Short answer: in the US, there is no single national rule. HIPAA — the federal privacy law everyone assumes covers this — requires providers to keep their compliance paperwork for six years, but says nothing about how long your actual medical records must survive. That number comes from your state, and it's commonly 5 to 10 years for adults after the last visit or discharge, with records of minors kept longer, often until a few years past the patient's 18th birthday. On top of that, any hospital that takes Medicare must keep records for at least 5 years under federal Conditions of Participation.

So a hospital in one state may be legally free to shred your chart after five years while a hospital across the border has to keep it for ten. Here's how the pieces fit, how to get your records while they still exist, and why the copy that really matters is the one on your own phone.

One caveat up front: this page describes what's generally true in the US. It isn't legal advice, and retention rules change — your state health department or medical board has the current wording.

What HIPAA actually requires (less than you'd think)

People search "HIPAA medical records retention" and find the number six. It's real, but it's about the wrong documents. HIPAA's administrative rules (45 CFR 164.530) require a covered provider to keep its privacy policies, notices, authorizations, and similar documentation for six years from the date they were created or last in effect. That's the paperwork proving the hospital followed the rules — not your lab results.

For the records themselves, HIPAA defers to state law. It does give you something arguably more useful: a federal right of access. Under 45 CFR 164.524, you're entitled to see and get a copy of your own records, within a fixed deadline, for a limited fee, in electronic form if you ask. More on that below.

Two federal rules do touch retention directly:

  • Medicare hospitals. 42 CFR 482.24 requires any hospital participating in Medicare — which is nearly all of them — to retain medical records "in their original or legally reproduced form" for at least five years. States can require more, and many do.
  • Medicare billing. Providers generally keep the documentation behind Medicare claims for several years for audit purposes. That affects the billing file more than the clinical chart.

Everything beyond that is state territory.

Who keeps what, and for how long: the usual pattern

Rather than a fifty-state list that would be wrong somewhere by next spring, here's the shape of the rules you'll find almost everywhere, and where the real number lives. Check your own state before relying on any row.

Who holds the record Typical US rule Where the actual number is
Hospitals 5–10 years after discharge or last visit; a handful of states require 20+ State hospital licensing rules (health department), plus the federal 5-year Medicare floor
Doctors' offices and clinics 5–10 years after last treatment State medical board or medical practice act
Records of minors Until a few years past the age of majority, often "age 18 plus the adult period" or until 21–25 Same sources as above; look for a separate "minor patient" clause
Mental-health and substance-use records Often the same as general records, sometimes longer; extra federal confidentiality rules apply to substance-use treatment State licensing rules for the facility type
Imaging (X-rays, MRIs, mammograms) Images and reports often have their own clock, frequently 5–10 years; federal mammography rules require the mammogram itself be kept at least 5 years State radiology rules; the FDA's mammography quality standards for mammograms
Deceased patients Some states set a separate, usually shorter, period after death; others apply the normal adult rule State rules, usually in the same retention section
Pharmacies Prescription records for a fixed period, often shorter than hospital records State board of pharmacy

For a concrete example of what one state's rule looks like: New York's Rules of the Board of Regents (Part 29, which governs licensed professionals) require that patient records be kept for at least six years, and that records of minors be kept for at least six years and until one year after the patient turns 21. Your state's rule will read differently, but it will have the same two parts — a base period for adults and a longer one for kids.

The practical lesson: the clock on a minor's records is long, the clock on an adult's records is shorter than most people assume, and once it runs out the provider can legally destroy the file. "They'll have it" is a bet, not a plan.

What happens when a practice closes or a doctor retires

This is where records actually get lost, far more than through shredding schedules. When a physician retires, sells the practice, or dies, the records don't vanish on day one — most states require the practice to notify patients (a letter, a newspaper notice, or a posting) and either transfer the records to another provider or hand them to a custodian service that stores them for the remaining retention period.

In practice, that means:

  • If you get a letter saying your doctor is closing, request your records right then. It is never easier than in the last weeks the office is open.
  • If the practice already closed, ask the state medical board who the custodian of records is. Boards commonly keep a list, or can tell you which practice absorbed the patients.
  • If a hospital closed or merged, the successor system usually inherited the records. Call the health information management (HIM) department of whoever bought it.
  • For a large health system, the records are almost certainly electronic and searchable by name and date of birth, which makes recovery easier — but the retention clock still runs.

How to request your medical records

HIPAA's right of access is the tool. It applies to hospitals, doctors, labs, pharmacies, and health plans. Here's how it works in practice.

1. Put it in writing. Providers may require a written request, and most have a form — usually called an "authorization for release of information" or simply a medical records release form. Ask the HIM or medical records department for it, or find it on the hospital's website under "patients" or "medical records." Many health systems now let you request through the patient portal, which counts as written.

2. Say exactly what you want. "All records" can mean thousands of pages and a big bill. Be specific: discharge summaries, operative reports, lab results, imaging reports, pathology, immunizations, medication lists, and the date range. Ask for electronic copies — HIPAA says that if the provider keeps records electronically and you ask for an electronic copy, they must give you one in the format you request if they can readily produce it.

3. Know the clock. The provider must act on your request within 30 days. They can take one 30-day extension, but only if they tell you in writing why and when you'll get the records. Some states require faster turnaround, and the shorter deadline wins.

