Medical Record Retention: HIPAA, State Laws, and International Requirements

How Long Must Medical Records Be Kept?

Retention periods vary by jurisdiction, record type, and patient age. Providers must comply with the strictest applicable rule.

United States

• HIPAA: 6 years from creation or last use (whichever is later).
• State laws: Often longer—e.g., 7–10 years for adults; minors: until age of majority + 3–10 years.
• Medicare/Medicaid: 5–10 years depending on program.
• OSHA: 30 years for occupational exposure records.

Canada

• CMA guideline: 10 years from last entry or age of majority (whichever later).
• Provincial laws may extend further.

United Kingdom

• GMC: 8 years after last entry (adults); until 25th birthday or 8 years (children).
• NHS: 20 years for some records; 8 years minimum.

European Union (GDPR)

• Retain only as long as necessary for the purpose.
• No fixed period—justify retention based on legal, clinical, or research needs.
• Secure deletion/anonymization required after.

Best Practices

• Maintain a written retention policy.
• Track retention triggers (last visit, age of majority, legal hold).
• Use secure destruction (shredding, degaussing) with documentation.
• Consult legal counsel for jurisdiction-specific requirements.