Loading...
A source-cited retention guide for Pennsylvania hospitals, ambulatory surgical facilities, and physician practices — covering the 7-year state rule, the HIPAA documentation floor most organizations mistake for chart retention, and the diverging minor-patient rules between hospitals and physician practices.
Guide briefing
In Pennsylvania, hospitals and ambulatory surgical facilities must keep patient medical records for a minimum of 7 years following discharge (28 Pa. Code §115.23; §563.6), and physicians must keep practice records for at least 7 years from the date of the last medical service entry (49 Pa. Code §16.95). HIPAA's Security Rule sets a separate, shorter 6-year floor — but only for administrative documentation (policies, risk assessments, training records), not patient charts (45 CFR §164.316(b)(2)(i)). Medicare's hospital Condition of Participation requires only 5 years (42 CFR §482.24(b)), and the rural health clinic/FQHC standard is 6 years (42 CFR §491.10(c)). Where these floors differ, the longest applicable requirement controls — which in Pennsylvania is almost always the 7-year state rule. Minors' records must be kept longer under both state rules: until majority plus 7 more years for hospitals, and until age 19 (one year past majority) for physician practices — even if that exceeds 7 years.
More from the Compliance & Regulations category.
Next step
Share the framework, records condition, workflow, capacity issue, or implementation risk. Reynolds routes it to the discipline that owns the work — from Emmaus, with same-day response.
Need help applying this guide?
Talk to a specialistThis guide is general reference information, not legal advice. Retention regulations are periodically revised — always confirm the current requirement against your regulator's published rule (PA Department of Health, PA State Board of Medicine, HHS/OCR, or CMS) before setting a destruction date.
Medical record retention in Pennsylvania sits under several overlapping authorities at once — state hospital licensure regulation, state physician licensure regulation, HIPAA, and Medicare's Conditions of Participation — and each sets its own floor. Where they differ, the longest applicable requirement controls. In Pennsylvania, that is almost always the 7-year state rule, not the 6-year period commonly (and incorrectly) attributed to HIPAA. This guide lays out the controlling rule for hospitals, ambulatory surgical facilities, and physician practices, and calls out the one area — minor patients — where the hospital rule and the physician rule genuinely diverge.
This guide is part of Reynolds' broader Pennsylvania records-retention coverage; see the Pennsylvania records retention guide for schedules covering municipal, tax, payroll, and workplace-safety records outside the scope of this medical-records guide.
Compliance & Regulations
Medical record retention in Pennsylvania is governed by more than one authority, and each sets a different floor:
These rules are not mutually exclusive. A hospital in Pennsylvania is bound by all of them simultaneously and must comply with whichever requirement demands the longest retention for a given record. In practice, that means the 7-year Pennsylvania state rule is the controlling number for actual patient charts, because it exceeds both the HIPAA documentation floor and the Medicare hospital floor.
| Record Type | Retention Period | Authority | Citation |
|---|---|---|---|
| Hospital medical records (adult patient) | Minimum 7 years following discharge | PA Dept. of Health regulation | 28 Pa. Code §115.23 |
| Hospital medical records (minor patient) | Until patient reaches majority (age 18), then 7 more years — or as long as adult records are kept, whichever is longer | PA Dept. of Health regulation | 28 Pa. Code §115.23 |
| Ambulatory surgical facility records (adult) | Minimum 7 years following discharge | PA Dept. of Health regulation | 28 Pa. Code §563.6 |
| Ambulatory surgical facility records (minor) | Until majority, then 7 more years — or as long as adult records are kept, whichever is longer | PA Dept. of Health regulation | 28 Pa. Code §563.6 |
| Physician/practice records (adult patient) | Minimum 7 years from the date of the last medical service requiring a record entry | PA State Board of Medicine | 49 Pa. Code §16.95 |
| Physician/practice records (minor patient) | Until 1 year after the minor reaches majority (age 19) — even if this exceeds 7 years | PA State Board of Medicine | 49 Pa. Code §16.95 |
| HIPAA Security Rule documentation (policies, risk assessments, training records — NOT patient charts) | 6 years from creation, or from when the document was last in effect, whichever is later | U.S. Dept. of Health and Human Services | 45 CFR §164.316(b)(2)(i) |
| Medicare-participating hospital records (Condition of Participation) | Minimum 5 years | CMS | 42 CFR §482.24(b) |
| Rural health clinic / federally qualified health center records | Minimum 6 years from date of last entry (longer if state law requires) | CMS | 42 CFR §491.10(c) |
| Facility closure — hospital or ASF | Records must remain in a retrievable storage facility for at least 5 years post-closure, with public notice before destruction | PA Dept. of Health regulation | 28 Pa. Code §115.23 / §563.6 |
Because Pennsylvania hospitals and ambulatory surgical facilities are also Medicare providers, and physicians are also HIPAA covered entities, the applicable rule for any given organization is the longest of the requirements that apply to it — in nearly every Pennsylvania case, that is the 7-year state rule.
