How long to keep medical records: Retention rules by state

Key Takeaways

No single federal law sets how long to keep medical records: state law governs clinical records, typically 5-10 years from last service date.

HIPAA’s 6-year rule covers administrative policies and documentation only, not the clinical records themselves.

Minor patient records require special treatment: retain until the patient reaches the age of majority plus the applicable state statute of limitations.

Pabau’s compliance management and client record features help practices automate retention tracking, access controls, and audit logs.

Practices lose malpractice cases not because they provided bad care, but because they cannot produce the records to prove they provided good care. The American Medical Association consistently identifies record retention gaps as one of the top administrative risks for physicians in private practice.

Yet most practices operate without a written retention policy, relying on a vague sense that “seven years is probably fine.” However, that assumption does not always hold up. Knowing how long to keep medical records matters just as much as keeping them accurate in the first place. Keeping client records up to date is only half the battle. You also need to know exactly when you are legally permitted to destroy them.

This guide covers how long to keep medical records under federal law and state-specific rules. In addition, it covers special cases for minors and deceased patients, plus the practical steps for secure disposal.

How long to keep medical records: The short answer

There is no single federal law that tells every practice how long to keep medical records. The answer depends on three overlapping layers of obligation:

• State law governs clinical records for most private practices. For example, requirements range from 5 to 10 years, with 7 years being the most common standard.
• Federal program rules (Medicare, Medicaid) add a separate floor for participating providers, typically 5 years from the date of service.
• HIPAA does not set clinical record retention. Instead, it sets a 6-year rule for HIPAA-related administrative documentation only.

A practical working rule covers most situations. Retain every record for the longer of your state’s minimum retention period, or the state’s malpractice statute of limitations plus two years. As a result, that formula keeps practices covered against the most common legal exposure scenarios.

Federal requirements: What HIPAA actually says about medical records retention?

This is the most common misconception in healthcare administration. In fact, HIPAA does not require clinical records to be kept for any specific period. What HHS HIPAA guidance requires instead is that covered entities retain HIPAA-related policies, procedures, and documentation for 6 years. That period runs from the date of creation or the date the document was last in effect, whichever is later.

That 6-year rule applies to things like your Notice of Privacy Practices, workforce training records, and risk assessment documentation. However, it does not apply to patient charts, clinical notes, or treatment records. In practice, those fall under state law instead.

Understanding this distinction matters for HIPAA compliance for medical offices, because conflating the two creates real risk. A practice that destroys clinical records after 6 years because “HIPAA said so” may be making a costly mistake. State statute often requires those same records to be kept for 7 or 10 years. Check the HIPAA compliance checklist for a fuller picture of what HIPAA administrative documentation covers.

Medicare and Medicaid records retention requirements

Providers participating in federal programs face an additional retention floor on top of state law. For instance, the CMS Medicare Conditions of Participation require hospitals to retain medical records for at least 5 years from the date of discharge. For a minor patient, that period extends to 3 years after the patient turns 18, whichever is longer. Similarly, physician practices billing Medicare are subject to comparable retention requirements tied to billing and reimbursement documentation.

Medicaid requirements vary by state. Because Medicaid is jointly administered, each state sets its own retention period for Medicaid-funded services. Some states align Medicaid retention with their general clinical retention statute; others impose a separate, longer period. Always verify current requirements with your state Medicaid agency.

Medical record retention by state: A reference guide

State law is the primary governing source for clinical record retention in private practice. The table below covers major US states. These figures reflect commonly cited state statutes and medical board guidance, but state laws change. Verify current requirements through your state’s medical board or a healthcare attorney before destroying any records.

For med spa compliance obligations, state law retention requirements apply to both clinical records and aesthetic treatment documentation.

Minor and pediatric patients: Special medical records retention rules

Medical records retention for minor patients follows a different formula than adult records. The standard approach is endorsed by the American Academy of Pediatrics. It calls for retaining records until the patient reaches the age of majority, plus the applicable statute of limitations period in your state.

In practice, consider a child treated at age 5 in a state with an 18-year age of majority and a 2-year malpractice SOL. That child’s records would need to be retained until age 20. This is because the clock does not start running on the SOL until the minor reaches adulthood in most states.

• Age of majority is 18 in most US states, 19 in Alabama and Nebraska, and 21 in Mississippi.
• Malpractice SOL for minors typically tolls (pauses) until the child becomes an adult.
• Safe default: retain pediatric records until the former patient turns 21. Alternatively, keep them until the state adult retention period runs from their 18th birthday, whichever is later.

Deceased patients and statute of limitations considerations

Most states require that the standard retention period runs from the date of last service or the date of death, whichever is later. Estate claims and wrongful death suits can be filed after a patient dies. As a result, the records remain legally relevant.

The statute of limitations for malpractice claims is the other critical variable. State SOL periods for medical malpractice generally range from 2 to 3 years. Some states, though, allow up to 6 years in cases of fraud or concealment. For data protection best practices in practice management, retain records beyond the SOL by at least two years. That buffer provides reasonable protection against late-filed claims.

The practical formula: keep all records for the longer of your state’s minimum retention period, or the state’s malpractice SOL plus 2 years. In short, this single rule resolves most retention decisions without needing to track individual record ages on a case-by-case basis.

