Illinois Medical Records Retention Requirements: How Long Healthcare Providers Must Keep Patient Records

Illinois medical records retention requirements vary by provider type and situation. This guide explains the core medical records retention periods, litigation hold compliance, patient confidentiality laws, electronic health records retention, and record destruction procedures so you can align practice policies with healthcare documentation standards and work effectively with legal counsel for record handling.

Hospital Medical Records Retention

Baseline retention

Illinois hospitals must preserve patient medical records for a duration set by hospital policy, but not less than 10 years. The statute applies regardless of format (paper or electronic). This is the statewide floor for hospital medical records retention periods. ([ilga.gov](https://ilga.gov/legislation/ilcs/fulltext.asp?DocName=021000850K6.17&utm_source=openai))

Special items: imaging

Hospitals must keep diagnostic X‑ray/roentgen films for at least 5 years. If litigation is anticipated or pending, additional rules apply (see the Litigation Hold Exception section). ([codes.findlaw.com](https://codes.findlaw.com/il/chapter-210-health-facilities-and-regulation/il-st-sect-210-90-1/?utm_source=openai))

Confidentiality reminder

Under the Hospital Licensing Act, staff and agents may not disclose patient record details except as authorized by law (for treatment, payment, healthcare operations, and other limited circumstances). Retention policies should be implemented alongside patient confidentiality laws to ensure compliant access and release. ([ilga.gov](https://ilga.gov/legislation/ilcs/fulltext.asp?DocName=021000850K6.17&utm_source=openai))

Litigation Hold Exception

Hospitals

If, before the 10‑year period ends, a hospital receives written notice from an attorney that a patient record may be evidence in pending litigation, the hospital must retain that record until written notice confirms the case has concluded, or for 12 years from the date the record was produced—whichever occurs first. Build litigation hold compliance into policies and workflows. ([ilga.gov](https://ilga.gov/legislation/ilcs/fulltext.asp?DocName=021000850K6.17&utm_source=openai))

Ambulatory surgical treatment centers (ASTCs)

ASTCs must retain a patient’s record for at least 10 years after the date of service. If the ASTC receives written notice of pending litigation before the record’s retention period expires, it must retain the record until the litigation ends or for 10 years after the date of service, whichever occurs later. ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-205.610))

Operational guidance

Document legal holds promptly, suspend routine destruction, and track holds through resolution for all affected record sets, including EHR data and backups. Industry guidance from health information professionals emphasizes formal legal‑hold procedures and clear release conditions. ([journal.ahima.org](https://journal.ahima.org/Portals/0/archives/AHIMA%20files/How%20and%20Why%20to%20Preserve%20Health%20Records%20During%20Litigation.pdf?utm_source=openai))

Physician and Outpatient Provider Retention

Independent physician practices and clinics

Illinois does not set a single statutory retention period for all private physician offices. Many practices align policies with malpractice statutes and payer requirements, and they consult legal counsel for record handling that fits their risk profile. ([medicaleconomics.com](https://www.medicaleconomics.com/view/illinois-medical-records?utm_source=openai))

Medicare requirements affecting practitioners

For Medicare services you order, certify, refer, prescribe, or bill, federal rules require you to maintain related medical documentation for 7 years from the date of service. This applies to physicians and other eligible professionals and should be reflected in electronic health records retention schedules. ([cms.gov](https://www.cms.gov/files/document/mln4840534-medical-record-maintenance-access-requirements.pdf))

Facility-based outpatient settings

Where outpatient care occurs in regulated facilities, Illinois rules may establish specific periods. For example, ASTCs must retain records for at least 10 years, with longer retention for minors (see below). ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-205.610))

Minor Patient Records Retention

Hospitals and risk-aligned practice

Illinois’ malpractice statute gives minors up to 8 years to file, but not beyond the 22nd birthday. Many providers therefore retain minor records until at least age 23 to cover the limitation window, even though the hospital statute sets a general 10‑year minimum. Coordinate this with EHR retention and schedule reviews. ([ilga.gov](https://ilga.gov/documents/legislation/ilcs/documents/073500050K13-212.htm?utm_source=openai))

ASTCs and long‑term care

ASTCs must retain a minor’s record until the patient is 23 years old or for at least 10 years after the record was produced, whichever is longer. Skilled nursing and similar long‑term care facilities must keep records for discharged minors at least until age 23. ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-205.610))

