How long must hospitals retain medical records?
The short answer
Federal Medicare conditions of participation require hospitals to keep medical records for at least 5 years (42 CFR 482.24(b)(1)). State hospital licensing rules are usually longer: most fall between 5 and 10 years after discharge or last treatment, and Massachusetts requires 20 years. Records of minors run until the age of majority plus roughly 1 to 7 years, depending on the state. Mammography records follow FDA MQSA. Always apply the longest of the state, federal and contractual requirements.
Key takeaways
What every reader should walk away with
Federal baseline: at least 5 years under 42 CFR 482.24(b)(1)
State hospital rules in this guide range from 5 years (Georgia, Virginia) to 20 years (Massachusetts)
Texas and Illinois hospitals: 10 years; California and Pennsylvania: 7 years; New York: 6 years
Minors: age of majority plus roughly 1 to 7 years, depending on the state
Hospital licensing rules and physician-office rules are different; check the one that applies to the record holder
Mammography: at least 5 years, or 10 years if no further mammograms are performed (21 CFR 900.12(c)(4))
BytePad maps state-by-state retention into the disposition policy engine
By the numbers
The data that defines this market
What is the federal minimum for hospital record retention?
Medicare conditions of participation at 42 CFR 482.24(b)(1) require hospitals to retain medical records in their original or legally reproduced form for at least 5 years. This is a floor, not a target: most state hospital licensing rules are longer, and the longer rule always governs.
Mammography records are governed separately by the FDA Mammography Quality Standards Act regulations (21 CFR 900.12(c)(4)), which require retention for not less than 5 years, or not less than 10 years if the facility performs no additional mammograms of the patient, or longer if state law requires.
How long do hospitals in each state keep records?
The table below lists the hospital (not physician-office) adult retention rule for a set of states, with the governing citation. Statutes change, so always confirm the current text with counsel before setting a disposition date.
- California, 7 years after discharge; minors at least 1 year past age 18 and never less than 7 years (22 CCR §70751(c))
- Georgia, 5 years; minors 5 years after age 18 (Ga. Comp. R. & Regs. 111-8-40-.18)
- Illinois, 10 years (210 ILCS 85/6.17)
- Massachusetts, 20 years after discharge or final treatment (M.G.L. c.111 §70)
- New York, 6 years after discharge; minors 3 years after age 18 if longer; 6 years after death (10 NYCRR §405.10(a)(4))
- Pennsylvania, 7 years after discharge; minors 7 years after reaching majority (28 Pa. Code §115.23)
- Texas, 10 years after last treatment; minors until age 20 or 10 years, whichever is later (Tex. Health & Safety Code §241.103)
- Virginia, 5 years after discharge; minors 5 years after age 18 (12VAC5-410-370)
- Florida, public hospitals 7 years after the last entry under the state General Records Schedule GS4
Do physician offices follow the same retention rules as hospitals?
No. Many states set one retention period in hospital licensing rules and a different one in medical-board rules for physicians. Texas is a clear example: hospitals keep records 10 years under Health & Safety Code §241.103, while the Texas Medical Board rule for physicians (22 TAC §165.1) sets 7 years. In Massachusetts, the 20-year hospital rule sits alongside a separate physician rule in 243 CMR 2.07.
For health systems that own hospitals, employed-physician clinics and ambulatory surgery centers, this means one archive can hold records governed by several schedules at once. The retention policy has to follow the legal entity and setting that created each record, not just the state.
How long must records of minors be kept?
Records of minors almost always run longer than adult records. The common pattern is "age of majority plus X years," with X ranging from about 1 year (California) to 7 years (Pennsylvania) in the states above. Texas uses a different form: until the patient turns 20 or 10 years after last treatment, whichever is later.
Always run the patient-specific math: a record opened at age 2 in Pennsylvania must be kept until the patient is at least 25, even though the adult rule is 7 years.
How do you build a multi-state retention schedule?
Health systems that operate in more than one state, or that acquired hospitals with their own legacy systems, need a single retention schedule that the archive can enforce record by record. The practical sequence is below.
- List every legal entity and care setting (hospital, physician practice, behavioral health, lab, imaging) and the state it operates in
- For each entity, record the governing state rule, the federal floor, and any payer or contractual requirement, and keep the longest
- Add special cases: minors, deceased patients, mammography, and substance-use-disorder records under 42 CFR Part 2
- Define the retention trigger for each rule (discharge, last treatment, last entry, or age of majority)
- Load the schedule into the archive so every record carries its own disposition date, and log every disposition decision
How BytePad enforces this
During implementation, InterScripts maps the customer's state footprint (and any cross-state operations) into a retention policy engine inside BytePad. Each record is tagged with its applicable retention schedule, and the disposition engine prevents premature deletion. Audit logs prove the disposition decision tree to any auditor or counsel. See defensible disposition for healthcare data for the disposition workflow.
Sources & references
Where this analysis comes from
- CMS, 42 CFR 482.24 Medical Record Services
- FDA MQSA, 21 CFR 900.12
- California, 22 CCR §70751
- New York, 10 NYCRR §405.10
- Texas Health & Safety Code §241.103
- Massachusetts General Laws c.111 §70
- Pennsylvania, 28 Pa. Code §115.23
- Virginia, 12VAC5-410-370
- Health Information and the Law, 50-state retention comparison
Frequently asked
Answers to the questions buyers ask
How long must hospitals retain medical records?
At least 5 years under the federal Medicare conditions of participation (42 CFR 482.24(b)(1)), and usually longer under state hospital licensing rules: most states in this guide require 5 to 10 years after discharge or last treatment, and Massachusetts requires 20 years. Minors' records run longer. Always apply the longest of state, federal and contractual requirements.
Which state has the longest hospital record retention requirement?
Of the states in this guide, Massachusetts is the longest: hospitals may destroy a record only 20 years after the patient's discharge or final treatment (M.G.L. c.111 §70). Texas and Illinois follow at 10 years.
Is there a separate 7-year federal rule for hospital billing records?
Not in the Medicare hospital conditions of participation. 42 CFR 482.24 sets the 5-year minimum for medical records; it does not set a separate 7-year billing period. Billing and cost-report retention comes from other rules and payer contracts, so it should be mapped separately in the retention schedule.
Do physician practices follow the same rules as hospitals?
Often not. Many states set physician retention in medical-board rules that differ from hospital licensing rules. In Texas, for example, hospitals keep records 10 years while the medical board rule for physicians sets 7 years.
How does BytePad handle multi-state retention?
During implementation, InterScripts maps the customer's state footprint into BytePad's retention policy engine. Each record is tagged with its applicable retention schedule, and the disposition engine prevents premature deletion. Audit logs prove the disposition decision tree to any auditor or counsel.
Related in this pillar
Other deep dives on this topic
Defensible disposition for healthcare data
Defensible disposition for healthcare data: retention schedule, immutable archive, tamper-evident audit log. Three-part OIG/OCR/litigation test.
Read articleDeep Dive · EHR ArchivalBehavioral health archival: Netsmart, Credible, Anasazi and 42 CFR Part 2
Behavioral-health archival from Netsmart myEvolv, Credible, Anasazi: 42 CFR Part 2 substance-use handling and state-specific retention rules.
Read articleTalk to the team that wrote this guide.
Book a 30-minute walkthrough with the InterScripts experts behind this framework. We'll tailor it to your systems, retention obligations, federal compliance posture, and procurement timeline.
Your guide author
This guide is reviewed and maintained by the InterScripts editorial team and reflects current customer engagements, federal program activity, and 2026 regulatory updates.