Most hospitals in the United States keep your medical records for 5 to 10 years, depending on the state where you were treated. There is no single federal law that sets one universal retention period. Instead, a patchwork of state laws, federal program rules, and record-specific regulations determines how long your records stay on file.
No Federal Minimum for Most Records
HIPAA, the federal privacy law most people associate with medical records, does not require hospitals to keep records for any specific length of time. It only requires that hospitals protect your information for as long as they do hold onto it, including during the process of destroying old files. The actual retention timelines come from state law and, for hospitals that accept Medicare or Medicaid, from the Centers for Medicare and Medicaid Services (CMS).
CMS requires hospitals participating in Medicare and Medicaid to retain medical records in their original or legally reproduced form for at least five years. That five-year floor applies broadly, but most states set their own minimums that are equal to or longer than this federal baseline.
State Requirements Range From 5 to 11 Years
State laws create the biggest variation in how long your records are kept. The shortest minimums are five years, and the longest is 11 years. Here’s how states generally break down:
- 5 years: Alabama, Arkansas, Florida, Kentucky, Maryland, Nevada, Virginia
- 6 years: New York, Washington
- 7 years: Arizona, California, Connecticut, Delaware, District of Columbia, Hawaii, Idaho, Indiana, Maine, Massachusetts, Michigan, Minnesota, Mississippi, New Jersey, Ohio, Oklahoma, Pennsylvania, South Dakota, Texas, Utah, Wisconsin
- 10 years: Colorado, Georgia, Illinois, Iowa, Kansas, Louisiana, Missouri, Montana, New Hampshire, New Mexico, North Dakota, Oregon, Rhode Island, South Carolina, Tennessee, Vermont, West Virginia, Wyoming
- 11 years: North Carolina
These are minimums. Many hospitals choose to keep records longer than required, especially large health systems that have transitioned to electronic storage where the cost of holding old records is relatively low. But once the minimum period expires, the hospital has no obligation to maintain your file.
Children’s Records Are Kept Much Longer
If the patient is a child, retention periods extend significantly. The American Academy of Pediatrics recommends keeping pediatric records for at least 10 years or until the child reaches the age of majority (typically 18) plus the state’s statute of limitations for malpractice claims, whichever is longer.
This matters more than it might seem at first. In some states, the statute of limitations for a malpractice lawsuit doesn’t begin until the patient turns 18. So in a state with a two-year statute of limitations, a malpractice case related to care a baby received at birth could legally be filed 20 years after delivery. That means the hospital needs to keep those newborn records for at least two decades. If you were treated as a child and are now an adult trying to access those records, there’s a reasonable chance they still exist, but the window does eventually close.
Some Records Have Their Own Rules
Certain types of medical records carry separate federal retention requirements that override general state timelines. Mammography records are the clearest example. Under the Mammography Quality Standards Act, facilities must keep original mammograms and reports for at least 5 years, or at least 10 years if no additional mammograms are performed at that facility. State or local law can push this even longer.
Vaccination records follow a different path entirely. While hospitals keep immunization data as part of your general medical record (subject to the same state timelines), most states also feed vaccination information into state immunization registries. These are population-level databases that consolidate records from multiple providers and can maintain lifetime vaccination histories. If a hospital destroys your general records after the retention period ends, your immunization history may still be accessible through your state’s registry.
Why Malpractice Laws Shape Retention
One of the biggest reasons hospitals hold records beyond the bare minimum is legal liability. If a patient files a malpractice lawsuit and the hospital has already destroyed the relevant records, defending the care provided becomes extremely difficult. For this reason, many hospitals and individual practitioners align their retention policies not just with record-keeping laws but with the statute of limitations for medical malpractice in their state.
Statutes of limitations for malpractice vary widely, typically ranging from one to six years depending on the state and the circumstances. Some states also have “discovery rules” that extend the clock if a patient didn’t know about an injury right away. Hospitals often factor in these longer potential windows when deciding how long to store files, which is why your records may still be available years after the legal minimum has technically passed.
How to Get Copies of Your Records
Under HIPAA, you have the right to request a copy of your medical records from any hospital or provider that still has them. The hospital can charge you for the copies, but the fees are regulated. One common option is a flat fee of up to $6.50 for electronic copies, which hospitals can use as a simplified alternative to calculating their actual per-page costs. Some facilities charge more using an itemized cost-based method, but they must stay within the boundaries set by the Privacy Rule.
If you need records from a hospital visit that happened years ago, your best first step is to contact the hospital’s health information or medical records department directly. They can tell you whether your records are still on file. For very old records, ask whether the hospital transferred files to an offsite storage company or archive before destruction, as some systems do this as a middle step. If the records have already been destroyed and the hospital followed its state’s retention requirements, there is no legal remedy to recover them.
The practical takeaway: keep your own copies of important medical records, especially surgical reports, imaging results, and medication histories. Hospitals are only required to store your records for a limited window, and once that window closes, your personal copies may be the only ones that exist.