Adult Patient Records Retention

Hospitals and regulated facilities

Illinois hospitals must keep adult patient records for a minimum of 10 years, and ASTCs must retain adult records for at least 10 years after the date of service. Your policy may specify a longer period based on operational needs. ([ilga.gov](https://ilga.gov/legislation/ilcs/fulltext.asp?DocName=021000850K6.17&utm_source=openai))

Physician practices

For Medicare-related documentation, keep records for 7 years from the date of service. For non‑Medicare adults, many practices adopt a 7‑to‑10‑year period aligned to payer rules and risk tolerance, documented in their healthcare documentation standards. ([cms.gov](https://www.cms.gov/files/document/mln4840534-medical-record-maintenance-access-requirements.pdf))

Deceased Patient Records Retention

Retention period versus privacy protection

Illinois law generally governs how long to keep records; HIPAA separately protects a decedent’s PHI for 50 years after death. You are not required by HIPAA to keep a record for 50 years, but while retained under state schedules, access and disclosure must meet HIPAA’s decedent privacy rule. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/1501/am-i-required-to-keep-the-decedents-information-for-50-years/index.html?utm_source=openai))

Provider‑type specifics

• Hospitals: follow the 10‑year minimum unless a litigation hold applies. ([ilga.gov](https://ilga.gov/legislation/ilcs/fulltext.asp?DocName=021000850K6.17&utm_source=openai))
• Long‑term care facilities: retain the resident’s record for at least 5 years after death. ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-350.1650?utm_source=openai))
• ASTCs and physician offices: follow the applicable 10‑year (ASTC) or practice/payer policies, and apply any legal holds. ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-205.610))

Record Destruction Policy

Core elements

• Written policy: Define retention schedules by record type, suspension rules for legal holds, and approved record destruction procedures across paper and electronic systems. Certain Illinois healthcare regulations require facilities to specify destruction methods in policy. ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-340.1830))
• Secure disposal: When destroying records with personal information, use methods that prevent reconstruction (for example, shredding, pulverizing, or secure media wiping). Illinois’ Personal Information Protection Act (PIPA) requires secure disposal and controls for third‑party destruction vendors. ([il.elaws.us](https://il.elaws.us/law/815ilcs530?utm_source=openai))
• Documentation: Maintain certificates or logs showing what was destroyed, when, how, and under whose authority, and keep them consistent with your electronic health records retention plan.
• Operational safeguards: Ensure access controls, chain‑of‑custody, and device/media sanitization standards are enforced, including for backups and archived media.

Hospitals and facility licensing considerations

Illinois hospital rules require you to establish record completion and retention requirements in policy; align those with statutory floors and your destruction timetable. During ownership changes or closures, ensure continued access and preservation before any records are destroyed. ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-250.1510?utm_source=openai))

FAQs

How long must Illinois hospitals keep medical records?

At least 10 years, per the Hospital Licensing Act; hospital policy can set a longer period. Keep in mind special items like X‑ray films (5 years minimum) and any litigation holds that may extend retention. ([ilga.gov](https://ilga.gov/legislation/ilcs/fulltext.asp?DocName=021000850K6.17&utm_source=openai))

What happens to patient records during litigation?

When a hospital receives proper written notice of pending litigation before its 10‑year minimum ends, it must keep the record until the case concludes or for 12 years from the record’s production date, whichever occurs first. ASTCs must retain until the case concludes or for 10 years after service, whichever is later. ([ilga.gov](https://ilga.gov/legislation/ilcs/fulltext.asp?DocName=021000850K6.17&utm_source=openai))

Are there special retention rules for minor patients?

Yes. To align with Illinois’ malpractice statute for minors (claims allowed up to the 22nd birthday), many providers keep records until at least age 23. ASTCs and long‑term care facilities explicitly require retention until age 23 (or longer rules as stated). ([ilga.gov](https://ilga.gov/documents/legislation/ilcs/documents/073500050K13-212.htm?utm_source=openai))

What are the requirements for destroying medical records in Illinois?

Have a written policy that specifies timing and methods, suspend destruction under any legal hold, and use secure techniques that prevent reconstruction. Illinois’ Personal Information Protection Act requires secure disposal and oversight of any destruction vendors. ([law.cornell.edu](https://www.law.cornell.edu/regulations/illinois/Ill-Admin-Code-tit-77-SS-340.1830))