How Long Do Hospitals and Medical Practices Keep Medical Records in Pennsylvania?

Introduction

Medical record retention in Pennsylvania sits under several overlapping authorities at once — state hospital licensure regulation, state physician licensure regulation, HIPAA, and Medicare's Conditions of Participation — and each sets its own floor. Where they differ, the longest applicable requirement controls. In Pennsylvania, that is almost always the 7-year state rule, not the 6-year period commonly (and incorrectly) attributed to HIPAA. This guide lays out the controlling rule for hospitals, ambulatory surgical facilities, and physician practices, and calls out the one area — minor patients — where the hospital rule and the physician rule genuinely diverge.

This guide is part of Reynolds' broader Pennsylvania records-retention coverage; see the Pennsylvania records retention guide for schedules covering municipal, tax, payroll, and workplace-safety records outside the scope of this medical-records guide.

Who Regulates Medical Record Retention — And Why the Rules Overlap

Medical record retention in Pennsylvania is governed by more than one authority, and each sets a different floor:

• Pennsylvania Department of Health licenses hospitals and ambulatory surgical facilities and sets retention rules through the Pennsylvania Code (Title 28).
• Pennsylvania State Board of Medicine licenses physicians and sets practice-level retention rules through the Pennsylvania Code (Title 49).
• HIPAA (federal), enforced by the U.S. Department of Health and Human Services, does not set a retention period for patient medical charts. It sets a 6-year retention period for a narrower category — the administrative documentation covered entities must keep to prove HIPAA compliance (policies, procedures, risk assessments, training logs).
• Medicare Conditions of Participation (CMS), which apply to hospitals and clinics that bill Medicare, set their own — generally shorter — federal retention floors.

These rules are not mutually exclusive. A hospital in Pennsylvania is bound by all of them simultaneously and must comply with whichever requirement demands the longest retention for a given record. In practice, that means the 7-year Pennsylvania state rule is the controlling number for actual patient charts, because it exceeds both the HIPAA documentation floor and the Medicare hospital floor.

Master Retention Table

Because Pennsylvania hospitals and ambulatory surgical facilities are also Medicare providers, and physicians are also HIPAA covered entities, the applicable rule for any given organization is the longest of the requirements that apply to it — in nearly every Pennsylvania case, that is the 7-year state rule.

Hospitals: The 7-Year Rule

Under 28 Pa. Code §115.23, Pennsylvania hospitals must keep medical records — whether original, reproduced, or microfilmed — on file for a minimum of 7 years following the discharge of a patient. This applies regardless of format: a scanned and properly indexed copy satisfies the requirement the same as a paper original.

The same section addresses what happens if a hospital ceases operations. The facility must notify the Department of Health of where records will be stored and keep them in a retrievable facility for at least 5 years post-closure. Before any records are destroyed, the facility must provide public notice — through a legal announcement and newspaper advertisement — giving former patients an opportunity to request their own records.

Ambulatory surgical facilities (ASFs) are held to a parallel standard under 28 Pa. Code §563.6: the same 7-year minimum for adult patients, the same minor-patient extension, and the same 5-year post-closure retrievability requirement.

Hospitals that participate in Medicare are simultaneously subject to 42 CFR §482.24(b), which sets a 5-year federal floor. Because Pennsylvania's 7-year state requirement is longer, it is the operative standard for Pennsylvania hospitals — the federal rule does not shorten the state obligation.

Physician Practices: 7 Years From the Last Entry

For individual physicians and physician practices, the controlling rule is 49 Pa. Code §16.95, issued by the Pennsylvania State Board of Medicine. It requires that a patient's medical record be retained for at least 7 years from the date of the last medical service for which a medical record entry is required — not 7 years from the date the patient last walked through the door, but from the last documented service.

This is a meaningfully different measuring point than the hospital rule, which counts from discharge. A physician practice needs to track the date of the last chart entry per patient, not simply a single facility-wide cutoff.

