Medical Record RetentionRequirements by State
Complete 2025 guide to medical record retention laws. State-by-state requirements, federal minimums, minor patient rules, and HIPAA-compliant destruction protocols.
Understanding Medical Record Retention
HIPAA doesn't set retention periods for medical records—state law does. Here's what you need to know.
State Law Rules
Each state sets its own retention periods. Ranges from 5-11 years for adults.
Minors Are Different
Most states require retention until age of majority plus additional years.
Use Strictest Rule
When multiple requirements apply, always follow the longest retention period.
Proper Destruction
HIPAA requires PHI be rendered unreadable and indecipherable.
Federal Retention Requirements
These federal minimums apply in addition to state requirements. Use the longer of the two.
HIPAA Compliance Documentation
6 yearsFrom creation or last effective date
Medicare (General)
6 yearsFrom date of service
Medicare Managed Care
10 yearsCMS requirement for MA plans
Medicaid
6 yearsFrom date of service (varies by state)
ERISA Plans
6 yearsFrom filing date
OSHA Records
5 yearsFollowing calendar year of record
Important: HIPAA vs Medical Records
HIPAA requires compliance documentation (policies, training records, BAAs) to be retained for 6 years. This is different from medical record retention, which is governed by state law. Don't confuse the two.
State-by-State Retention Requirements
Complete breakdown of adult and minor patient record retention by state.
| State | Adult Records | Minor Records | Notes |
|---|---|---|---|
| Alabama | 6 years | Until age 19 + 6 years | From date of last treatment |
| Alaska | 7 years | Until age 19 + 7 years | From date of discharge |
| Arizona | 6 years | Until age 21 | From date of last treatment |
| Arkansas | 10 years | Until age 22 | From date of treatment |
| California | 7 years | Until age 19 + 7 years | From date of discharge |
| Colorado | 7 years | Until age 18 + 7 years | From date of last treatment |
| Connecticut | 10 years | Until age 21 | From date of discharge |
| Delaware | 7 years | Until age 21 | From date of last treatment |
| Florida | 7 years | Until age 25 | From date of last contact |
| Georgia | 10 years | Until age 23 | From date of last visit |
| Hawaii | 7 years | Until age 25 | After last treatment |
| Idaho | 7 years | Until age 21 | From date of last treatment |
| Illinois | 10 years | Until age 23 | From date of discharge |
| Indiana | 7 years | Until age 20 + 7 years | From date of discharge |
| Iowa | 10 years | Until age 21 + 10 years | From date of discharge |
| Kansas | 10 years | Until age 21 | From date of discharge |
| Kentucky | 6 years | Until age 19 | After patient dies or treatment ends |
| Louisiana | 10 years | Until age 21 | From date of discharge |
| Maine | 7 years | Until age 23 | From date of last treatment |
| Maryland | 5 years | Until age 21 + 3 years | From date of discharge |
| Massachusetts | 7 years | Until age 25 | From date of last treatment |
| Michigan | 7 years | Until age 21 | From date of last treatment |
| Minnesota | 7 years | Until age 21 | After last contact |
| Mississippi | 10 years | Until age 21 | From date of discharge |
| Missouri | 7 years | Until age 21 | From date of discharge |
| Montana | 7 years | Until age 25 (immunizations) | From date of last contact |
| Nebraska | 10 years | Until age 21 | After services rendered |
| Nevada | 7 years | Until age 23 | From date of discharge |
| New Hampshire | 7 years | Until age 20 | From date of last treatment |
| New Jersey | 7 years | Until age 23 | From date of last treatment |
| New Mexico | 10 years | Until age 25 | From date of last treatment |
| New York | 6 years | Until age 21 + 6 years | From date of last visit |
| North Carolina | 11 years | Until age 30 | From date of discharge |
| North Dakota | 10 years | Until age 21 | From date of last treatment |
| Ohio | 7 years | Until age 21 | From date of discharge |
| Oklahoma | 7 years | Until age 20 | After treatment ends |
| Oregon | 10 years | Until age 21 | From date of last contact |
| Pennsylvania | 7 years | Until age 21 | From date of last treatment |
| Rhode Island | 5 years | Until age 23 | From date of discharge |
| South Carolina | 10 years | Until age 21 | From date of discharge |
| South Dakota | 10 years | Until age 21 | From date of last treatment |
| Tennessee | 10 years | Until age 21 + 1 year | From date of discharge |
| Texas | 7 years | Until age 21 | From date of last treatment |
| Utah | 7 years | Until age 22 | From date of last treatment |
| Vermont | 10 years | Until age 21 | From date of last treatment |
| Virginia | 6 years | Until age 21 | From date of last treatment |
| Washington | 10 years | Until age 21 + 3 years | From date of discharge |
| West Virginia | 10 years | Until age 21 | From date of discharge |
| Wisconsin | 7 years | Until age 21 | From date of last treatment |
| Wyoming | 10 years | Until age 21 | From date of discharge |
Disclaimer: This table provides general guidance. Laws change frequently. Always verify current requirements with your state medical board or healthcare attorney before establishing retention policies.
