Your Medical Records Have an Expiration Date: A 50-State Investigation Into When Hospitals Can Legally Destroy Them

The Short Version

Nothing in federal law says how long your doctor has to keep your medical records. Not HIPAA, not anything else. The only federal floor is a Medicare rule that tells hospitals to hold a chart for five years. After that, state law takes over, and state law is a patchwork that most patients have never seen.

So we went and read it. All 50 states plus the District of Columbia, hospital rules and physician rules, retention periods and copy-fee schedules, checked against the current statute wherever we could reach it. The full table is below. Four findings stood out:

• In 15 jurisdictions, five years is the whole story. Seven states set the hospital minimum at exactly five years. Eight more have no hospital-specific state rule at all, which leaves only the federal five-year floor.
• Nineteen states have no mandatory minimum for physician offices. Where a rule exists, the shortest is three years, in West Virginia and the District of Columbia.
• Washington is now the national outlier at 26 years, after a 2025 change that almost nobody noticed. Massachusetts is next at 20. Every other state is at 11 or less.
• Getting a copy before the clock runs out costs anywhere from $0 to $131 for a 100-page paper record, depending on where you live.

If you have ever assumed your medical history is sitting safely in a hospital basement somewhere, waiting for the day you need it, this is the article that should change your mind.

There Is No Federal Expiration Date (Which Is the Problem)

Most people assume HIPAA covers this. It does not. HIPAA’s one retention rule, 45 CFR 164.530(j), requires a provider to keep its privacy policies and paperwork for six years. The regulation never mentions your chart. HIPAA’s access rule, 45 CFR 164.524, gives you the right to a copy of your record “for as long as the protected health information is maintained.” Read that again. Your right to the record lasts exactly as long as the provider chooses to keep it.

The closest thing to a national floor is Medicare. Hospitals that bill Medicare, which is nearly all of them, must follow the Conditions of Participation, and 42 CFR 482.24(b)(1) says: “Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.” Five years. That is the entire federal commitment to the paper trail of your body.

Everything above five years is a state decision, and it turns out the states decided very differently.

1. Federal privacy law

   HIPAA

   No rule

   Sets a six-year retention period for privacy policies and paperwork. Says nothing about how long your chart must exist.

   45 CFR 164.530(j)

2. Medicare Conditions of Participation

   Medicare

   5 years

   Hospitals that bill Medicare must keep records at least five years. Applies to hospitals only, not physician offices.

   42 CFR 482.24(b)(1)

3. Your state

   State law

   0 to 26 years

   Fifteen jurisdictions stop at the federal floor. Washington requires 26 years. Nineteen states set nothing for doctors.

   51 statutes, checked Oct 2026

The 50-State Table

How to read it: Hospital minimum is the shortest period a licensed hospital in that state must keep an adult patient’s record before it may destroy it. Doctor minimum is the same for a physician office or licensee. Max charge is the highest amount the state’s fee schedule allows a provider to bill you for a 100-page paper copy of your own record, excluding postage. “Cost-based only” means the state has no fixed schedule and defers to HIPAA’s reasonable, cost-based standard. “None found” means we could not locate a binding state rule after checking the statute, the licensing regulations, and the medical board; it does not mean a hospital will destroy your file next week, only that the law does not stop it after the federal five years.

Minors are usually protected longer (commonly until a few years past age 18), and most states let a provider keep records longer than the minimum. Nothing requires them to.

• 15 of 51 stop at the federal five-year floor for hospitals
• 19 of 51 have no binding minimum for physician offices
• $0 to $131.00 legal maximum for a 100-page paper copy of your own record

Filter by state

51 jurisdictions. Click a column heading to sort.

