA Privacy Rule requires a covered entity to keep "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information" (45 CFR 164.530(c)(1)), and that duty runs through disposal.

The Security Rule is more specific for electronic records. A covered entity must "implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored," and must remove electronic protected health information from media before that media is made available for reuse (45 CFR 164.310(d)(2)).

In practice that means paper records are destroyed by methods that leave them unreadable, such as shredding, burning, or pulverizing, and electronic media are wiped, degaussed, or physically destroyed. Leaving records in an unsecured dumpster or a publicly accessible recycling bin does not meet the safeguard standard.

Hospitals may hire a business associate to handle disposal, but a business associate agreement must be in place first.

Some states add a notice step before destruction. Massachusetts allows a hospital or clinic to destroy records "only after the applicable retention period has elapsed and after notifying the department of public health, in accordance with its regulations, that the records will be destroyed" (M.G.L. c. 111, § 70). Check your state's hospital licensure rules for a similar requirement.