HIPAA-Compliant Record Destruction
When retention periods expire, PHI must be destroyed so it "cannot be reconstructed."
Shredding
Cross-cut shredding to ensure PHI cannot be reconstructed
Burning/Incineration
Complete destruction through controlled burning
Pulping/Pulverizing
Mechanical destruction rendering records unreadable
Degaussing
Magnetic erasure of electronic media
Physical Destruction
Crushing, disintegrating, or melting media
Secure Deletion
Software-based data wiping with verification
Destruction Best Practices
Secure, Compliant Documentation from Day One
PatientNotes AI generates HIPAA-compliant clinical notes stored securely in the cloud. Built-in audit trails, encryption, and automatic backups protect your documentation.
Just $50/month • HIPAA Compliant • SOC 2 Certified
Frequently Asked Questions
Common questions about medical record retention.
QDoes HIPAA require specific medical record retention periods?
No, HIPAA does not mandate how long to retain medical records. HIPAA only requires that compliance documentation (policies, procedures, training records) be kept for 6 years. Medical record retention periods are determined by state law, which varies significantly from state to state.
QWhat happens if state law and federal requirements conflict?
Always follow the most stringent requirement. If your state requires 10 years and Medicare requires 6 years, retain records for 10 years. Create a retention policy that identifies all applicable requirements and uses the longest period for each record type.
QWhen does the retention period start for minor patients?
For minors, most states require retention until the patient reaches the age of majority (usually 18) plus additional years. Some states extend this to age 21, 23, or even 25 plus additional retention years. Always calculate from the later date.
QHow should medical records be destroyed when the retention period expires?
HIPAA requires that PHI be rendered "unreadable, indecipherable, and otherwise cannot be reconstructed." For paper: shred, burn, or pulp. For electronic: degauss, physically destroy, or use certified data wiping software. Document all destruction with certificates of destruction.
QDo I need to notify patients before destroying their records?
Some states require notification before destruction. Best practice is to provide reasonable notice (30-60 days) through your Notice of Privacy Practices and/or direct notification when possible. Offer patients the opportunity to obtain copies before destruction.
QWhat about records for deceased patients?
Retain records of deceased patients for the full retention period from the date of death or last treatment, whichever your state requires. Some states have specific provisions for deceased patient records. HIPAA protections continue to apply for 50 years after death.
QCan I convert paper records to electronic and destroy the originals?
Yes, most states allow electronic storage if the system ensures integrity, accessibility, and security of records. Ensure your EHR system meets these requirements before destroying paper originals. Some records (like certain legal documents) may need to be retained in original form.
QWhat records should be retained longer than state minimums?
Consider longer retention for: records involved in litigation or investigations (retain indefinitely until resolved), patients with chronic conditions who may return, high-risk procedures or outcomes, records that may be needed for continuity of care, and any records subject to legal holds.