Electronic vs. paper records: Does format change your retention obligations?

No. Retention obligations apply equally to EHR data and paper charts. In other words, the format of the record does not change the legal requirement to keep it.

Electronic records do introduce additional compliance considerations beyond simple retention. For example, HIPAA’s Security Rule requires that patient data security tools protect electronic protected health information (ePHI) throughout its entire lifecycle. That protection must continue during the retention period too. That means:

• Access controls: only authorized personnel should be able to view records, even historical ones.
• Audit logs: EHR systems should log who accessed which records and when. In turn, these logs themselves are HIPAA administrative documentation subject to the 6-year rule.
• Backup integrity: archived EHR data must remain retrievable in a usable format throughout the retention period. As a result, data stored on obsolete media that cannot be read is treated as lost.
• Migration planning: if you switch EHR systems, patient data from the old system must be migrated or archived in a compliant format. This should happen before the old system is decommissioned.

For practices moving to digital, resources on running a paperless, HIPAA-compliant practice cover the access control and encryption requirements in detail.

How Pabau helps practices manage medical records retention

Manual retention tracking creates compliance risk. For example, a practice with 2,000 active patients and 10 years of history cannot reliably track individual record ages. A spreadsheet or a wall calendar simply is not built for that. This is where practice management software changes the risk profile.

Pabau’s client record management stores all patient notes, treatment records, consent forms, and communications in a single secure, cloud-based environment. In addition, role-based access controls ensure that historical records are visible only to authorized staff, satisfying HIPAA’s minimum-necessary access standard throughout the retention period. In turn, audit logs track every access event automatically.

The platform’s compliance management features help practice managers document their retention policies and set review reminders. In addition, the system maintains the administrative paper trail that HIPAA requires for its own 6-year documentation rule. As a result, for practices across multiple locations, centralized record storage means retention compliance does not depend on individual site managers remembering the rules.

Learn more about Pabau’s HIPAA compliance posture and how the platform supports secure record management throughout the full retention lifecycle.

Stop tracking retention periods manually

Pabau stores patient records securely, maintains access-controlled audit logs, and helps your team stay compliant with HIPAA administrative documentation requirements without manual calendar reminders.

Book a demo

What to do when you close or sell your practice

Practice closure does not end your retention obligations. Records must be kept for the full retention period from the date of last service, regardless of whether the practice is still operating.

Most state medical boards require physicians closing a practice to notify patients in advance, typically within 30 to 90 days. In addition, physicians must give patients a reasonable opportunity to transfer or obtain copies of their records. In addition, the notification must include information about where records will be stored and how patients can request them.

• Notify patients in writing at least 30 days before closure (check your state’s specific requirement).
• Arrange record transfer if selling the practice: the purchasing provider typically assumes retention obligations by agreement.
• Archive independently if closing with no successor: use a certified medical records storage or archival service. That service must maintain HIPAA-compliant custody until each record’s retention period expires.
• Document the process: keep a record of patient notifications sent, records transferred, and any records destroyed at end of retention period.

How to safely dispose of medical records

Once the retention period has passed, you are not just permitted to destroy records. In some cases, holding records longer than necessary actually increases privacy exposure. Therefore, destruction must be done correctly to satisfy HIPAA Security Rule requirements.

• Paper records: cross-cut shredding by a certified document destruction vendor. However, simple tearing or single-pass shredding does not meet HIPAA standards.
• Electronic records: certified data deletion, degaussing (for magnetic media), or physical destruction of storage media. However, standard file deletion is not sufficient.
• Document the destruction: maintain a destruction log showing what was destroyed, when, by whom, and the method used. In fact, this log is itself HIPAA documentation subject to the 6-year retention rule.

For practices using a cloud-based EHR, check the vendor’s data deletion policy before relying on it for HIPAA-compliant destruction. In fact, the vendor should be able to certify that data is deleted from all servers, backups, and disaster-recovery systems.

Medical records retention: Quick-reference checklist

Use this checklist as a starting point for your practice’s written retention policy. Verify every period against your current state statute and federal program requirements before finalizing.

Pair this checklist with a medical spa compliance checklist if your practice operates in the aesthetics space. That space carries additional documentation requirements around consent and treatment photos.

Conclusion

Record retention failures are preventable. Most practices are not destroyed by bad clinical care. Instead, they are exposed by incomplete documentation, records destroyed too early, or minor patient records wiped before the SOL clock even started. Overall, the rules are manageable when you understand the layered structure: state law first, federal program floors second, HIPAA administrative requirements third.

Pabau’s client record and compliance management features remove the manual burden. Every patient record stored securely, every access logged, and retention documentation maintained automatically. Book a demo to see how it works in practice.

Continue your research

Need a framework for your full compliance program? HIPAA compliance for clinic software covers how your practice management platform should support your security obligations beyond just record retention.

Considering going paperless? Pabau digital forms replaces paper intake and consent processes with HIPAA-aligned electronic capture, reducing physical record storage risk.

Running a multi-location practice? Building a medical practice business plan includes compliance infrastructure planning, including record retention systems for distributed teams.

Frequently Asked Questions