Medical Record Retention Laws by State: 2026 Guide
Head of Customer Success at LlamaLab
Medical Record Retention Laws by State: The 2026 Guide for Injury Attorneys
Key Points
Essential takeaways from this article
A provider that destroys a patient's chart one day before a firm requests it has not committed a crime in most states. If the statutory retention period has run, the provider was allowed to shred it. The claim depending on that chart does not get a second chance.
Retention law is scattered across state health departments, medical boards, and administrative codes, and most 50-state summaries in circulation quote only one of two rules that actually apply. This guide pulls every state's hospital and physician retention period into a single reference, flags the states where the rule is genuinely unsettled, and explains why records should be requested well before a firm assumes it has time.
The HIPAA Retention Myth
Why This Matters for Injury Litigation
Retention statutes set a floor, not a promise. Once the statutory period expires, a provider may destroy the record at its own discretion, and most states impose no notice requirement before doing so. For a firm building a personal injury or mass tort case, that creates a hard deadline that has nothing to do with the statute of limitations for filing suit.
A claimant injured five years ago in a state with a 5-year physician retention period may already be past the window. A firm that waits to request treatment records until after the case is filed can find that the single provider who documented an early diagnosis destroyed the chart months earlier, in full compliance with the law.
Retention Deadline vs. Filing Deadline
| Statute of Limitations | Medical Record Retention Period | |
|---|---|---|
| What it controls | How long a plaintiff has to file suit | How long a provider must keep the chart on file |
| Who it protects | The claimant's right to sue | Nothing. It only protects the provider from a records-destruction claim |
| What happens if you miss it | The claim is barred | The record may already be gone, even though the claim is still timely |
| Typical trigger | Injury date or discovery date | Last treatment date, discharge date, or record creation date |
All 50 States + DC: Retention Periods by Provider Type
Most states run two separate rules: a hospital-licensing period written by the state health department, and a physician-records period written by the state medical board. Where a state source specifies both, the table below states each explicitly. Where only one figure has a confirmed source, that figure is shown alone. Rows marked "not specified" reflect states where no confirmed statute sets a distinct rule for that category, not a confirmed absence of any rule.
| State | Adult / Physician Retention | Minor Retention | Key Statute |
|---|---|---|---|
| Alabama | 5-7 years | 5 yrs after age 19 | Ala. Admin. Code r. 540-X-9-.10 |
| Alaska | 7 years | 2 yrs after age 19 or 7 yrs, whichever is longer | Alaska Stat. § 18.20.085 |
| Arizona | 6 years | 3 yrs after age 18 or 6 yrs, whichever is later | A.R.S. § 12-2297 |
| Arkansas | 10 years | 10 yrs or 2 yrs after age 18, whichever is longer | Ark. Code R. 007.05.17 |
| California | 7 years | 1 yr after age 18 (minimum 7 yrs) | Cal. HSC § 123145 |
| Colorado | 10 yrs (hospitals); no physician mandate, board policy recommends 7 yrs | Until age 28 (hospitals) | 6 CCR 1011-1, ch. 4; Med. Board Policy 40-7 |
| Connecticut | 7 yrs (physicians); 10 yrs (hospitals) | Same as adult | Conn. Agencies Regs. § 19a-14-42 |
| Delaware | 7 years (physicians) | Not specified | Del. Code tit. 24, § 1761 |
| District of Columbia | 5 years | 5 yrs after majority | D.C. Code § 3-1210.11 |
| Florida | 5 years (federal Medicare floor; state statute sets no retention period) | Same as adult | 42 CFR § 482.24 |
Unlock the Full 50-State Retention Guide
Get hospital and physician retention periods, minor-patient rules, and statute citations for every U.S. jurisdiction. Free and instant.
+41 more states waiting for you
No payment required. Instant access.
Methodology and Confidence Notes
Hospital vs. Physician: Why One Number Is Rarely Enough
A single "years to keep records" figure per state usually reflects only one of two rules. Reading only the physician-board rule when the records at issue came from a hospital, or vice versa, is the most common way a retention summary goes wrong.
For a claimant who saw both a hospital emergency department and a treating physician for the same injury, the two charts may legally be destroyed on two different dates. A firm auditing a stale file should request both categories of records rather than assuming one clock covers the entire treatment history.
