What Happens to a Medical Record After 5 Years?
Meta description: Learn what happens to a medical record after five years, how U.S. retention rules vary, and how to request or transfer older records.
A medical record does not automatically expire, become invalid, or disappear after five years. In the United States, its status depends on the type of provider, applicable state law, and the circumstances of care. Some hospitals must keep records for at least five years under federal Medicare participation rules, while state requirements may call for longer retention. HIPAA, meanwhile, generally does not set a medical-record retention period. Knowing these distinctions can help patients locate older records, plan a provider change, and understand when records may be securely destroyed.
What a Medical Record’s Status Means After Five Years
After five years, a medical record may still be held by the doctor, hospital, clinic, or another record custodian. It may be stored in an electronic health record system, archived separately, transferred to a successor organization, or—if the applicable retention period has ended—eligible for secure destruction. The passage of time alone does not determine which outcome applies.
A record also does not lose its medical or legal significance simply because it is old. It can still help a clinician understand prior diagnoses, surgeries, allergies, medications, test results, and treatment. If it has been lawfully destroyed, however, the original information may no longer be available from that provider. Other sources, such as a patient portal, insurer, pharmacy, laboratory, or another treating provider, may retain some related information.
In short, five years is a retention benchmark in some settings, not a universal expiration date. The rules can differ between a hospital and an independent physician, and between states.
HIPAA Does Not Set a General Medical-Record Retention Period
A common misconception is that HIPAA requires every health care provider to keep medical records for six years. The six-year period in HIPAA’s Privacy Rule applies to certain required documentation—such as privacy policies, authorizations, and other compliance records—not to every patient’s clinical chart. HHS explains that the Privacy Rule generally does not require covered entities to retain medical records for a particular period; state law and other applicable rules may set those periods instead.
HIPAA does affect what happens while records are maintained. It establishes privacy and security duties for covered health care providers, health plans, and health care clearinghouses, and it gives individuals rights to access certain health information. But HIPAA should not be treated as a nationwide rule that a patient chart must be kept for six years—or that it can be destroyed as soon as six years have passed.
For the federal rule on HIPAA documentation, see the 45 C.F.R. § 164.316 and HHS’s guidance on how long HIPAA requires medical records to be kept.
Federal Rules Can Require Hospitals to Keep Records for at Least Five Years
Although HIPAA does not create a general retention period, other federal requirements may apply to particular providers. For example, Medicare’s hospital Conditions of Participation require hospitals to retain medical records in their original or legally reproduced form for at least five years, subject to applicable state law. This requirement appears in 42 C.F.R. § 482.24.
That rule concerns hospitals participating in Medicare. It does not mean every health care professional in the country has the same five-year deadline. A physician’s office, nursing facility, behavioral health provider, or other setting may be subject to different federal program requirements and state rules. A state may also require a hospital to retain records longer than the federal minimum.
Federal laws and program rules can apply to a specific record or provider type, so the relevant question is not simply, “Has it been five years?” It is also, “Who created the record, where was care provided, and which retention rules apply?”
State Laws Determine Many Retention Periods
Medical-record retention requirements vary across states. State statutes or regulations may set different periods for hospitals, physicians, dentists, mental health professionals, and other providers. They may also calculate the retention period differently: from the date of the last visit, the last entry, discharge, or another event. Some rules specify special timeframes for minors’ records.
For that reason, there is no reliable nationwide answer such as “all doctors keep records for seven years.” A period used in one state or provider setting may not apply in another. The requirement may also change over time, so current rules should be checked rather than inferred from an older internet summary.
To find the rule that applies, patients can check their state health department, professional licensing board, or state legislature’s official website. The provider’s medical-records or privacy office can also explain its retention policy and identify whether records were transferred or destroyed. When the issue involves a lawsuit, a minor’s record, or a specialized type of care, an attorney or the relevant licensing agency may help clarify the applicable rule.
