How Long Do Hospitals and Doctors Keep Medical Records?

You need an old medical record. Maybe you're switching doctors, applying for disability, dealing with a new diagnosis that requires history, or just trying to figure out what medication you took for that thing five years ago. So you call the hospital, and they tell you the records are gone.

Is that true? Sometimes, yes. But often, no.

There isn't one nationwide rule for how long hospitals keep medical records. Retention depends on state law, federal requirements for specific record types, and the healthcare organization's own policies. HIPAA gets a lot of blame here, but it doesn't actually set a general retention period. That means the common belief that medical records are automatically destroyed after 7 years isn't universally true.

Some records get kept longer. Some organizations have different rules for adult and minor patients or specific record types. And plenty of records sit in archives long after the minimum required period, just waiting for someone to ask for them.

TL;DR: Key Takeaways

• There is no single nationwide rule for how long hospitals and doctors must keep every medical record.
• HIPAA doesn't establish a general medical-record retention period. State laws usually determine how long records must be retained.
• Some federal requirements do specify retention periods for particular records. For example, certain Medicare documentation must be maintained for 7 years from the date of service.
• Medical records aren't automatically destroyed after 7 years just because HIPAA exists.
• Records for children may have different retention requirements than records for adults, depending on state law.
• If you need an old medical record, contact the hospital, doctor's office, or health system that created or maintained it. You may also be able to request a copy under HIPAA.

Need care today, or trying to figure out what your medical records mean? Try August AI's free symptom checker to evaluate your symptoms in under 3 minutes, or book a $39 online urgent care visit with August AI. A US-licensed clinician can review your symptoms and prescribe when clinically appropriate, with same-day pharmacy pickup across all 50 states. The visit does not guarantee a prescription. Online urgent care isn't appropriate for emergencies or conditions that require an in-person examination, testing, or imaging.

How long do providers keep records?

Hospitals and doctor's offices keep records for however long the applicable rules require, but there's no single nationwide answer. It varies by state, by the type of record, and by the organization's own policies.

The Department of Health and Human Services specifically states that HIPAA doesn't include medical-record retention requirements, which surprises a lot of people. State law usually does the actual work here.

Many hospitals also keep records longer than the minimum required by law, especially for pediatric records, operative reports, or complex cases. So an old record might still be sitting in an archive even if state law would technically allow it to be destroyed.

What if your doctor retires or closes their practice?

This is the situation that trips people up most often.

Records aren't supposed to just disappear when a practice closes. Depending on state rules, they might get transferred to another provider, another practice, or a designated records custodian. But finding them can take a few phone calls.

If you're looking for records from a doctor you saw years ago, start with the practice itself. If it no longer exists, try the state medical board. The board can often point you toward the current records custodian or tell you where the records went when the practice closed.

How long are medical records kept under HIPAA?

Here's where a lot of confusion starts.

HIPAA is a privacy and security law. It protects your health information, but it doesn't tell hospitals how many years they have to keep it.

The "6-year HIPAA rule" you'll see online is real, but it applies to specific compliance documentation (privacy policies, breach notification logs, that kind of thing), not to your actual medical records. State law is what usually governs how long your medical records get kept.

Are medical records destroyed after 7 years?

Not automatically.

The "7 years" rule you might have heard comes from real requirements, just narrower ones than most people think. Certain Medicare documentation must be kept for 7 years from the date of service, for example. But that's a specific rule for specific records, not a nationwide expiration date on your entire medical history.

Think of the "7 years" idea like the "10,000 steps a day" recommendation for walking: memorable, widely repeated, but not actually a universal rule the experts follow. State laws often require longer, and many healthcare organizations voluntarily keep records well beyond the minimum.

Why do providers keep medical records for so long?

Because your medical record isn't just a history of your appointments. It can contain information that matters for your ongoing care years later.

A medical record includes diagnoses, clinical notes, medication history, allergies, laboratory results, imaging reports, surgical records, hospitalization records, treatment plans, immunization information, and specialist reports.

If you had surgery several years ago, an old operative report could give a new clinician information that isn't obvious from your current symptoms or medication list. Your record can also help you avoid repeating tests or procedures when previous results are still relevant.

