How Long Are Medical Records Kept in Pennsylvania? PA Retention Rules Explained

If you manage patient records in Pennsylvania, how long you must keep them depends on patient age and the type of provider or facility. This guide explains adult and minor retention periods, physician versus hospital rules, legal risks, and practical compliance steps so you can meet Pennsylvania medical record retention obligations with confidence.

Medical Record Retention for Adult Patients

Core timeframes by setting

• Physicians (MDs): Keep adult patient records at least 7 years from the last date of service. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))
• Osteopathic physicians (DOs): Keep at least 7 years from the last entry. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter25/subchapDtoc.html))
• Hospitals: Keep at least 7 years after discharge. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/028/chapter115/chap115toc.html))
• Ambulatory surgical facilities (ASFs): Keep at least 7 years after discharge and maintain a written retention policy. ([law.cornell.edu](https://www.law.cornell.edu/regulations/pennsylvania/28-Pa-Code-SS-563-6?utm_source=openai))

Other timing rules that may also apply

• Medicaid (MA) providers: Retain medical and fiscal records at least 4 years unless a longer provider-specific rule applies—follow whichever is longer. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/055/chapter1101/chap1101toc.html?utm_source=openai))
• HIPAA: The Privacy Rule does not set a medical-record retention period, but it does require you to retain HIPAA documentation (for example, policies, NPP copies, training records) for 6 years. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html?utm_source=openai))

Retention Periods for Minor Patients

Pennsylvania’s age of majority is 18, which drives the State’s patient age criteria for record retention. ([legis.state.pa.us](https://www.legis.state.pa.us/wu01/li/li/ct/htm/23/23.htm?utm_source=openai))

• Physicians (MDs): Keep until 1 year after the patient turns 18—even if that exceeds 7 years (practically, at least until age 19). ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))
• Osteopathic physicians (DOs): Keep until 2 years after the patient turns 18 or 7 years from the last entry, whichever is later (practically, at least until age 20). ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter25/subchapDtoc.html))
• Hospitals and ASFs: Keep until the patient reaches majority, then for an additional 7 years (practically, at least until age 25). ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/028/chapter115/chap115toc.html))

Example timeline

If a 16-year-old is treated on June 1, 2026, an MD must retain the record at least until the patient turns 19 (June 1, 2029+ based on birthday), while a hospital or ASF must retain it until at least age 25. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))

Retention Requirements for Physicians

What the regulations require

• Maintain accurate, legible, and complete records with timely entries that reflect evaluation and treatment. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))
• Minimum retention: 7 years from last service (MDs) or last entry (DOs); longer for minors as above. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))
• Provide copies to patients or authorized representatives within a reasonable time; keep information confidential subject to limited exceptions. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))
• Components of a patient’s record kept by a licensed facility (for example, labs, imaging) are part of the physician’s record even if stored at the facility. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))

Following these healthcare provider obligations helps ensure PA healthcare compliance and reduces risk in audits, payer reviews, and litigation. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/055/chapter1101/chap1101toc.html?utm_source=openai))

Hospital and Ambulatory Facility Retention Rules

Hospitals must preserve medical records for a minimum of 7 years after discharge; for minors, retain until they reach age 18 and then for 7 more years. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/028/chapter115/chap115toc.html))

ASFs must meet the same minimum periods and maintain a written retention policy. If an ASF closes, it must arrange record storage for at least 5 years after closure and provide public notice before destruction. Hospitals follow a similar closure-notice and storage framework. These requirements shape medical record disposal regulations at the facility level. ([law.cornell.edu](https://www.law.cornell.edu/regulations/pennsylvania/28-Pa-Code-SS-563-6?utm_source=openai))

Legal Implications of Record Retention

Licensing and enforcement

Failure to retain or produce required records can trigger disciplinary action by state licensing boards under the Medical Practice Act. ([codes.findlaw.com](https://codes.findlaw.com/pa/title-63-ps-professions-and-occupations-state-licensed/pa-st-sect-63-422-41/?utm_source=openai))

