How long must hospitals retain medical records?
The short answer
Federal Medicare conditions of participation set a 5-year minimum for clinical records and 7 years for billing records (42 CFR 482.24). State retention varies, most states require adult records 6–10 years from the date of last service. Pediatric records typically run age of majority plus 2–7 years. Specialty modalities (mammography, radiation oncology) often require 7–10+ years. Always defer to the longer of state and federal requirements.
Key takeaways
What every reader should walk away with
Federal baseline: 5 years clinical, 7 years billing (42 CFR 482.24)
Most states: 6–10 years adult retention from last service
Pediatric: age of majority + 2–7 years (state median)
Mammography: 10 years federally (FDA MQSA)
Always defer to the longer of state, federal, and contractual requirements
BytePad maps state-by-state retention into the disposition policy engine
By the numbers
The data that defines this market
Federal baseline
Medicare conditions of participation at 42 CFR 482.24 require hospitals to retain medical records in their original or legally reproduced form "for a period of at least 5 years." Billing records under 42 CFR 482.24(c) require 7 years. These are minimums, most state laws are stricter.
Mammography records are governed separately by the FDA Mammography Quality Standards Act (MQSA), which requires retention "for a period of not less than 5 years, or not less than 10 years if no additional mammograms of the patient are performed."
State adult retention (representative sample)
A representative sample of state requirements for adult medical records (always confirm with current state statutes):
- California, 7 years from date of last service (Health & Safety Code §1797.220, hospital licensing regs)
- Florida, 7 years from last patient contact (Rule 64B8-10.002, FAC)
- New York, 6 years (Public Health Law §18(6))
- Texas, 7 years (25 TAC §165.1)
- Pennsylvania, 7 years (28 Pa. Code §115.23)
- Illinois, 10 years (210 ILCS 85/6.17)
- Massachusetts, 30 years (243 CMR §2.07)
- Virginia, 6 years (12 VAC 5-410-370)
- Georgia, 10 years (Rule 111-8-40-.21)
- Ohio, 7 years (OAC 3701-83-08)
Pediatric retention
Pediatric retention is longer than adult retention in nearly every state. The pattern is "age of majority plus X." Most states set X at 2–7 years. Massachusetts, again, is an outlier at 30 years from the date of last entry regardless of patient age.
Always run the state-specific math: a record opened at age 2 in a state with "age of majority plus 7" must be retained until that patient is at least 25 years old.
How BytePad enforces this
During implementation, InterScripts maps the customer's state footprint (and any cross-state operations) into a retention policy engine inside BytePad. Each record is tagged with its applicable retention schedule, and the disposition engine prevents premature deletion. Audit logs prove the disposition decision tree to any auditor or counsel.
Sources & references
Where this analysis comes from
Frequently asked
Answers to the questions buyers ask
How long must hospitals retain medical records?
Federal Medicare conditions of participation require 5 years for clinical records and 7 years for billing. Most states require longer, typically 6–10 years for adult records, with pediatric records running age of majority plus 2–7 years. Always defer to the longer of state, federal, and contractual requirements.
What is the longest state retention requirement?
Massachusetts requires 30 years from the date of last entry under 243 CMR §2.07, the longest in the United States.
How does BytePad handle multi-state retention?
During implementation, InterScripts maps the customer's state footprint into BytePad's retention policy engine. Each record is tagged with its applicable retention schedule, and the disposition engine prevents premature deletion. Audit logs prove the disposition decision tree to any auditor or counsel.
Related in this pillar
Other deep dives on this topic
Defensible disposition for healthcare data
Defensible disposition for healthcare data: retention schedule, immutable archive, tamper-evident audit log. The three-part test that holds up in OIG, OCR, and litigation review.
Read articleDeep Dive · EHR ArchivalBehavioral health archival, Netsmart, Credible, Anasazi, Dayforce
Behavioral-health archival from Netsmart myEvolv, Credible, Anasazi, and Dayforce, with 42 CFR Part 2 substance-use-disorder handling and state-specific retention rules.
Read articleTalk to the team that wrote this guide.
Book a 30-minute walkthrough with the InterScripts experts behind this framework. We'll tailor it to your systems, retention obligations, federal compliance posture, and procurement timeline.
Your guide author
This guide is reviewed and maintained by the InterScripts editorial team and reflects current customer engagements, federal program activity, and 2026 regulatory updates.