If you want to understand exactly what belongs in a medical record, see our guide to what medical records are.

Are medical records kept longer for children?

They can be, and this often surprises people.

Retention rules for minors are often longer than for adults because a child's record may need to remain available for years after they turn 18. The exact requirement depends on the state and the type of provider. Some rules use the patient's age; others use age plus a set number of years after the last treatment.

Don't assume an old pediatric record has been destroyed just because it's more than 7 years old. If you need childhood medical records, contact the hospital, pediatrician, or health system where you received care and ask what's still available.

Can you get old medical records?

Often, yes.

HIPAA generally gives individuals the right to inspect, review, and receive copies of medical records and billing records held by covered healthcare providers and health plans, with limited exceptions.

Start by contacting the provider's medical records, health information management, or patient records department. You'll likely need to complete an authorization or records request form and verify your identity.

If the provider still has the records, they can generally provide copies through an appropriate method. Providers can charge reasonable, cost-based fees for copying and mailing, but HHS states that they can't deny you a copy simply because you haven't paid a medical bill.

If the provider no longer exists, finding the records takes more legwork. Try the former practice, the organization that acquired it, or the state licensing or regulatory authority for guidance.

What happens when medical records are destroyed?

Hospitals can't just toss medical records in a dumpster.

HIPAA requires reasonable safeguards for protected health information as long as it's maintained, including during disposal. For paper records, that usually means shredding. For electronic records, it means proper deletion or destruction of the storage media so the information can't be recovered.

Most healthcare organizations also have internal policies for reviewing, archiving, transferring, and destroying records. Your old chart isn't tossed casually.

What if a hospital says it no longer has your records?

If a hospital or doctor's office tells you an old record is no longer available, don't take "gone" at face value. Ask a few follow-up questions:

• When was the record destroyed?
• Was the entire record destroyed or only part of it?
• Was it transferred to another organization?
• Was the practice acquired or closed?
• Is there an archived or off-site copy?
• Can you get written confirmation of retention or destruction?

The answers can tell you whether the record is genuinely unavailable or just stored somewhere else.

If you're looking for something specific like an imaging report or surgical record, ask directly whether that part of the record is still available. Sometimes the summary is gone but the imaging is still there, or vice versa.

How should you keep your own medical records?

You don't need to hoard every piece of healthcare paperwork forever, but having copies of important records can save you real headaches later.

Consider keeping an organized copy of your current and past medication lists, major diagnoses, allergy information, surgical and hospitalization records, important laboratory results, imaging reports, vaccination records, specialist reports, and discharge summaries.

You can store these digitally, on paper, or through a secure patient portal.

The best time to request copies is before you actually need them, especially when you change doctors, move to another state, change health systems, or see specialists who don't have access to your previous records. Requesting records from a practice you're leaving is much easier than trying to track them down years later.

Retention vs access: two different questions

People often confuse these two, but they're not the same.

Retention asks: How long is the healthcare organization required or permitted to keep the record?

Access asks: Can you actually obtain a copy of the record?

A record can still exist even if you haven't accessed it in years. But if a record has been legally destroyed after the applicable retention period, the provider can't produce something that no longer exists.

HIPAA generally gives you access rights to records maintained by covered providers and plans, with limited exceptions. If you're looking for an old medical record, always start by asking whether the organization still has it, rather than assuming it's gone.

Conclusion

So, how long do hospitals keep medical records? There's no single answer for every hospital or patient.

The HIPAA Privacy Rule doesn't set a universal retention period. State law generally determines how long records must be retained, and additional federal requirements can apply to particular records or types of care.

That's why the idea that all medical records are destroyed after 7 years isn't accurate. Some records live in archives for decades.

If you need an old medical record, don't assume it's gone. Contact the hospital, doctor's office, or health system that provided your care and ask whether the record is still available or whether it was transferred elsewhere. If the record still exists, you generally have important rights under HIPAA to request access.

And keeping your own copies of important medical documents can save you a lot of trouble later, especially when you change doctors or healthcare systems.