Reference › Medical record retention

Medical record retention laws by state

By Ahmed Jemaa · Reviewed 2026-09-09

How long a medical record must be kept is set by state law, and it varies by who held the record. Hospitals sit under a health department licensure rule, physician practices under a separate medical board rule, and Medicare participating providers under a federal floor beneath both. The periods rarely match, even inside one state.

What the primary sources actually say

One row per jurisdiction we have read from the primary text. A state appears here only once someone has opened the statute or administrative code and quoted the operative sentence on its page. States still being worked through are absent rather than guessed at.

Why this table is shorter than the ones that outrank it

Every widely circulated version of this chart gives you 50 rows. We checked a sample of those rows against the primary text and found errors serious enough that we will not republish any of them.

• ›New York. A chart ranking on the first page of Google gives a ten year hospital period. The rule, 10 NYCRR section 405.10(a)(4), says at least six years from discharge. The same page then contradicts its own figure one sentence later.
• ›Texas. Several charts cite 22 Texas Administrative Code section 165.1. That rule number no longer exists. Medical record retention moved to section 163.2, adopted in its current form in January 2025.
• ›Texas, again. One vendor page publishes a six year physician period. The rule says seven.

These are not edge cases, they are the largest legal markets in the country. The charts appear to be copied from each other and from a compilation whose own footer dates it to July 2022. So this page grows a row at a time, from the source, and says plainly which rows are not done yet.

Which rule applies to the record you want

The period turns on who held the record, not on what the record says. A hospital chart, a private practice chart and a nursing facility chart can sit under three different rules in the same state, with three different clocks.

• ›Hospital or licensed facility: the state hospital licensure regulation, usually written by the health department.
• ›Physician practice: the medical board rule, which is a separate chapter and often a different number of years.
• ›Anything billed to Medicare: the federal condition of participation applies as a floor underneath the state rule.
• ›Where a state publishes no rule for a setting, providers generally default to the longest applicable period they can identify. That is a practice, not a legal requirement, so do not assume the record exists.

The federal layer sits on top of this

State law sets how long the record itself must be kept. Federal rules add separate duties that people routinely confuse with it, and none of them replace the state period. The longer duty always governs.

The one that causes the most trouble is the HIPAA six year rule. It applies to a covered entity's own compliance documentation, such as policies, notices and signed authorizations. It does not set a retention period for the medical record.

Retention is not the same as your filing deadline

A retention period tells a provider how long to keep a chart. It does not tell you how long you have to bring a claim, and the two rarely match. A state can require seven years of retention while its limitation period for a minor runs years longer, which is how records get destroyed on schedule while a claim is still live. If a matter is reasonably anticipated, a litigation hold overrides the routine destruction schedule regardless of what the retention rule permits.