How Long Are Patient Records Kept? Retention Laws by State

Short answer

Medical records are usually kept for 5 to 10 years after the patient's last visit, and longer for minors, but the period is set by state law, not HIPAA. HHS says the HIPAA Privacy Rule "does not include medical record retention requirements"; it does require HIPAA documentation, such as policies, to be kept six years. Medicare requires ordering and referring providers to keep records 7 years from the date of service. Dental boards set their own periods, from 4 years in Florida to 10 in North Carolina and Wisconsin.

HIPAA sets no retention period for the chart itself; state law does, and the longest rule that applies wins.
Minors' records run longer: commonly until a set age (21 in Texas, 25 in Maryland) or a set number of years, whichever is later.
Medicare Advantage and Medicaid managed care contracts can pull 10-year audit periods down to the practice.
Some imaging can be destroyed sooner if the report is kept; mammograms have a federal rule of their own.

How long are patient records kept?

Patient records are kept for the period your state sets, usually 5 to 10 years after the last visit for adults and longer for children, plus any longer period a federal program or a payer contract requires. HHS states that "the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained." (HHS).

Two federal periods are often confused with that. HIPAA's own paperwork, such as privacy policies and records of required actions, must be kept "for six years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.530). That applies to HIPAA documentation, not the chart. And HIPAA safeguards apply to records "for whatever period such information is maintained by a covered entity, including through disposal" (HHS).

This page is general information, not legal or medical advice; state law varies, so confirm each rule with your counsel, your malpractice carrier or your state board.

Medical records retention laws by state

The table gives the rule for 17 states, each with the statute or board rule it comes from. Periods run from the last treatment, entry or contact as the rule states. Where a state's rule covers dentists rather than physicians, the row says so. States not listed were left out because we did not read their rule on a primary source.

State	Who the rule covers	Adults	Minors	Source
Alabama	Physicians	7 years from last professional contact	At least 2 years after reaching majority, or 7 years, whichever is longer	Ala. Admin. Code 540-X-9-.10
Arizona	Health care providers	6 years after last service	3 years after the 18th birthday or 6 years after last service, whichever is later	A.R.S. 12-2297
Florida	Physicians	5 years from last patient contact	No separate rule in this section	Fla. Admin. Code 64B8-10.002
Florida	Dentists	4 years from last exam or treatment	No separate rule in this section	Fla. Admin. Code 64B5-17.002
Iowa	Dentists	6 years after last exam, prescription or treatment	Until age 19, or 6 years, whichever is longer	Iowa Admin. Code 481-574.13
Maryland	Physicians (Board of Physicians)	7 years from when the record was created	Until age 25, or 7 years, whichever is later	Maryland Board of Physicians
Massachusetts	Physicians	7 years from last encounter	7 years or until age 18, whichever is longer	243 CMR 2.07
Massachusetts	Dentists	7 years, including original x-rays	7 years, or 3 years after reaching majority, whichever is later	234 CMR 5.13
Michigan	Licensees	7 years from date of service	No separate rule in this section	MCL 333.16213
Mississippi	Dentists	7 years from last treatment	No separate rule	30 Miss. Code R. 2301-1.53
New Hampshire	Physicians	7 years from last contact	No separate rule in this section	N.H. Med 501.02
New Jersey	Physicians	7 years from most recent entry	No separate rule in this section	N.J.A.C. 13:35-6.5
New Jersey	Dentists	7 years from last entry, x-rays included	No separate rule in this section	N.J.A.C. 13:30-8.7
New York	Licensed professions	6 years	6 years and until 1 year after age 21; obstetrical records the same	8 NYCRR 29.2
North Carolina	Dentists	10 years from last treatment	No separate rule	21 NCAC 16T .0101
Pennsylvania	Physicians	7 years from last service	Until 1 year after reaching majority, even if longer than 7 years	49 Pa. Code 16.95
Tennessee	Physicians	10 years from last professional contact	1 year after majority or 10 years, whichever is longer	Tenn. Comp. R. & Regs. 0880-02-.15
Texas	Physicians	7 years from last treatment	Until age 21, or 7 years, whichever is longer	22 TAC 163.2
Texas	Dentists	5 years from last treatment	Until age 21, or 5 years, whichever is longer	22 TAC 108.8
Virginia	Dentists	6 years from last service	Until age 18 (or emancipation), with at least 6 years	18 VAC 60-21-90
Wisconsin	Dental practices	10 years from last entry	No separate rule	Wis. Admin. Code DE 8.035

Hospitals, nursing homes and other facilities have separate rules that this table does not show. A practice that falls under more than one rule keeps each record for the longest period that applies.