4. Know the fee rules. For copies you request for yourself, the fee must be "reasonable and cost-based": labor for copying, supplies, postage. They can't charge you for searching, retrieving, or reviewing the file. Many states also cap per-page fees, and many providers charge nothing for portal downloads. Records sent directly to another doctor for your continued treatment are often free. If a bill looks wild, ask them to show how it's cost-based.

5. Keep a copy of the request. Note the date you sent it. If the deadline passes with no answer, a polite follow-up citing "the HIPAA right of access under 45 CFR 164.524" usually unsticks things. Beyond that, complaints go to the HHS Office for Civil Rights.

The release form: what's on it, and the two kinds of release

A medical records release form (authorization) typically asks for:

  • Your name, date of birth, and contact details
  • Which provider or facility the records come from
  • What records, over what dates
  • Who the records go to — you, another doctor, a lawyer, an insurer
  • Whether sensitive categories are included (mental-health notes, HIV status, substance-use treatment), which usually require a separate checkbox or signature because of extra protections
  • An expiration date for the authorization, and your signature

There's an important difference between two things the same form can do:

  • A release to you. This is your right of access. The provider has to honor it, within the deadline, for a limited fee, and can refuse only in narrow cases (for example, psychotherapy notes or information that would endanger someone).
  • A release to a third party. When you authorize records to go to a lawyer, an insurer, or an employer, you're granting permission, not exercising a right. The deadline and fee limits are looser, and the third party's own handling of your records is their business, not HIPAA's.

The tidy trick: when someone else needs your records, get them sent to you first, then forward what's relevant. You keep a copy, you control what goes out, and you never depend on the hospital's clock again.

How long you should keep your own copies

Flip the question around. The hospital's retention period protects the hospital. Yours protects you, and it's longer.

In the US, generally: bills and explanation-of-benefits (EOB) statements are financial paperwork — keep them until everything is paid and any dispute is closed, about a year, or seven years if you deducted medical costs on your taxes. Your medical history — diagnoses, surgeries, pathology, allergies, medication history, vaccination records — is worth keeping for life. The full retention chart is in what documents to keep and for how long; the medical section there covers bills and history in detail.

The reason to keep your own copy is exactly the reason this page exists. A surgery at 30 is still relevant at 55, long after any hospital's retention period has expired. A childhood vaccination record matters for a job at 40. A pathology report from a decade ago is the one document a specialist will ask for and the one nobody can recreate. The provider's copy is on a timer; yours isn't.

Keeping copies doesn't mean keeping paper. Medical records are almost always accepted as copies, so a clear scan is the record.

Build a medical file on your phone that you can actually search

The failure mode isn't losing records — it's having them somewhere you can't find when a new doctor asks. The manual version, using what's already on an iPhone:

  1. Download from patient portals now, not later. Most hospital portals let you export visit summaries and results as PDFs. Do it after every significant visit; portals get shut down when systems merge.
  2. Scan the paper. Notes → camera icon → Scan Documents handles discharge papers, vaccination cards, and mailed results.
  3. One folder, dated names. A "Medical" folder in Files; name files "2026-03 Mercy Hospital discharge summary," date first. No subfolders — you'll disagree with yourself about them later.
  4. Keep the five that matter: discharge summaries and visit notes, test and imaging results, EOBs, vaccination records, and a running medication list. Organizing medical records walks through each one and what to let go.
  5. Lock it. Medical paper in the camera roll shows up when you hand someone your phone. Use a locked note or keep the folder out of anything that auto-shares.

That works, and it costs nothing. Its weak point is the fourth year, when the folder has 80 files and you're in an exam room trying to remember whether the tetanus shot was 2019 or 2021.

That's the part Paperlock is built for. Save a discharge summary, an EOB, or a vaccination card once and it reads the document — what it is, which hospital or insurer, the dates, the amounts — and files it with a clear title, no naming or folders on your part. Later you ask, in plain words: "when was my last tetanus shot?" or "what did the 2023 MRI report say?" and get the answer with the document attached; if it isn't in your vault, it tells you so instead of guessing. The whole vault sits behind Face ID, stored encrypted on the phone, and medical documents specifically show blurred thumbnails until you confirm with Face ID again, so a glance over your shoulder sees nothing. That's how it works, and it's on the App Store.

Two documents are worth a special word. EOBs are how you catch billing mistakes, and they're only useful if you can match them to the bill — the medical bills and EOBs page shows how. And vaccination records are the one medical document you'll be asked to produce on demand for schools, jobs, and some travel, which is why storing vaccination records on your iPhone gets its own guide.

If you need old records, do this today

  • Figure out the clock. Count years from your last visit, not from today. Minors' records live longer; adult records may already be gone past a decade.
  • Ask anyway. Retention periods are minimums. Many facilities keep electronic records far longer, and it costs one phone call to find out.
  • Request everything you might want, in electronic form, sent to you. Thirty days, a cost-based fee at most, one possible extension.
  • Save the copies somewhere locked and searchable, and make it a habit after every hospital stay and every new test result.

The hospital's obligation to remember your history ends on a date set by a regulation you've never read. Yours doesn't have to.