Under 28 Pa. Code §115.23, Pennsylvania hospitals must keep medical records — whether original, reproduced, or microfilmed — on file for a minimum of 7 years following the discharge of a patient. This applies regardless of format: a scanned and properly indexed copy satisfies the requirement the same as a paper original.
The same section addresses what happens if a hospital ceases operations. The facility must notify the Department of Health of where records will be stored and keep them in a retrievable facility for at least 5 years post-closure. Before any records are destroyed, the facility must provide public notice — through a legal announcement and newspaper advertisement — giving former patients an opportunity to request their own records.
Ambulatory surgical facilities (ASFs) are held to a parallel standard under 28 Pa. Code §563.6: the same 7-year minimum for adult patients, the same minor-patient extension, and the same 5-year post-closure retrievability requirement.
Hospitals that participate in Medicare are simultaneously subject to 42 CFR §482.24(b), which sets a 5-year federal floor. Because Pennsylvania's 7-year state requirement is longer, it is the operative standard for Pennsylvania hospitals — the federal rule does not shorten the state obligation.
For individual physicians and physician practices, the controlling rule is 49 Pa. Code §16.95, issued by the Pennsylvania State Board of Medicine. It requires that a patient's medical record be retained for at least 7 years from the date of the last medical service for which a medical record entry is required — not 7 years from the date the patient last walked through the door, but from the last documented service.
This is a meaningfully different measuring point than the hospital rule, which counts from discharge. A physician practice needs to track the date of the last chart entry per patient, not simply a single facility-wide cutoff.
Rural health clinics and federally qualified health centers that participate in Medicare are also subject to 42 CFR §491.10(c), a 6-year federal floor measured from the date of last entry — shorter than, and superseded by, the 7-year Pennsylvania Board of Medicine requirement.
When a practice closes. The 7-year retention obligation does not end when a physician retires, sells, or closes a practice. A physician cannot simply abandon records. Acceptable options generally include transferring records to another physician or practice willing to maintain them, arranging secure third-party storage, or notifying patients and giving them a reasonable opportunity to obtain copies before the practice closes. Treat specific closure procedures and notice timelines as a matter for the Pennsylvania State Board of Medicine or legal counsel — this guide does not have a verified primary-source citation for a detailed closure notice procedure beyond the general retention duty in §16.95, and we are not going to guess at specifics that could expose a practice to a Board complaint.
Pennsylvania's age of majority is 18. Both the hospital rule and the physician rule extend retention for minors' records beyond the standard period — but they extend it differently, and mixing them up is a common compliance error for organizations that operate both a hospital/ASF and affiliated physician practices.
Hospitals and ambulatory surgical facilities (28 Pa. Code §115.23 / §563.6): if the patient is a minor, records must be kept until the patient reaches majority, and then for 7 more years — or as long as the facility's adult patient records are maintained, whichever is longer. In practice, this generally means retention until roughly age 25.
Physician practices (49 Pa. Code §16.95): the rule is different — records for a minor patient must be kept until 1 year after the minor reaches majority, which is age 19. The regulation is explicit that this 1-year-past-majority rule controls even if it results in a shorter or longer retention period than the standard 7 years for that particular patient.
Because these are two distinct regulatory standards, a health system that includes both a hospital and employed physician practices should apply the correct rule to each record type rather than defaulting to a single organization-wide policy.
The single most common misunderstanding in this area is the belief that "HIPAA requires providers to keep medical records for 6 years." That is not accurate, and it understates Pennsylvania's actual requirement.