Medicare and Medicaid record retention rules

Federal health programs add their own periods on top of state law. The three that reach most practices:

Program	What the rule says	Source
Medicare (42 CFR 424.516(f))	Applies to "A physician or, when permitted, an eligible professional who orders, certifies, refers, or prescribes Part A or Part B services, items, or drugs". "The regulation requires you to maintain medical records for 7 years from the date of service (DOS)."	CMS MLN fact sheet
Medicare Advantage	The plan "agrees to maintain for 10 years books, records, documents, and other evidence", and must require its contracted providers to agree that HHS may audit records, "including medical records and documentation of the first tier, downstream, and entities related to CMS" contracts. The audit right "extends through 10 years from the end of the final contract period or completion of audit, whichever is later".	42 CFR 422.504
Medicaid managed care	Plans "must retain, and require subcontractors to retain, as applicable" listed records "for a period of no less than 10 years".	42 CFR 438.3

Your participation agreements with Medicare Advantage and Medicaid plans are where these periods reach you, so read them before you set a destruction date.

How long are dental records kept?

Dental records are kept for the period the state dental board sets, which in the states we read runs from 4 to 10 years after the last treatment. Florida requires "at least four (4) years" (Fla. Admin. Code 64B5-17.002); Texas "not less than five years from the last date of treatment" (22 TAC 108.8); Iowa and Virginia six; Massachusetts, Mississippi and New Jersey seven; North Carolina and Wisconsin ten (sources in the table above).

Radiographs usually follow the chart. New Jersey says "Patient records, including all radiographs, shall be maintained for at least seven years from the date of the last entry" (N.J.A.C. 13:30-8.7), and Massachusetts covers "original radiographs (x-rays)" in its seven-year rule (234 CMR 5.13).

How long to keep x-rays and imaging

Some states let a practice destroy the images sooner than the chart, as long as the written report is kept. Mammography has its own federal rule.

Alabama: "X-rays, radiographs, and other imaging products shall be retained for at least five (5) years after which if there exist separate interpretive records thereof, they may be destroyed." Mammography imaging and reports: ten years (Ala. Admin. Code 540-X-9-.10).
Tennessee: imaging "for at least four (4) years" if separate interpretive records exist; mammography ten years (Tenn. Comp. R. & Regs. 0880-02-.15).
Federal mammography rule: facilities keep mammograms and reports for "a period of not less than 5 years, a period of not less than 10 years if no additional mammograms of the patient are performed at the facility, or a period, if any, mandated by State or local law", whichever is longest (21 CFR 900.12).

Before destroying images that are past their period, read licensing medical imaging data: studies paired with signed reports are the part of an archive that holds value.

Medical records should be kept for how long when no rule applies?

Where no statute sets a period, follow your malpractice carrier. The Doctors Company recommends keeping records for "Adult patients, 10 years from the date the patient was last seen." and "Minor patients, 28 years from the date of birth.", and "Deceased patients, five years from the date of death." (The Doctors Company). Those are an insurer's recommendations for defending claims, not law.

Medical records destruction: what to do when the period ends

When a record passes its retention period, destroy it on a schedule, by a method that makes it unreadable, and keep a log. State rules spell out each part:

Method: "Records may be destroyed by burning, shredding, or other effective methods in keeping with the confidential nature of the records." (Tennessee 0880-02-.15).
Log: "When records are destroyed, the time, date and circumstances of the destruction shall be recorded and maintained for future reference." (Tennessee 0880-02-.15). The Doctors Company also advises that destroyed records "should be listed on a log with the date of destruction" (The Doctors Company).
Disputes: "no medical record involving services which are currently under dispute shall be destroyed until the dispute is resolved" (Tennessee 0880-02-.15).
Early destruction: Michigan lets a licensee destroy a record that is less than 7 years old "only if both of the following are satisfied": written notice to the patient offering a copy, and the patient's response or authorization (MCL 333.16213).
HIPAA: safeguards apply "including through disposal" (HHS). Use a shredding or media-destruction vendor that signs a business associate agreement. Business, tax and payroll records follow different periods, covered in business records after closing.