State	Hospital min. years	Doctor min. years	Max charge 100-page paper copy	Notes
ALAlabama	5	7	$67.50
AKAlaska	7	None found	Cost-based only	No doctor minimum found; fees cost-based
AZArizona	6	6	Cost-based only	Fees "reasonable" only, no schedule
ARArkansas	10	None found	$52.50	Fee tiers conflict between sources
CACalifornia	7	None found	$25.00	$0.25 per page copying only
COColorado	10	7	$78.23	Doctor figure is Medical Board policy, not statute
CTConnecticut	10	7	$65.00
DEDelaware	None foundfederal 5-yr floor	7	$86.00	No hospital-specific state rule found
DCDistrict of Columbia	10	3	$121.00	Fees adjusted for inflation each year
FLFlorida	None foundfederal 5-yr floor	5	$43.75	No private-hospital rule found; cost uses physician schedule
GAGeorgia	5	10	$111.68	Fees indexed annually
HIHawaii	7	7	Cost-based only	Basic record information kept 25 years
IDIdaho	None foundfederal 5-yr floor	None found	Cost-based only	Only lab and X-ray records have a set period
ILIllinois	10	None found	$117.18	Fees indexed annually
INIndiana	7	7	$52.50	$20 labor fee only if first 10 pages are free
IAIowa	None foundfederal 5-yr floor	7	Cost-based only	Hospital rule defers to statute of limitations
KSKansas	10	10	Cost-based only	Patient fee set by Board rules, not located
KYKentucky	6	None found	$0 first copy free	First copy free by statute; 6 years verified on official site
LALouisiana	10	6	$87.50
MEMaine	7	None found	$49.55
MDMaryland	None foundfederal 5-yr floor	7	$98.88	Statute (7) and regulation (5) conflict; no hospital rule found
MAMassachusetts	20	7	$124.69	Longest in the East at 20 years
MIMichigan	None foundfederal 5-yr floor	7	$72.00	No hospital-specific state rule found
MNMinnesota	7	None found	$50.00	Hospital may destroy only non-permanent parts after 7 years
MSMississippi	10	10	$100.00	Doctor rule phased in from 2026
MOMissouri	5	7	$100.32	State hospital rule rescinded 2019; federal 5-year floor applies
MTMontana	10	None found	$65.00	No doctor minimum found
NENebraska	7	None found	$70.00	General facility rule; sources conflict
NVNevada	5	5	$60.00	Minors kept to age 23
NHNew Hampshire	7	7	$40.09	Fee schedule updated 2025
NJNew Jersey	10	7	$110.00	Discharge summaries kept 20 years
NMNew Mexico	10	10	$51.25	Cost uses physician schedule; no hospital fee cap
NYNew York	6	6	$75.00	$0.75 per page, no base fee
NCNorth Carolina	11	None found	$56.25	Minors kept to age 30
NDNorth Dakota	10	7	$76.25
OHOhio	6	None found	$90.00	Electronic copies capped at $50
OKOklahoma	7	None found	$50.00	State statute says 7; health department rule says 5
OROregon	10	None found	$62.50	Doctor 10 years is guidance only
PAPennsylvania	7	7	Cost-based only	Patient fees follow HIPAA cost-based rule
RIRhode Island	5	7	$50.00	Fee structure unclear for patients
SCSouth Carolina	10	10	$109.36	Fees indexed annually; paper cap $278.16
SDSouth Dakota	10	None found	$39.70	Search fee waived for patients
TNTennessee	10	10	$72.50	Fee schedule rewritten 2024 and 2025
TXTexas	10	None found	Cost-based only	Physician rule repealed Jan 2025; hospital fees indexed, current table not published
UTUtah	7	None found	Cost-based only	Patient copies cost-based; $150 cap is electronic only
VTVermont	10	7	$50.00	Greater of $5 or $0.50 per page
VAVirginia	5	6	Cost-based only	Patient copies cost-based by statute
WAWashington	26	None found	$131.00	Raised from 10 to 26 years in 2025
WVWest Virginia	None foundfederal 5-yr floor	3	Cost-based only	Board can discipline below 3 years; recommends 10
WIWisconsin	5	5	$100.50	Fees indexed each July
WYWyoming	None foundfederal 5-yr floor	None found	Cost-based only	3-year statute repealed 2019; no state minimum

• Five years or less; $100 and up
• Ten years or more
• Twenty years or more
• No binding state rule or schedule found

"None found" is a negative finding after checking the statute, licensing regulations and medical board; it does not mean records are destroyed sooner, only that the federal floor is all that applies. Indexed-fee states change annually. Not legal advice.