Litigation exposure

• Statute of limitations: Most medical malpractice claims must be filed within 2 years of when the injury was or reasonably should have been discovered. ([legis.state.pa.us](https://www.legis.state.pa.us/WU01/LI/LI/CT/HTM/42/00.055.024.000..HTM?utm_source=openai))
• Minors: The limitations period is tolled during minority; a patient typically has until their 20th birthday to file. ([law.justia.com](https://law.justia.com/codes/pennsylvania/title-42/chapter-55/section-5533/?utm_source=openai))
• Statute of repose: Pennsylvania’s 7‑year malpractice statute of repose was struck down in 2019, which can lengthen risk horizons under the discovery rule. ([law.justia.com](https://law.justia.com/cases/pennsylvania/supreme-court/2019/10-wap-2018.html?utm_source=openai))

Privacy compliance

HIPAA requires appropriate safeguards for PHI throughout its lifecycle and mandates 6‑year retention of HIPAA documentation (for example, policies, NPPs, training, complaint logs)—separate from state-mandated medical record retention. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html?utm_source=openai))

Compliance Strategies for Healthcare Providers

• Build a written retention schedule that distinguishes adult patient record retention from minor patient record retention and maps rules by setting (office, hospital, ASF).
• Track trigger events precisely: “last date of service/entry” for physicians; “discharge” for hospitals/ASFs.
• Flag minors at registration and automate destruction dates by date of birth plus the required post‑majority period.
• Layer in payer rules (for example, MA’s 4‑year retention) and keep the longer period when requirements differ. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/055/chapter1101/chap1101toc.html?utm_source=openai))
• Adopt legal‑hold procedures to pause disposal when litigation, audits, or investigations are reasonably anticipated.
• Document secure destruction methods (paper and electronic) and maintain certificates of destruction where applicable; ensure safeguards satisfy HIPAA. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html?utm_source=openai))
• Designate a records custodian, test EHR archiving/export, back up indexes, and define a plan for provider retirement, practice sale, or facility closure consistent with PA rules. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/028/chapter115/chap115toc.html))

Consulting Pennsylvania Medical Record Regulations

When finalizing policies—or if your scenarios are nuanced—consult the controlling sources directly: physicians (49 Pa. Code § 16.95), osteopathic physicians (49 Pa. Code § 25.213), hospitals (28 Pa. Code § 115.23), ASFs (28 Pa. Code § 563.6), Medicaid providers (55 Pa. Code § 1101.51(e)), and HIPAA documentation retention (45 C.F.R. § 164.530). Always confirm the latest text before making disposal decisions. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))

Summary

Pennsylvania medical record retention hinges on patient age and practice setting: 7 years for adult office records (from last service/entry), 7 years after discharge for hospitals/ASFs, and extended periods for minors. Pair state rules with HIPAA’s 6‑year documentation mandate, respect payer overlays, and use a written schedule plus legal holds and secure destruction to maintain PA healthcare compliance. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))

FAQs.

How long must physicians keep medical records in Pennsylvania?

Physicians must keep adult patient records at least 7 years—MDs measure from the last date of service; DOs from the last entry. Longer timelines apply for minors. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))

What are the retention requirements for minor patient records?

MDs must keep records until 1 year after the patient turns 18; DOs must keep them until 2 years after the 18th birthday or 7 years from the last entry, whichever is later. Hospitals and ASFs keep minor records until majority and then for 7 additional years. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/049/chapter16/subchapFtoc.html))

Do hospitals have different record retention periods than doctors?

Yes. Hospitals (and ASFs) calculate retention from discharge—at least 7 years for adults and, for minors, until majority plus 7 years—whereas physician offices calculate from the last service/entry. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/028/chapter115/chap115toc.html))

When can medical records be legally destroyed in Pennsylvania?

After the applicable retention period ends, and absent a legal hold, records may be securely destroyed. Facilities must also follow any closure‑specific steps (for example, storage and public notice for hospitals/ASFs). Regardless of retention, HIPAA requires safeguarded disposal and 6‑year retention of HIPAA documentation. ([pacodeandbulletin.gov](https://www.pacodeandbulletin.gov/secure/pacode/data/028/chapter115/chap115toc.html))