Why some practices keep de-identified data after the retention period

Destroying the identifiable chart on schedule does not require destroying every use of it. Information de-identified under HIPAA is outside the Privacy Rule: "The requirements of this subpart do not apply to information that has" been de-identified (45 CFR 164.502). Some practices therefore make a de-identified copy before destruction, for research, quality work or a licence. The method is in the de-identification guide.

De-identified patient records do get licensed. Tempus AI reported in its SEC filing for the quarter ended 30 September 2026 that a licensee will pay data license fees of $100 per delivered record, up to $50 million, for 500,000 de-identified records of patients with Alzheimer's disease or other specified neurological conditions (Tempus 10-Q). That deal is between large companies, not a single practice.

Most small practices will not qualify on volume alone. The one priced deal above covers 500,000 records, far more than a solo office holds, and Origin has found no published sale by a single small practice. A specialty, a long history or imaging linked to signed reports can still make a set worth a look (what makes patient records licensable), which is why a check before records go to storage is worth a few minutes.

What buyers ask for, and the size thresholds they publish, are in licensing patient records.

Next step

Closing or retiring? The medical records custodian guide covers who keeps the records for these periods, and the closing checklist covers the order of steps.

Does your company hold records like these? See what your data is worth.

Common questions

Does HIPAA say how long medical records must be kept?

No. HHS says the HIPAA Privacy Rule does not include medical record retention requirements; state laws generally govern. HIPAA does require its own documentation, such as privacy policies and records of required actions, to be kept six years from creation or the date last in effect, and its safeguards apply until records are disposed of.

How long does a doctor have to keep medical records in Texas?

The Texas Medical Board rule requires at least seven years from the date of last treatment by the physician. For a patient under 18, records are kept until the patient turns 21 or for seven years from last treatment, whichever is longer. A longer federal or state rule overrides both periods.

How long do dentists have to keep patient records and x-rays?

It depends on the state dental board. In the states we read it runs from four years (Florida) to ten (North Carolina and Wisconsin), with Texas at five, Iowa and Virginia at six, and Massachusetts, Mississippi and New Jersey at seven. New Jersey and Massachusetts include radiographs in the same period.

How long must a medical practice keep records for Medicare patients?

CMS says providers who order, certify, refer or prescribe Medicare Part A or B services must keep the records seven years from the date of service. Medicare Advantage plans keep records 10 years and must make contracted providers agree to HHS audits, so plan contracts can stretch the period further. State law may also be longer.

How long should a closing medical practice keep records of patients who were children?

Longer than for adults in most states. Texas physicians keep them until age 21 or seven years, Maryland until age 25 or seven years, New York until one year after age 21 and at least six years. Where no rule applies, The Doctors Company recommends 28 years from the date of birth.

What is the correct way to destroy old patient medical records?

Destroy them on a schedule by a method that makes them unreadable, such as shredding or burning, and keep a log of the time, date and circumstances, as Tennessee requires. Never destroy records under dispute. Use a destruction vendor that signs a HIPAA business associate agreement, because HIPAA safeguards apply through disposal.

Can a practice keep a de-identified copy of patient records after the retention period ends?

Yes, information properly de-identified under HIPAA is outside the Privacy Rule, so a de-identified copy can be kept for research, quality work or a licence. It must meet HIPAA's Safe Harbor or Expert Determination standard. State law and contracts can add limits, so check them before making the copy.

How long do hospitals have to keep medical records?

At least 5 years under the federal rule for hospitals in Medicare, which says medical records "must be retained in their original or legally reproduced form for a period of at least 5 years" (42 CFR 482.24). State hospital licensing rules can set their own periods, so check those as well.

How long are medical records kept after a patient dies?

HIPAA itself sets no retention period, and HHS says "State laws generally govern how long medical records are to be retained", so the state or program rule decides. HIPAA keeps protecting a deceased person's health information for 50 years after death, because its definition of protected health information excludes information about a person "deceased for more than 50 years."

Sources and further reading

Origin Data Partners is an independent data partner. We work with buyers, and a buyer may pay us when a deal closes.