How Retention Periods May Differ by Record Type
Not every document connected to care is necessarily handled under the same schedule. Clinical charts, billing files, insurance claims, laboratory materials, imaging, and records created for research or other purposes may be governed by different laws or organizational policies. A provider may also keep some information in one system and other information in a separate archive.
| Record or situation | What may affect retention | Practical point |
|---|---|---|
| Hospital medical chart | Federal hospital rules, state law, and hospital policy | Medicare-participating hospitals generally face a five-year federal minimum, but a longer state requirement may apply. |
| Physician or clinic chart | State law, provider type, and applicable program requirements | Do not assume the hospital rule applies to an independent practice. |
| Minor’s record | State rules may use a special period tied to age or adulthood | Ask how the period is calculated before assuming the chart is eligible for destruction. |
| Billing or insurance information | Separate legal, contractual, tax, or program requirements | A billing record may not contain the full clinical chart. |
| Imaging or laboratory material | Record type, state law, and facility policy | The written report may remain available even if an image or specimen is not. |
This table is a general guide, not a substitute for the rule in a specific state. A provider’s retention policy may exceed the legal minimum, and special circumstances can affect whether a record should be preserved.
Can a Provider Destroy a Medical Record After Five Years?
Possibly, but only if the applicable retention period has ended and no other duty requires preservation. A provider may have a legal, regulatory, contractual, or professional obligation to keep records longer than the minimum period. A pending complaint, audit, investigation, or legal claim may also affect whether destruction is appropriate. The details depend on the provider and the circumstances.
When records are no longer required, providers should follow applicable privacy and security obligations when disposing of them. HIPAA requires covered entities to use reasonable safeguards to protect protected health information, including when it is disposed of. That does not mean HIPAA specifies one universal destruction method or date for every chart; the provider’s process must be appropriate to the medium and applicable requirements.
Patients should not assume that an old chart has been destroyed simply because it is more than five years old. Providers may preserve records longer for continuity of care, internal policy, or legal compliance. Conversely, a provider may be unable to produce a record if it was lawfully destroyed after its required retention period.
How to Request a Medical Record That Is More Than Five Years Old
Patients generally have a HIPAA right to inspect or obtain a copy of protected health information in a designated record set maintained by a covered provider or health plan, subject to limited exceptions. That right applies to existing records; it does not require a provider to recreate information that no longer exists or to preserve a record indefinitely. HHS explains the access right in its guide to getting copies of medical records.
- Contact the records department. Ask for the health information management, medical records, or privacy office. A former patient may need to contact the organization that operated the facility at the time of care.
- Identify the records clearly. Include the patient’s name used during treatment, date of birth, approximate dates of care, provider or facility name, and the specific records requested, such as visit notes, discharge summaries, or imaging reports.
- Use the provider’s request process. The provider may require a form and identity verification. A personal representative may need to show legal authority to act for the patient.
- Ask where archived records went. If a practice closed or changed ownership, records may have been transferred to another provider, a records custodian, or a successor organization. The state licensing board may be able to point patients toward the responsible office.
- Request electronic delivery when available. A patient can ask for a convenient electronic copy if the information is maintained electronically and the requested format is readily producible.
Under the HIPAA access rule, a covered entity generally must act on an access request within 30 days. One extension of up to 30 additional days may be available when the provider gives the required written explanation and expected completion date. Fees for copies are limited to reasonable, cost-based amounts under HIPAA; state rules may provide additional protections. See 45 C.F.R. § 164.524.
What to Do if a Record Cannot Be Found
If a provider says a record is unavailable, patients can ask whether it was archived, transferred, or destroyed, and whether the office can provide a destruction date or the policy that applied. The provider may not be required to retain a record forever, but a clear explanation can help identify the next step.
Other organizations may hold copies or related data. A health insurer may have claims and explanation-of-benefits records; a pharmacy may have medication history; a laboratory may have test reports; and another hospital or clinician may have received records during treatment. A patient portal may also retain selected documents, though it may not include the complete chart.
When a record is needed for ongoing care, patients can provide a written timeline of diagnoses, procedures, medications, and allergies, and ask prior clinicians whether they retained summaries or key reports. For future access, it can be useful to download available records and keep copies of important documents in a secure location.
Key Takeaways About Medical Records After Five Years
- There is no universal five-year expiration rule. Record retention depends on state law, provider type, and other applicable requirements.
- HIPAA does not generally require providers to keep clinical records for six years. Its six-year documentation rule applies to specified HIPAA compliance records.
- Some Medicare-participating hospitals must retain records for at least five years. State law may require a longer period.
- Older records may still be accessible. Contact the provider or records custodian and make a specific written request.
- A provider may not be able to produce a record that was lawfully destroyed. Check for copies with insurers, pharmacies, laboratories, and other treating providers.
For an individual record, the most dependable answer comes from the provider’s records office and the current rules in the state where the care was delivered. Five years can matter, but it does not by itself decide whether a medical record still exists, must be retained, or can be requested.