The Five-Year States

Here is the list nobody publishes. In these 15 jurisdictions, a hospital that has held your chart for five years and one day is, as far as the law is concerned, free to shred it.

Explicit five-year minimums (7): Alabama, Georgia, Missouri, Nevada, Rhode Island, Virginia, Wisconsin. Missouri is a special case: it had a 10-year state rule until the health department rescinded it in 2019 and replaced it with a reference to the federal Medicare standard, which quietly cut the floor in half.

No hospital-specific state rule found (8): Delaware, Florida, Idaho, Iowa, Maryland, Michigan, West Virginia, Wyoming. Each of these regulates physicians, labs, nursing homes, or some other slice of the system, but we could not find a statute or regulation that tells a general hospital how long to keep an adult’s record. The federal five years is all that applies.

Wyoming is the one that surprised us most. Older compliance tables, including ones still being republished in 2026, list Wyoming at three years, the shortest in the country. That statute was repealed in 2019. Nothing replaced it. Wyoming did not go from three years to something better; it went from three years to no state rule at all.

To put five years in perspective: a routine colonoscopy is every ten. A mammogram baseline is compared against prior images for decades. A childhood allergy, a reaction to an anesthetic, a surgical implant with a serial number, a lab value that was borderline in 2019 and matters in 2031. Five years is shorter than the useful life of almost every clinically important fact about you.

Doctor Offices: Even Less Protection

Hospitals at least have licensing regulators. Physician offices are governed by state medical boards, and the boards are far less consistent. We found a binding retention minimum for physician offices in 31 states and DC. In the other 19, there is either nothing, or a non-binding “guideline” that a board publishes and admits is not enforceable:

Alaska, Arkansas, California, Idaho, Illinois, Kentucky, Maine, Minnesota, Montana, Nebraska, North Carolina, Ohio, Oklahoma, Oregon, South Dakota, Texas, Utah, Washington, Wyoming.

Hospitals

Minimum years before an adult's record may be destroyed

• 5 or no state rule 15
• 6 to 7 15
• 10 to 11 19
• 20 or more 2

Physician offices

Same question, for the doctor who knows you best

• No binding minimum found 19
• 3 years 2
• 5 to 7 24
• 10 6

Adult records. Washington's 26-year hospital rule is the longest in the country; its physician guideline is advisory only. DC counted as a jurisdiction.

Texas belongs on that list for an uncomfortable reason. The Texas Medical Board’s retention rule, which set seven years, was repealed effective January 9, 2025 as part of a rule chapter cleanup, and we could not locate a replacement. The second most populous state in the country currently has no physician retention rule we can point to.

Where a minimum does exist, the shortest is three years. West Virginia’s Board of Medicine recommends ten years but says its enforceable rule only lets it discipline a physician who keeps records “for at least three years after the last date of treatment.” The District of Columbia’s physician standard is also three years. Your primary care doctor, the person with the most complete longitudinal picture of your health, is in many states under less obligation to keep it than your dentist is to keep your X-rays.

The Other Direction: Washington Just Went to 26 Years

Not every state is racing to the bottom. In 2025, Washington amended RCW 70.41.190 to require hospitals to “retain and preserve all medical records for a minimum period of 26 years from the date the record was created.” The previous rule was ten years from discharge. The change took effect July 27, 2025, applies to every record a hospital still held on that date, and as far as we can tell received almost no press coverage.

Twenty-six years is not an arbitrary number. It is long enough that a record created at birth survives into a patient’s late twenties, which is roughly when adult health problems start to reveal their childhood origins. Massachusetts has required 20 years for decades. North Carolina requires 11, and keeps a minor’s record until age 30.

Everyone else is at 10 or less. Eighteen jurisdictions sit at exactly ten years, which is the number most people guess when asked, and which is wrong for 33 states.

Why This Matters More Than It Did Ten Years Ago

A five-year retention rule was a tolerable risk when most people saw one family doctor and one hospital for most of their life. That is not how care works anymore.