45 CFR §164.316(b)(2)(i) requires covered entities to retain HIPAA-related documentation — policies, procedures, risk assessments, training records, and other materials showing the organization's compliance program — for 6 years from the date of creation, or from the date the document was last in effect, whichever is later.
That provision governs compliance paperwork, not the patient's medical chart. HIPAA itself does not specify how long a provider must keep a patient's actual clinical record. Chart retention in Pennsylvania is governed by state licensure regulations — the 7-year rules in 28 Pa. Code §115.23, §563.6, and 49 Pa. Code §16.95 — which are considerably longer than HIPAA's 6-year documentation floor and are the numbers that actually control how long a chart must be kept.
Organizations that stop at "6 years because HIPAA" are under-retaining patient charts relative to their Pennsylvania licensure obligations.
Pennsylvania's hospital and ambulatory surgical facility regulations explicitly recognize reproduced and microfilmed records as valid for meeting the retention requirement: 28 Pa. Code §115.23 and §563.6 both state that records "whether original, reproductions or microfilm" must be kept on file for the required period. A properly scanned, indexed, and access-controlled digital record therefore satisfies the same 7-year (or minor-extended) retention obligation as a paper original — the regulation does not require the paper original to be preserved once a compliant reproduction exists.
What this guide can verify stops there. We have not located a Pennsylvania-specific primary-source standard spelling out chain-of-custody or format-integrity requirements for scanned medical records beyond that general "reproductions or microfilm" language, so we are not going to invent one. Reynolds' document scanning services apply standard information-governance practice — verifiable scan quality, audit trails, and access controls — as part of a broader records management program; organizations should confirm any additional specifics with the Department of Health or legal counsel.
One related point that is independently verifiable but outside this guide's medical-records scope: government-operated health facilities and other public bodies in Pennsylvania may also have obligations under the Pennsylvania Historical and Museum Commission (PHMC) records retention schedules that apply to public records generally. Where a healthcare organization is a government entity, its PHMC schedule and the medical-records-specific rules above should both be checked.
A minimum of 7 years following the patient's discharge, per 28 Pa. Code §115.23. For minors, records must be kept until the patient reaches majority (age 18) and then for 7 more years, or as long as the facility keeps adult records — whichever is longer.
At least 7 years from the date of the last medical service for which a record entry was required, per 49 Pa. Code §16.95. The clock runs from the last chart entry, not from the date the patient stopped being an active patient.
It depends on the type of provider. Hospitals and ambulatory surgical facilities must keep a minor's record until majority (age 18) plus 7 more years, or as long as adult records are kept — whichever is longer (28 Pa. Code §115.23; §563.6). Physician practices must keep a minor's record until 1 year after the patient reaches majority, i.e., until age 19 — even if that period is different from the standard 7 years (49 Pa. Code §16.95).
Not for patient charts. HIPAA's 6-year retention rule (45 CFR §164.316(b)(2)(i)) applies to compliance documentation — policies, risk assessments, training records — not to the clinical medical record itself. Pennsylvania's state licensure rules, which require 7 years for hospital and physician records, are the actual controlling standard for chart retention.
Once the applicable state-mandated retention period has run — 7 years for most adult records, longer for minors — records may generally be destroyed, subject to any facility-closure notice requirements. Organizations should also confirm no other legal hold, pending litigation, or longer contractual/insurer requirement applies before destruction, since this guide covers the regulatory retention floor, not litigation-hold practice.
Pennsylvania's hospital and ambulatory surgical facility regulations explicitly count reproductions and microfilm as valid formats for meeting the retention requirement (28 Pa. Code §115.23; §563.6), which supports treating a properly scanned and indexed record as satisfying the same obligation as a paper original.
Both require a 7-year minimum, but they measure from different starting points: hospitals count from the date of patient discharge (28 Pa. Code §115.23), while physician practices count from the date of the last medical service entry (49 Pa. Code §16.95). The minor-patient extensions also differ between the two rules — see the minors section above.
Yes, but the shorter federal number doesn't reduce the state obligation. Medicare's hospital Condition of Participation requires only 5 years (42 CFR §482.24(b)), and the rural health clinic/FQHC standard is 6 years (42 CFR §491.10(c)). Both are shorter than Pennsylvania's 7-year rule, so Pennsylvania providers must still meet the longer state requirement.
