Medical Records Retention Laws by State: A Reference for HIM Teams

October 26, 2026Posted by: Tony Acerra

Take Control of Your Records

Get a free consultation to simplify storage, scanning, retrieval, and secure destruction.

Get Started

An HIM director whose system has hospitals in New Jersey and Pennsylvania is already working to two clocks. New Jersey hospitals keep records for 10 years after the most recent discharge, or until the patient turns 23 if that’s later. Pennsylvania hospitals keep them for 7 years after discharge, and for minors, until majority and then 7 more years. Add a Medicare floor, a payer contract and a lawsuit, and one patient’s chart can carry three different end dates.

This reference covers the federal rules that sit under every state, then eleven states, including those where GRM runs records facilities: California, Florida, Georgia, Illinois, Indiana, Maryland, Massachusetts, New Jersey, New York, Pennsylvania and Texas. Every period below was checked against the text of the statute or regulation in October 2026. For other states and record types, see our records retention guidelines by state.

Why HIPAA Does Not Set the Retention Period

HHS answers the question directly in its HIPAA FAQ: the Privacy Rule does not include medical record retention requirements, and state laws generally decide how long records are kept. What HIPAA does require is that covered entities protect records with appropriate safeguards for as long as they hold them, including when they dispose of them.

The six years people associate with HIPAA comes from two documentation rules. The Security Rule requires covered entities to keep their required documentation for 6 years from its creation or the date it was last in effect, whichever is later, and the Privacy Rule sets the same period for its policies, procedures and documented actions. Those are records about your compliance program. Our guide to HIPAA records retention covers that side in detail.

Federal Retention Floors That Sit Under State Law

• Hospitals in Medicare. The Conditions of Participation require medical records to be kept in original or legally reproduced form for at least 5 years.
• Critical access hospitals. Records are kept at least 6 years from the date of last entry, and longer if state law requires it or a pending proceeding may need them.
• Ordered, certified, referred or prescribed services. Providers that furnish these Part A or B services, items or drugs, and the practitioners who order them, keep the related documentation for 7 years from the date of service. CMS’s 2026 fact sheet on medical record maintenance and access explains the same rule.
• Medicare Advantage. MA plans keep their records for 10 years, and their contracts with providers preserve the government’s right to audit pertinent information for 10 years after the contract period or audit ends. Providers are bound to that period through their plan contracts, not by a direct federal rule on the chart.
• Clinical laboratories. CLIA requires pathology test reports to be kept for at least 10 years after reporting, histopathology slides for 10 years, cytology slides for 5 years and specimen blocks for 2 years from examination. Our article on in-house pathology storage covers the lab side.

Here’s the part that trips up experienced HIM teams: the seven years everyone quotes for Medicare isn’t a rule for the whole chart. It comes from a regulation about documentation for ordered, referred and prescribed services. The hospital Conditions of Participation say five. Your state may say ten, or twenty. The period that governs is the longest one that applies to that record, and for most hospitals it comes from the state, not from Washington.

Medical Records Retention Periods by State

State	Hospitals	Minor patients (hospitals)	Physicians
California	7 years after discharge	At least 1 year after age 18, never less than 7 years	7 years after last date of service
Florida	No general statewide period for private hospitals	Not set for private hospitals	5 years from last patient contact
Georgia	5 years after discharge	5 years past the age of majority	10 years for evaluations, diagnoses, prognoses, lab reports and biopsy slides
Illinois	At least 10 years	No separate rule	No general period identified
Indiana	At least 7 years	No separate rule	At least 7 years
Maryland	7 years after the record is made	Age of majority plus 7 years	Same as hospitals
Massachusetts	20 years after discharge or final treatment	No separate rule	7 years from last encounter
New Jersey	10 years after most recent discharge	Until age 23, if longer	7 years from most recent entry
New York	6 years from discharge	3 years after age 18, if longer	6 years
Pennsylvania	7 years after discharge	Until majority, then 7 years	7 years from last service
Texas	10 years after last treatment	Age 20 or 10 years, whichever is later	7 years from last treatment

“No general period identified” means we found no statewide statute or board rule setting a general period as of October 2026. Payer contracts, federal rules and facility policy still apply. The notes below give the citation for each state and the details a table can’t hold.

California. General acute care hospitals preserve patient records, including X-ray films, for at least seven years following discharge (22 CCR 70751(c)); a hospital that ceases operation must tell the Department within 48 hours how its records will be preserved (70751(d)). Since January 1, 2024, a physician who fails to keep records for at least seven years after the last date of service commits unprofessional conduct (Business and Professions Code 2266). Medi-Cal providers keep required records for 10 years from the latest of the contract end, audit completion or date of service.

