TL;DR

In California, physicians and surgeons must keep adult patient records for at least 7 years after the last date of service, under California Business and Professions Code §2266 (effective January 1, 2024). Licensed medical facilities (hospitals, skilled nursing facilities, clinics) must keep records for a minimum of 7 years after patient discharge under Title 22 §72543 and §73543 of the California Code of Regulations. For minors treated at a licensed facility, records must be kept until 1 year after the minor turns 18, or 7 years after the last date of service, whichever is later. Providers billing Medi-Cal have a stricter rule: retention for 10 years under Welfare and Institutions Code §14124.1.

The short answer

California's default retention rule is 7 years. Physicians must keep patient records for at least 7 years after the last date of service, and the same 7-year minimum applies to licensed medical facilities. For minors treated at licensed facilities, the rule is more protective: records stay on file until 1 year after the minor reaches age 18, or 7 years after the last service, whichever is longer. Programs with audit or reimbursement exposure, particularly Medi-Cal, add longer retention on top. Across the board, California's rules are stricter than the federal HIPAA and Medicare baselines, which apply only to administrative documentation (HIPAA) or set a shorter floor for patient records (Medicare hospitals).

California rules by scenario

Physicians and surgeons

California Business and Professions Code §2266 makes it unprofessional conduct for a licensed physician or surgeon to fail to keep adequate and accurate patient records "for at least seven years after the last date of service to a patient." The 7-year floor was added by Senate Bill 815 (Stats. 2023, Ch. 294) and took effect on January 1, 2024. Prior law required "adequate and accurate records" without any specific time floor.

Section 2266 does not specify a separate retention period for minor patients treated in a physician's office. The 7-year rule applies across the board. Physicians seeking a more conservative standard often extend retention for pediatric records to match the facility rule below (age 19 or 7 years from last visit, whichever is later), because California's malpractice statute of limitations for minors can extend well past age 18.

Hospitals, skilled nursing facilities, and intermediate-care facilities

Title 22 of the California Code of Regulations, §72543 (skilled nursing facilities) and §73543 (intermediate-care facilities and acute hospitals), set the facility rule:

• All health records of discharged patients must be completed and filed within 30 days of discharge.

• Records must be kept for a minimum of 7 years.

• For minors, records must be kept at least until 1 year after the minor has reached age 18, but in no case less than 7 years.

• All exposed X-ray film must be retained for 7 years.

• Records must be filed in an accessible manner in the facility or in health-record storage.

A licensee that sells, transfers, or ceases operation must notify the California Department of Public Health of the arrangements made to preserve records.

Facility closure or sale

California Health and Safety Code §123145 imposes a separate duty that kicks in only when a licensed health facility (specifically those licensed under HSC sections 1205, 1253, 1575, or 1726) ceases operation. In that event, the licensee must preserve patient records for at least 7 years after discharge, with the minor rule extending to 1 year past age 18 and never less than 7 years total. Section 123145 does not set the general retention rule while a facility is operating; that duty comes from the Title 22 regulations above. Patients whose records are lost when a facility closes have a private right of action for damages.

Medi-Cal providers

California Welfare and Institutions Code §14124.1 requires Medi-Cal providers to retain records for 10 years, running from the latest of three dates:

• The final date of the contract period between the Medi-Cal plan and the provider

• The date of completion of any audit

• The date the service was rendered

For any patient treated under Medi-Cal, the 10-year rule supersedes the 7-year default. Providers that mix Medi-Cal and non-Medi-Cal caseloads commonly apply the longer rule across the practice to avoid tracking different retention clocks for different charts.

Mental-health and psychotherapy notes

California does not set a separate statutory retention period for psychotherapy notes beyond the 7-year default that applies to physicians and facilities. HIPAA's rule on psychotherapy notes (45 CFR §164.508) governs authorization for disclosure, not retention. HIPAA's 6-year documentation rule at 45 CFR §164.530(j)(2) applies to administrative compliance records, not to clinical notes.

Substance-use disorder records

Federal law at 42 CFR Part 2 governs the confidentiality of federally-assisted substance-use disorder treatment records but does not impose a distinct retention period beyond what HIPAA and state law require.

X-rays and imaging

Title 22 sections 72543 and 73543 require California licensed facilities to retain exposed X-ray film for 7 years, matching the general facility retention period.

Patient access

California Health and Safety Code sections 123110 through 123120 give patients and their representatives the right to inspect and copy their own medical records, with specific statutory deadlines for providers to respond to written requests. These access rules do not alter the retention period, but destroying records before the retention period expires can result in enforcement actions and civil liability.

How California compares to federal law

California's 7-year rule is longer than the federal baselines:

• HIPAA Privacy Rule, 45 CFR §164.530(j)(2): requires covered entities to retain policies, procedures, and documentation of HIPAA compliance activities for 6 years from creation or last effective date. This is administrative documentation, not patient medical records. HIPAA does not set a retention period for patient charts.

