There is no single federal limit on how far back medical records can be subpoenaed. The practical answer depends on whether the records still exist, which is determined by a patchwork of state retention laws, federal program requirements, and the type of healthcare provider involved. In many cases, records from 7 to 10 years ago are readily available, and electronic records from much further back may still be retrievable.
Why There’s No Universal Time Limit
A subpoena is a legal demand for documents. Courts don’t set a specific cutoff date for how old medical records can be when subpoenaed. Instead, the limiting factor is whether the records still exist. If a provider kept records from 25 years ago, those records can be subpoenaed. If the provider destroyed them in compliance with their state’s retention law, there’s nothing left to produce.
Federal Rule of Civil Procedure 45 does allow a court to quash or modify a subpoena that imposes “undue burden” on the person or organization being asked to produce records. A request for decades-old paper files stored in an off-site warehouse could qualify as unduly burdensome, but the age of the records alone isn’t grounds to refuse. The requesting party would need to show a substantial need for the material, and the provider would need to demonstrate that retrieving it creates significant expense or hardship.
How Long Providers Are Required to Keep Records
HIPAA, despite being the most well-known health privacy law, does not require providers to keep medical records for any specific period. Record retention is governed primarily by state law, and those requirements vary widely. Most states require retention for somewhere between 5 and 10 years after the patient’s last visit or discharge, though a handful require longer.
Federal rules do apply in certain situations. Hospitals participating in Medicare must retain medical records for at least 5 years, per federal conditions of participation. Providers who submit Medicare cost reports must keep all patient records for at least 5 years after the cost report closes. Providers in Medicare managed care programs face a longer requirement: 10 years. And HIPAA’s administrative rules require Medicare fee-for-service providers to retain required documentation for 6 years from the date it was created or last in effect, whichever is later.
These are minimums. Many providers, especially large hospital systems, keep records far longer than required, particularly now that electronic storage is inexpensive.
Electronic Records Often Survive Much Longer
The shift from paper to electronic health records has dramatically extended the practical life of medical documentation. Most electronic health record systems are designed so that information is never permanently deleted. When a clinician corrects an error, the original entry is retracted or hidden from the default view, but it remains in the system’s version history. The American Health Information Management Association recommends that EHR systems never allow total elimination of information.
This means that even records a provider might have shredded after 7 years in the paper era could now persist indefinitely in a digital system. For anyone wondering whether old records might still exist to be subpoenaed, the answer is increasingly yes, especially if the provider transitioned to electronic records before or during the period in question.
Pediatric Records Have Longer Timelines
Records for children are a special case. The American Academy of Pediatrics recommends keeping pediatric records for at least 10 years or until the patient reaches the age of majority plus the state’s statute of limitations for malpractice, whichever is longer. In practice, this can extend retention dramatically. In a state where the statute of limitations doesn’t begin until the patient turns 18, and that statute runs for two years, a record from a newborn’s first days of life could be relevant to a lawsuit filed 20 years after delivery. Providers treating children are generally aware of this and retain records accordingly.
If you’re involved in litigation related to care you received as a child, there’s a reasonable chance those records still exist, especially if the provider is a hospital or large practice with systematic retention policies.
Records of Deceased Patients
HIPAA’s privacy protections apply to a deceased person’s health information for 50 years after the date of death. After that 50-year window, the records are no longer considered protected health information under federal law. This doesn’t mean providers are required to keep records for 50 years after a patient dies. It simply means that if the records do still exist within that window, HIPAA’s rules about who can access them still apply. A subpoena issued by a court would generally override HIPAA restrictions regardless, but the 50-year framework is worth knowing if you’re trying to access a deceased family member’s records through other channels.
What Determines Whether Old Records Can Actually Be Produced
Several practical factors determine whether a subpoena for older records will actually yield anything useful:
- State retention law. If the provider followed their state’s minimum retention period and destroyed records on schedule, the records no longer exist. No subpoena can produce documents that have been lawfully destroyed.
- Provider type. Hospitals and large health systems tend to retain records longer than solo practitioners or small clinics. A small practice that closed 15 years ago may have transferred records to another provider, sent them to a storage company, or destroyed them entirely.
- Storage format. Paper records from decades ago are more likely to have been destroyed or lost. Electronic records stored in active or archived systems are far more likely to be retrievable.
- Federal program participation. Providers receiving Medicare or Medicaid funding face federal retention floors of 5 to 10 years, which may exceed their state’s requirement.
Retrieval Costs and Who Pays
When records are subpoenaed, the provider is entitled to charge for the cost of locating, copying, and producing them. These fees vary by state. California, for example, allows providers to charge a search and retrieval fee of $30 plus per-page copying fees (50 cents per page for the first 25 pages, 25 cents for each additional page), along with clerical costs up to $24 per hour for time spent locating records. Other states have their own fee schedules.
For very old records that require digging through archived storage, retrieval costs can be higher, and the provider may argue that the expense constitutes an undue burden. In that situation, a court may require the party requesting the records to cover the cost of retrieval, or it may narrow the scope of the subpoena to reduce the burden.
How Statutes of Limitations Factor In
The reason someone is subpoenaing records matters. In personal injury or medical malpractice cases, the statute of limitations determines how long a plaintiff has to file a lawsuit. Once a case is filed, the parties can subpoena any records relevant to the claims, regardless of how old those records are. A malpractice case filed just before the statute of limitations expires might require records from 5, 10, or even 20 years earlier.
In criminal cases, certain offenses have no statute of limitations at all, meaning records from any point in a person’s life could theoretically be subpoenaed if they’re relevant and still exist. Workers’ compensation claims, Social Security disability cases, and VA benefits disputes can also involve records going back many years, since these cases often require documenting a long history of symptoms or treatment.
The bottom line: courts will not refuse a subpoena simply because the records are old. The only real barrier is whether the records have been destroyed in compliance with applicable retention laws. Given the durability of electronic health records, that barrier is lower than it used to be.