Florida. Physicians keep patient records for at least five years from the last patient contact (Florida Administrative Code 64B8-10.002), and a physician who closes, sells or relocates a practice publishes a newspaper notice once a week for four consecutive weeks. The state’s hospital rule on health information management does not set a retention period. Public healthcare providers follow the state records schedule, which keeps patient medical records 7 anniversary years after last entry, with longer periods for some minors.

Georgia. Hospitals keep medical records at least until the fifth anniversary of discharge, and records of minors for at least five years past the age of majority; films, scans and other images are kept at least five years after the procedure (111-8-40-.24). Separately, Georgia law requires a provider with custody of any evaluation, diagnosis, prognosis, laboratory report or biopsy slide to keep that item for not less than ten years from its creation (O.C.G.A. 31-33-2); hospitals are excluded and follow the hospital rules instead.

Illinois. Every hospital preserves its medical records for not less than 10 years, and if an attorney gives written notice of pending litigation before the 10 years run out, until the case ends or 12 years from the record’s creation, whichever comes first. Hospital X-ray films are kept for 5 years under the X-Ray Retention Act.

Indiana. One statute covers hospitals, physicians and other listed providers: original health records or microfilms are kept for at least seven years (IC 16-39-7-1), X-ray images for at least five years, and mammograms for five years, or ten if the provider performs no further mammograms for that patient.

Maryland. Maryland lengthened its rule in 2024. Since October 1, 2024, a health care provider, hospitals and physicians included, may not destroy a medical record, laboratory report or X-ray report for 7 years after it is made unless the patient is notified, and a minor’s records are kept until the age of majority plus 7 years unless a parent or guardian is notified (Health-General 4-403). The previous period was five years, so older internal schedules may be out of date.

Massachusetts. Hospital and clinic records may be destroyed 20 years after the patient’s discharge or final treatment, and only after notifying the Department of Public Health (General Laws c. 111, s. 70). Physicians keep records for at least seven years from the last patient encounter; for a patient who was a minor at that encounter, the longer of seven years or until the patient turns 18 (243 CMR 2.07(13)).

New Jersey. Hospitals keep medical records for 10 years following the most recent discharge, or until the patient reaches age 23 if that is longer, keep the discharge summary for 20 years, and keep X-ray films for 5 years (N.J.S.A. 26:8-5). Physicians keep treatment records for seven years from the most recent entry (N.J.A.C. 13:35-6.5).

New York. Hospitals keep medical records for at least six years from discharge, or three years after the patient turns 18 if that is longer, or at least six years after death (10 NYCRR 405.10). Physicians keep patient records for at least six years, and obstetrical records and records of minors for at least six years and until one year after the patient turns 18 (Education Law 6530(32)).

Pennsylvania. Hospitals keep medical records for at least 7 years following discharge, and records of minors until majority and then for 7 years (28 Pa. Code 115.23). Physicians keep records for at least 7 years from the last medical service, and a minor’s record until one year after the patient reaches majority (49 Pa. Code 16.95).

Texas. A hospital may authorize disposal of a medical record on or after the 10th anniversary of the patient’s last treatment; for a patient last treated before 18, on or after the 20th birthday or the 10th anniversary, whichever is later; and never while the hospital knows related litigation is unresolved (Health and Safety Code 241.103). Physicians keep records at least seven years from the date of last treatment, and a minor’s records until age 21 or seven years, whichever is longer, under 22 TAC 163.2, which replaced the repealed rule 165.1 in January 2025. Separately, a 2025 law requires covered entities to keep electronic health records containing patient information physically maintained in the United States or a U.S. territory, including records held by cloud or other third-party storage providers, a requirement that applies to storage on or after January 1, 2026.

Minor Patients: The Rule That Extends Every Schedule

Take a patient discharged from a New Jersey hospital at age 4. The 10-year rule would end at age 14, but the statute keeps the record until age 23, up to nineteen years after the stay. The same child treated in a Texas hospital keeps the record until the 20th birthday, and in a Maryland practice until majority plus seven years. A schedule keyed only to discharge dates will flag those charts years too early.

The practical fix is to store the patient’s date of birth with the record, or at least a “minor at time of care” flag, so the right end date can be calculated when the record reaches review. For paper records in storage, that means capturing it in the box or file index at intake, not reconstructing it from the chart years later.