• 59% of Americans with online access hold records in more than one patient portal ONC, HINTS 2024
• 4 different providers the typical Medicare patient sees in a year; one in four sees six or more Kern et al., Medical Care 2024
• 154 rural hospitals closed or converted since 2010, each with a records department that closed with it UNC Sheps Center
• 51% of portal users now manage records on behalf of someone else, up from 24% in 2020 ONC, HINTS 2024

Your records are spread across more places. The 2024 federal HINTS survey, analyzed by the federal Office of the National Coordinator for Health IT (ASTP/ONC), found that 59% of Americans with online access now have records in multiple patient portals, up from 50% two years earlier. Only 7% use an app to combine them. Each of those portals belongs to a different organization, in a different state’s jurisdiction, running a different retention clock.

Older patients are the most fragmented. A 2024 study in Medical Care tracking 13,680 Medicare beneficiaries found the typical 65-plus patient sees four different providers a year, and 26% have what the authors call highly fragmented care, spread across six or more. Those patients cost Medicare $1,085 more per year. Every one of those providers holds a piece of the record, and in most states none of them is required to hold it past a decade.

Hospitals are closing. The UNC Sheps Center counts 154 rural hospitals that have closed or converted to a non-inpatient facility since 2010. When a hospital closes, its records department closes with it. State rules typically require closing facilities to arrange custody of records, but patients are rarely notified where the records went, and a custodian is under no obligation to keep them past the original retention period.

Half of us are now managing someone else’s records. The same ONC brief found 51% of portal users accessed records on behalf of someone they care for, up from 24% in 2020. Caregivers inherit the retention problem twice over: once for themselves, once for a parent whose records span four decades and six states.

The Errors You Will Never Catch

There is a second cost to records disappearing, beyond the obvious one. You cannot fix a mistake in a chart you no longer have.

When Harvard researchers surveyed 22,889 patients who had read their own visit notes, 21% reported finding a mistake, and 42% of those described it as serious. The most common serious errors were wrong diagnoses, inaccurate medical histories, and medication mistakes, which are exactly the things that follow you from provider to provider. A 2023 Johns Hopkins analysis estimated that diagnostic errors kill or permanently disable roughly 795,000 Americans a year. Many of those are errors of missing information: the allergy that was documented at a hospital you no longer have access to, the prior scan nobody could find.

And getting access in the first place is not guaranteed. Since the federal information-blocking rules took effect in 2021, patients and others have filed more than 2,400 complaints with HHS alleging that a provider or vendor improperly withheld health information. The right to your record exists on paper. Exercising it is another matter.

What a Copy of Your Own History Costs

Which brings us to the fee column. HIPAA says a provider may charge you only a reasonable, cost-based fee covering labor, supplies, and postage. Most states also publish a maximum schedule, and those maximums are what the table shows.

$100 and up 10

1. Washington $131.00
2. Massachusetts $124.69
3. District of Columbia $121.00
4. Illinois $117.18
5. Georgia $111.68
6. New Jersey $110.00
7. South Carolina $109.36
8. Wisconsin $100.50
9. Missouri $100.32
10. Mississippi $100.00

$50 to $99 23

1. Maryland $98.88
2. Ohio $90.00
3. Louisiana $87.50
4. Delaware $86.00
5. Colorado $78.23
6. North Dakota $76.25
7. New York $75.00
8. Tennessee $72.50
9. Michigan $72.00
10. Nebraska $70.00
11. Alabama $67.50
12. Connecticut $65.00
13. Montana $65.00
14. Oregon $62.50
15. Nevada $60.00
16. North Carolina $56.25
17. Arkansas $52.50
18. Indiana $52.50
19. New Mexico $51.25
20. Minnesota $50.00
21. Oklahoma $50.00
22. Rhode Island $50.00
23. Vermont $50.00

Under $50 6

1. Maine $49.55
2. Florida $43.75
3. New Hampshire $40.09
4. South Dakota $39.70
5. California $25.00
6. Kentucky $0

No schedule 12

HIPAA's cost-based rule only. The provider sets the fee; you can challenge it.

• Alaska
• Arizona
• Hawaii
• Idaho
• Iowa
• Kansas
• Pennsylvania
• Texas
• Utah
• Virginia
• West Virginia
• Wyoming

Kentucky's first copy is free by statute; a second copy may be charged at up to $1 per page. States marked as indexed in the table adjust these figures each year.