Minors: The Longest Retention Windows
Because a minor's statute of limitations for a malpractice or injury claim often does not begin running until age 18, most states extend medical record retention well past a child's treatment date.
North Carolina requires hospitals to retain a minor's record until the patient turns 30, the longest age-based rule of any state
Colorado's hospital retention requirement for minors, the second-longest fixed age threshold
The range where most states set their minor retention endpoint
New York illustrates why a single number per state can mislead even within one jurisdiction. A physician's office may close a minor's chart 6 years after the last visit or 1 year after the patient turns 18, whichever is later. A hospital must hold the same record until 6 years have run from discharge or the patient has been 18 for 3 years, whichever is later. Most other licensed health professions in the state run a third clock entirely, extending to age 22. Three different endpoints, one state, one child's medical history.
What Happens When a Record Is Destroyed on Schedule
Destruction that happens after the statutory period expires is lawful. It is also frequently irreversible for the case that needed the record.
Retention period runs
The statutory clock (from last treatment, discharge, or record creation, depending on the state) reaches its end date while the case is still being developed
Provider destroys the record
Most states impose no notice requirement before destruction once the period expires; a small number, including Mississippi, require advance notice to patients
Firm requests the record
The request returns a 'no records found' response instead of the chart documenting an early diagnosis, prior condition, or treatment timeline
Case proceeds without the evidence
Absent a spoliation claim (which requires proof the provider had a duty to preserve, such as a litigation hold or subpoena already in effect), the gap in the record becomes the defense's argument
A spoliation claim against the provider is not a substitute for the record itself. It requires proving the provider had an independent duty to preserve the file, typically because litigation was reasonably anticipated or a preservation letter had already been sent. Destruction that happens before a firm is retained, or before any request has gone out, rarely supports that claim.
Request early, not at the deadline
Practical Guidance for Multi-State Practices
Firms handling claims across multiple states face compounding complexity: different retention periods, different agencies, and different rules for hospitals versus physicians in every jurisdiction.
Traditional Approach vs LlamaLab Solution
Traditional Approach
Assuming One Rule Fits All
Applying a single 'HIPAA requires 7 years' assumption across every state and provider type
Discovering Gaps Mid-Case
Learning a provider destroyed records only after a request comes back empty
Manual Statute Tracking
Staff manually checking hospital-licensing rules against medical-board rules for every new jurisdiction
Hidden & Unpredictable Costs
Per-page fees, rush charges, and surprise bills that blow up your budget
LlamaLab Solution
Request Records Immediately
Records ordered at case intake, not at demand-letter stage, closing the window where destruction risk lives
Reverse Provider Search
Uses insurance data to surface every treating provider a claimant may not remember, before any of their retention clocks expire
4-Day Average Turnaround
Records come back in 4 days on average, with 30 to 40% returned same-day on electronic requests
Flat Transparent, Risk-free Pricing
1 flat fee covers all costs. Only pay full price for cases that authorize
The Bottom Line
Medical record retention is not a single federal rule. It is 51 separate sets of statutes and administrative codes, most of which split hospitals from physician offices and set a longer clock for minors. A firm that treats retention as background legal trivia risks losing records it never knew were on a countdown. A firm that requests records at intake, for every treating provider, removes that risk entirely.
Don't Wait for a Record to Disappear
LlamaLab retrieves records from every treating provider in 4 days on average, so retention deadlines never become case losses. Reverse provider search surfaces facilities clients forget to mention.
Sources: Recording Law: Medical Records Retention Laws by State (2026 Guide), Washington RCW 70.41.190, Wyoming SF0096, 2019 Wyo. Sess. Laws ch. 78, Massachusetts 243 CMR 2.07, West Virginia CSR 64-12-7, WV Board of Medicine retention guidance, Neb. Rev. Stat. 71-8403, S.D. Admin. R. 44:75:09:06, Miss. Admin. Code Pt. 2635, Ch. 10, HHS: Does HIPAA Require Covered Entities to Keep Medical Records?, 45 CFR 164.530(j), 42 CFR 482.24. Individual state statute citations are provided in the table above; verify current text before relying on any figure in a filing.
Stay Updated with Latest Insights
Get the latest articles about medical record retrieval and legal tech delivered to your inbox.