How to Build a Retention Crosswalk Across States

1. List record types per facility. Inpatient charts, outpatient and physician records, imaging, discharge summaries, laboratory and pathology materials, and billing records.
2. Apply the state rule for that facility type. A hospital outpatient department and an affiliated physician practice in the same state can fall under different rules.
3. Add the federal floors. Medicare Conditions of Participation, the 7-year documentation rule for ordered and referred services, CLIA for lab materials.
4. Add contract and program terms. Medicare Advantage and Medicaid contracts can extend the period, as California’s 10-year Medi-Cal rule shows.
5. Record the trigger for each rule. The clocks start at different events: discharge in California and Pennsylvania, most recent discharge in New Jersey, last treatment in Texas, last patient contact for Florida physicians, and the date the record was made in Maryland.
6. Take the longest period, then add holds. A litigation hold, an investigation or an audit suspends the end date regardless of the schedule.

The trigger column is the one most crosswalks get wrong. Two states with the same seven years can produce different end dates for the same patient if one counts from discharge and the other from the last treatment.

When Retention Ends: Review Before Anything Is Destroyed

Several of these states attach conditions to destruction itself. Massachusetts hospitals must notify the Department of Public Health before destroying records. Maryland requires notice to the patient, or to a parent or guardian for a minor, before a record is destroyed early. Texas hospitals must give patients written notice that records may be disposed of after the statutory periods, and may not destroy records tied to unresolved litigation. A record that is still needed, or that you are not sure about, stays in storage; keeping it costs far less than defending a premature destruction. When destruction is approved, document what was destroyed, under which rule and on whose authority.

For paper charts in storage, a defensible review depends on knowing exactly what is in each box. Our guide on managing paper records during a litigation hold covers how holds work in practice.

When a Practice or Hospital Closes

• California: a hospital that ceases operation informs the Department within 48 hours of how its records will be preserved.
• Massachusetts: a hospital or clinic that closes permanently arranges for its records to be preserved for the required time.
• Pennsylvania: a closing hospital stores records in a facility offering retrieval services for at least 5 years after closure and gives public notice before destruction.
• Florida and New Jersey: physicians closing a practice publish newspaper notices, and New Jersey also asks them to make reasonable efforts to notify patients treated in the prior six months.
• Texas: a physician leaving a practice notifies patients seen in the last two years and posts notice at least 30 days before leaving.

A closing practice still needs someone to answer record requests for years. GRM’s medical records custodian services take over storage and release of information for practices that close, retire or transition.

How GRM Keeps Medical Records Ready for Review

At intake, each box GRM stores receives a unique barcode entered into its inventory system, with box-level or folder-level tracking. GRM’s PrecisionPlus process governs how records move through storage and logs each movement, and through the eAccess portal clients search by barcode, keyword or metadata and run reports that include destruction eligibility. For medical document storage, access is restricted to authorized personnel and every record interaction is logged for audits, while pathology slides and tissue blocks are barcoded, indexed and kept in controlled vault systems, with handling processes aligned with CAP and CLIA guidelines. That combination is what lets a crosswalk become an actual review list instead of a spreadsheet nobody can match to boxes.

Frequently Asked Questions

How long do hospitals have to keep medical records?

Hospitals keep medical records for the period their state sets, which varies widely: 5 years after discharge in Georgia, 7 years in California and Pennsylvania, 10 years in Illinois, New Jersey and Texas, and 20 years in Massachusetts. Hospitals in Medicare must also keep records at least 5 years, and the longest applicable period governs.

Does HIPAA require medical records to be kept for six years?

No. HHS states that the HIPAA Privacy Rule does not include medical record retention requirements; state laws generally set them. HIPAA’s six-year rule applies to compliance documentation, such as policies, procedures and documented actions, which must be kept six years from creation or the date last in effect.

How long must medical records of minors be kept?

Most states extend retention for minors based on the patient’s age. Examples: New Jersey hospitals keep records until age 23 if that is longer than 10 years, Texas hospitals until the 20th birthday or 10 years, whichever is later, and Maryland providers until the age of majority plus 7 years.

How long do physicians have to keep patient records?

Physician retention periods are set by each state, usually by statute or medical board rule. Examples: 5 years from last patient contact in Florida, 6 years in New York, and 7 years in California, Massachusetts, New Jersey, Pennsylvania and Texas, with longer periods for minors in several states. Medicare and payer rules can extend them.

What should happen when a medical record reaches the end of its retention period?

A record that reaches the end of its retention period becomes eligible for review, not automatic destruction. Confirm the longest applicable state, federal and contract period has passed, check for litigation holds, give any notice the state requires, and document the decision. Records still needed, or in doubt, should stay in secure storage.

Retention Support From GRM

GRM provides indexed offsite storage for medical records, with barcode tracking and logged retrievals, climate-controlled vault storage for media, document scanning when a chart is needed on demand, and documented destruction once eligibility is confirmed. To keep multi-state records ready for every review date, request a free quote.