• HIPAA Security Rule, 45 CFR §164.316(b)(2)(i): requires the same 6-year retention for security policies and related documentation of required actions.

• Medicare Conditions of Participation for Hospitals, 42 CFR §482.24(b)(1): requires hospitals to retain medical records, in original or legally reproduced form, for at least 5 years.

Where California's rule is longer, California controls. HIPAA expressly defers to state law that is more protective of patient privacy or that imposes longer retention. Summary: HIPAA requires 6 years for administrative documents only, Medicare hospitals require 5 years for patient records, and California requires 7 years for patient records with 10 years for Medi-Cal.

State-by-state quick reference

Retention rules in 13 states, confirmed against primary sources as of 2026. Laws change, and several of these statutes were amended in recent years. Always confirm against the current statute or regulation before acting on this information. Some states have different rules for physicians than for hospitals; those entries are labeled accordingly.

• California (physicians). Adult records: 7 years from last service · Minor records: No separate minor rule in §2266 · Primary source: Cal. Bus. & Prof. Code §2266

• California (licensed facilities). Adult records: 7 years from discharge · Minor records: Age 19, or 7 years from last service, whichever later · Primary source: 22 CCR §72543, §73543

• Texas (physicians). Adult records: 7 years from last treatment · Minor records: Age 21, or 7 years, whichever longer · Primary source: 22 Tex. Admin. Code Ch. 163 (replaced §165.1 on January 9, 2025)

• Florida (physicians). Adult records: 5 years from last patient contact · Minor records: No separate statutory minor rule; longer retention commonly practiced · Primary source: Fla. Admin. Code R. 64B8-10.002

• New York (hospitals). Adult records: 6 years from discharge · Minor records: 6 years, or 3 years past age 18 (age 21), whichever longer · Primary source: 10 NYCRR §405.10

• Pennsylvania (hospitals). Adult records: 7 years from discharge · Minor records: Until age of majority plus 7 years (age 25) · Primary source: 28 Pa. Code §115.23

• Illinois (hospitals). Adult records: 10 years (12 years if hospital receives written litigation notice) · Minor records: No separate statutory minor rule; secondary guidance commonly extends to age 23 based on Illinois malpractice statutes of limitations · Primary source: 210 ILCS 85/6.17

• Ohio (licensed facilities). Adult records: 6 years from discharge · Minor records: No separate statutory minor rule · Primary source: Ohio Admin. Code 3701-83-11

• Georgia (general health-care providers). Adult records: 10 years from date the record item was created · Minor records: No separate statutory minor rule · Primary source: O.C.G.A. §31-33-2

• Georgia (hospitals). Adult records: 5 years from discharge · Minor records: 5 years past age of majority (age 23) · Primary source: Ga. Comp. R. & Regs. R. 111-8-40-.18

• Michigan. Adult records: 7 years from last service · Minor records: No separate statutory minor rule; 7-year floor applies. Secondary guidance commonly extends to age 21. · Primary source: MCL §333.16213

• Virginia (physicians). Adult records: 6 years from last encounter · Minor records: Until age 18, minimum 6 years · Primary source: Va. Code §54.1-2910.4

• Washington (hospitals). Adult records: 26 years from record creation (effective July 27, 2025) · Minor records: 26 years (no separate minor rule) · Primary source: RCW 70.41.190

• Arizona. Adult records: 6 years from last service · Minor records: 3 years past age 18 (age 21), or 6 years from service, whichever later · Primary source: A.R.S. §12-2297

• Massachusetts (physicians). Adult records: 7 years from last encounter · Minor records: Age 18, or 7 years, whichever longer · Primary source: 243 CMR 2.07

• Massachusetts (hospitals). Adult records: 20 years from discharge or final treatment · Minor records: No separate statutory minor rule · Primary source: M.G.L. c. 111, §70

A few notes on the list. Washington's 26-year rule became effective July 27, 2025, replacing an earlier 10-year rule. Massachusetts hospitals have a notably longer rule (20 years) than physician offices (7 years) in the same state. Texas reorganized its physician retention rule in January 2025, repealing 22 TAC §165.1 and relocating the same substantive 7-year / age-21 rule to Chapter 163. Florida, Ohio, Michigan, and Georgia's general health-records statute do not set a separate statutory minor rule; providers in those states often extend retention beyond the adult floor as risk-management practice, referencing state malpractice statutes of limitations. New Jersey and North Carolina have rules that vary by facility type; they were not independently verified for this article and are omitted.

This article provides general information about medical records retention rules as of 2026. It is not legal advice. Retention requirements can change and often interact with malpractice statutes of limitations, contract terms, and payor agreements. Providers and patients with specific questions should consult a qualified attorney or their state medical board.