How Long Do Doctors Keep Medical Records?
Most states require providers to keep adult medical records for somewhere between five and ten years after your last visit, and records for children until the child reaches adulthood plus several more years. There is no single national answer, because HIPAA does not set a retention period for medical records at all. HIPAA requires covered entities to keep their own compliance paperwork — policies, authorizations, notices — for six years, and that rule is often misquoted as a six-year records rule. It is not. The actual clock comes from your state, and it varies widely: some states set three years after the last encounter, others eleven. Hospitals frequently face longer requirements than individual physicians in the same state. The practical consequence is that once the clock runs out, a provider may legally destroy the record, and your right of access cannot recover something that no longer exists.
Why isn’t there one national rule?
Because retention is a state matter, and states set it against their own malpractice statutes of limitations rather than against any federal standard.
That means three different numbers can all be correct at once for a single episode of care: the state’s physician rule, the state’s hospital rule, and whatever a payer contract or federal program separately requires. When they conflict, the longest one governs in practice — a provider satisfies all of them by keeping the record for the longest applicable period.
It also means that a record from an out-of-state hospitalization follows that state’s rule, not yours. For anyone whose care has crossed state lines, the retention picture is a patchwork, and the shortest rule in the patchwork is the one that decides what you can still retrieve.
How long are children’s records kept?
Longer, and the clock usually does not start until the child turns eighteen.
The common pattern is age of majority plus the state’s malpractice limitations period — so retention until age 21 in some states, 23 in others, 30 in a few. The logic is that a person injured as a child has a right to bring a claim as an adult, and the record has to survive long enough for that to be possible.
For families managing a child’s chronic condition, this is more than a legal footnote. Pediatric records carry the early history — first symptoms, the diagnostic path, what was tried and ruled out — that adult specialists will ask about for decades. That history is at its most retrievable while the child is still a patient, and it becomes progressively harder to reassemble afterward.
What happens when the retention period ends?
The record can be destroyed, and often is.
Destruction is not usually announced. There is no notice to patients, no last-chance email. Storage costs money, and once a record is past its required retention period it becomes a line item rather than an obligation. Some systems keep records far longer than required, especially now that storage is digital. Others do not.
This is the part people learn too late. A record you assumed would always be there is gone, and the reason is entirely mundane.
How do I find out my own state’s rule?
Three sources, in order of reliability.
Your state medical board publishes retention requirements for licensed physicians, and usually says what happens when a practice closes. Your state department of health covers hospitals and facilities, which are often on a different schedule. And the provider’s own medical records department can tell you their internal policy, which is frequently longer than the legal minimum.
Ask the provider directly: how long do you retain records, and how far back can you still produce mine? That second question is the useful one. The policy tells you the rule; the answer tells you what actually exists.
What should I request first if the clock is running?
Work backward from oldest to newest, because the oldest records are the ones at risk.
Prioritize the material that cannot be reconstructed from anywhere else: operative reports, pathology, hospital discharge summaries, and any diagnostic workup that established a condition. Recent visit notes and labs are the easiest to replace and the least urgent, even though they are what portals show you first.
If a provider is closing or a physician is retiring, treat it as a deadline. Records from a closed practice are usually transferred to a custodian and remain obtainable, but the path gets longer and the answers get vaguer with every year that passes.
Does keeping my own copy change any of this?
It changes the only thing that matters, which is whether the record still exists when you need it.
A provider’s retention obligation ends. Your own copy does not. Once you hold the file, no state schedule, practice closure, or system migration can take it away from you — and you stop having to time your requests against a clock you cannot see. For a long or complex history spread across many providers, the copy you made years ago is regularly the only surviving version of the earliest and most important part of your record.
Organized.health helps you organize your health information. It does not provide medical advice, diagnosis, or treatment. Always talk to a qualified healthcare provider about your care.
Related: How do I get copies of my medical records? · How to organize your medical records · Health records in Organized.health