Rural health clinics and federally qualified health centers that participate in Medicare are also subject to 42 CFR §491.10(c), a 6-year federal floor measured from the date of last entry — shorter than, and superseded by, the 7-year Pennsylvania Board of Medicine requirement.

When a practice closes. The 7-year retention obligation does not end when a physician retires, sells, or closes a practice. A physician cannot simply abandon records. Acceptable options generally include transferring records to another physician or practice willing to maintain them, arranging secure third-party storage, or notifying patients and giving them a reasonable opportunity to obtain copies before the practice closes. Treat specific closure procedures and notice timelines as a matter for the Pennsylvania State Board of Medicine or legal counsel — this guide does not have a verified primary-source citation for a detailed closure notice procedure beyond the general retention duty in §16.95, and we are not going to guess at specifics that could expose a practice to a Board complaint.

Minors' Records: Two Different Rules, Not One

Pennsylvania's age of majority is 18. Both the hospital rule and the physician rule extend retention for minors' records beyond the standard period — but they extend it differently, and mixing them up is a common compliance error for organizations that operate both a hospital/ASF and affiliated physician practices.

Hospitals and ambulatory surgical facilities (28 Pa. Code §115.23 / §563.6): if the patient is a minor, records must be kept until the patient reaches majority, and then for 7 more years — or as long as the facility's adult patient records are maintained, whichever is longer. In practice, this generally means retention until roughly age 25.

Physician practices (49 Pa. Code §16.95): the rule is different — records for a minor patient must be kept until 1 year after the minor reaches majority, which is age 19. The regulation is explicit that this 1-year-past-majority rule controls even if it results in a shorter or longer retention period than the standard 7 years for that particular patient.

Because these are two distinct regulatory standards, a health system that includes both a hospital and employed physician practices should apply the correct rule to each record type rather than defaulting to a single organization-wide policy.

The #1 Confusion: HIPAA Does Not Set Chart Retention

The single most common misunderstanding in this area is the belief that "HIPAA requires providers to keep medical records for 6 years." That is not accurate, and it understates Pennsylvania's actual requirement.

45 CFR §164.316(b)(2)(i) requires covered entities to retain HIPAA-related documentation — policies, procedures, risk assessments, training records, and other materials showing the organization's compliance program — for 6 years from the date of creation, or from the date the document was last in effect, whichever is later.

That provision governs compliance paperwork, not the patient's medical chart. HIPAA itself does not specify how long a provider must keep a patient's actual clinical record. Chart retention in Pennsylvania is governed by state licensure regulations — the 7-year rules in 28 Pa. Code §115.23, §563.6, and 49 Pa. Code §16.95 — which are considerably longer than HIPAA's 6-year documentation floor and are the numbers that actually control how long a chart must be kept.

Organizations that stop at "6 years because HIPAA" are under-retaining patient charts relative to their Pennsylvania licensure obligations.

Digitization and Retention

Pennsylvania's hospital and ambulatory surgical facility regulations explicitly recognize reproduced and microfilmed records as valid for meeting the retention requirement: 28 Pa. Code §115.23 and §563.6 both state that records "whether original, reproductions or microfilm" must be kept on file for the required period. A properly scanned, indexed, and access-controlled digital record therefore satisfies the same 7-year (or minor-extended) retention obligation as a paper original — the regulation does not require the paper original to be preserved once a compliant reproduction exists.

What this guide can verify stops there. We have not located a Pennsylvania-specific primary-source standard spelling out chain-of-custody or format-integrity requirements for scanned medical records beyond that general "reproductions or microfilm" language, so we are not going to invent one. Reynolds' document scanning services apply standard information-governance practice — verifiable scan quality, audit trails, and access controls — as part of a broader records management program; organizations should confirm any additional specifics with the Department of Health or legal counsel.

One related point that is independently verifiable but outside this guide's medical-records scope: government-operated health facilities and other public bodies in Pennsylvania may also have obligations under the Pennsylvania Historical and Museum Commission (PHMC) records retention schedules that apply to public records generally. Where a healthcare organization is a government entity, its PHMC schedule and the medical-records-specific rules above should both be checked.