The spread is wide. Kentucky gives you the first copy of your record free by statute. California caps copying at $0.25 a page, so 100 pages is $25. At the top, Washington ($131), Massachusetts ($124.69), DC ($121), Illinois ($117.18), Georgia ($111.68), and New Jersey ($110) all allow a provider to charge more than $100 for the same stack of paper, usually through a “search and retrieval” base fee layered on top of per-page charges. Ten jurisdictions in total can charge $100 or more. The median, among the 39 jurisdictions with a published schedule, is $70.

Twelve states have no schedule at all and rely purely on the HIPAA cost-based rule, which in practice means the fee is whatever the provider decides it costs them, until you challenge it. Several states (Georgia, Illinois, Michigan, Missouri, Ohio, South Carolina, Wisconsin, DC, Washington) index their fees to inflation every year, so the number in the table will be higher by the time you read it.

The practical lesson: ask for an electronic copy. Under HHS guidance, a provider can deliver records it already holds electronically for a flat $6.50, and several states (Ohio, Minnesota, Utah, West Virginia) cap electronic copies far below the paper rate. Paper is the expensive option by design.

What to Do Before the Clock Runs Out

None of this is a reason to panic. It is a reason to stop treating the hospital as your filing cabinet. A few habits close the gap almost entirely:

1. Request your complete record after every hospital stay and every surgery, not years later when you need it. The 30-day response deadline in HIPAA starts when the provider receives the request, and the request is free to make. Our guide on how to request your medical records walks through the exact wording. Large health systems publish their own request routes; our hospital guides list them for Cleveland Clinic medical records, Cedars-Sinai medical records and Houston Methodist medical records, among others.
2. Ask for electronic, not paper. It is cheaper, faster, and easier to keep. A PDF of a discharge summary is just as legally valid as the printout.
3. Collect from every provider, not just the big one. The dermatologist, the urgent care, the imaging center, the lab. These are the places with the thinnest retention rules and the highest closure rates.
4. Keep the copies somewhere you control. A patient portal is not a copy; it is a window into the hospital’s copy, and it closes when the hospital decides. The same goes for an insurer’s portal when you change plans. We built KeepMD because we kept hitting this exact wall: the records should live on your own device, organized by person, searchable, and exportable in standard formats, so that your family’s history survives whatever happens to the institutions that created it.
5. Do it for your parents and your kids. Minors’ records are generally protected until a few years past 18, then they hit the same adult clock. A parent’s records are spread across the most providers and the most decades of anyone in your family. If you are among the 51% already managing someone else’s portal, you are the right person to pull the copies.
6. Check for errors while you still can. One in five patients who reads their notes finds a mistake. Read yours now, while the provider still has the record and can correct it. KeepMD’s reminder and tagging features exist for exactly this kind of recurring review, but a calendar entry works too.

How We Built This

Between October 10 and 12, 2026, we checked the hospital licensing regulations, physician licensing regulations, medical board rules, and patient copy-fee statutes for all 50 states and the District of Columbia. Wherever possible we read the current text on the official state legislature or code site. Where the official site was unreachable, we used a reproduction on Justia, Cornell LII, or the state’s own agency notice, and recorded which. Starting hypotheses came from older compliance tables published by ChartRequest, AccountableHQ, HealthInfoLaw, and an ONC appendix; a large share of those values turned out to be outdated, superseded, or wrong, which is partly why this article exists.

Cost figures use the state’s statutory maximum for a patient’s own 100-page paper copy, including any base or retrieval fee the state allows to be charged to the patient, and excluding postage, certification, and media such as X-ray film. Where a state has separate hospital and physician schedules, the table notes which was used. Figures for states that index fees to inflation are the most recent published values and will change.

“None found” is a negative finding and should be read carefully. It means that after checking the sources above we could not locate a binding minimum for that provider type in that state. A rule may exist in a place we did not look, and several states have “longer of” provisions, litigation holds, and minor-patient rules that extend the period in specific cases. This is a journalistic survey, not legal advice. If you need a definitive answer for a specific situation, ask the provider’s records department or a health-law attorney, and tell us if you find something we missed. We will update the table.

Related reading: Understanding your medical records rights, What is HIPAA? A patient’s guide, and Why on-device storage matters for health data.