In Massachusetts, how long medical records are kept depends on who treated you. Physicians in private and outpatient practice must keep patient records for at least seven years from the date of your last visit. Hospitals and clinics licensed by the Department of Public Health, along with facilities licensed by the Department of Mental Health, must keep treatment records for 30 years after discharge or final treatment.1Mass.gov. Medical Records Obligations
Those two numbers cover most situations, but the clock works differently for children, keeps running after a doctor retires, and interacts with federal rules in ways worth knowing before you assume your records are still on file.
The Seven-Year Rule for Physicians
Every physician licensed in Massachusetts must retain patient records for a minimum of seven years, measured from the last patient encounter. The requirement applies to all licensees regardless of current status, which means it also covers physicians who have retired, allowed their licenses to lapse, or had their licenses suspended or revoked.1Mass.gov. Medical Records Obligations A doctor cannot shed the obligation by closing shop.
The seven-year floor is a minimum, not a maximum. Nothing prevents a provider from keeping records longer, and many do because of malpractice exposure, billing audits, or the practical reality that older records sometimes matter to ongoing care.
The 30-Year Rule for Hospitals and Clinics
Facilities are held to a much longer standard. Hospitals and clinics licensed by the Department of Public Health must retain treatment records, including medical histories and nursing notes, for 30 years following discharge or final treatment. Department of Mental Health facilities follow the same 30-year minimum, measured from discharge or last patient contact.
The gap between seven years and 30 years matters if you received care in more than one setting. Records from an inpatient hospital stay in 2000 should still exist today; records from the primary care physician who admitted you may not. Providers who operate across both settings, such as a physician group affiliated with a hospital system, need to track each requirement separately, and patients should not assume one part of their history guarantees the other.
Pediatric Records
For children, the retention period is the longer of two alternatives: seven years from the last patient encounter, or until the child turns 18.1Mass.gov. Medical Records Obligations Whichever runs longer controls.
A child last seen at age 5 has records kept until age 18, because that stretches beyond seven years from the visit. A teenager last seen at age 16 has records kept until age 23, because seven years from the visit runs past the age-18 cutoff. The common shorthand that pediatric records survive “until age 25” overstates the rule in most cases. If you are a young adult trying to reconstruct your childhood medical history, do it before the seven-year clock from your last pediatric visit runs out.
What Happens When a Doctor Retires or Closes the Practice
A retiring physician, or their successor, must continue to maintain patient records for the full seven-year period measured from your last visit.1Mass.gov. Medical Records Obligations The retention duty does not vanish when the office closes.
In practice, retiring physicians often transfer records to another provider, a records-storage service, or a purchasing practice. If you receive a letter that your doctor is retiring or the practice is closing, treat it as a prompt: request a copy of your records for your own files, or confirm in writing where they will be held and how to reach them later. Once the retention period expires and records are destroyed, there is no way to recover them.
How HIPAA Fits In
HIPAA does not set a retention period for medical records. The federal Privacy Rule requires providers to protect health information for as long as they hold it, but the question of how long to hold it is left entirely to state law.2HHS.gov. Does the HIPAA Privacy Rule Require Covered Entities to Keep Patients Medical Records for Any Period of Time In Massachusetts, that means the seven-year and 30-year state minimums are what actually control.
Getting Your Records Before Time Runs Out
Massachusetts law gives every patient the right to inspect their medical records and receive copies.3General Court of Massachusetts. Massachusetts General Laws Chapter 111 Section 70E You do not need to explain why you want them, and a provider cannot refuse because you have an outstanding balance. Under Board of Registration regulations, providers must respond in a timely manner.
Timelines
For records requested to support a claim under the Social Security Act or any federal or state needs-based benefit program, the provider must furnish them within 30 days and cannot charge a fee.4Mass.gov. Mass General Laws c111 Section 70E You will need to present reasonable documentation showing the request supports such a claim. For all other requests, HIPAA’s general standard applies: the provider must act within 30 days, with one possible 30-day extension if you are notified of the delay in writing.
What You Can Be Charged
When you request your own records as a patient, HIPAA limits the provider to a reasonable, cost-based charge covering labor for copying, supplies, and postage. Search-and-retrieval fees are not allowed. If your records are maintained electronically and you request an electronic copy, the provider can charge a flat fee of no more than $6.50, which must cover all labor, supplies, and postage.5HHS.gov. Clarification of Permissible Fees for HIPAA Right of Access
Higher per-page rates you may see quoted, such as $0.96 per page with a base administrative charge, apply to third-party requests from attorneys or insurers, not to patients requesting their own records. If a provider quotes you a fee closer to the third-party schedule, reference the HIPAA right-of-access rules and push back.
X-rays and similar imaging that cannot be reproduced by ordinary photocopying may be charged at the provider’s actual cost, which can be substantially higher. Ask upfront what that cost will be.
Records of a Deceased Family Member
The retention rules keep records alive after the patient dies, and access rules control who can see them. Under HIPAA, a personal representative of a deceased patient, typically the executor or administrator of the estate, can exercise the same access rights the patient would have had, for up to 50 years after death.6HHS.gov. Health Information of Deceased Individuals Family members who were involved in the patient’s care or in payment for care may also receive limited disclosures, unless the patient previously expressed a preference against it.
Massachusetts is stricter for certain records. To obtain a deceased person’s Department of Mental Health records, you must be a court-appointed personal representative of the estate or have a court order. A voluntary administrator does not have sufficient authority, and until a valid court order or personal representative authorization is on file, the Department will not even confirm whether records exist.7Mass.gov. I Am Seeking DMH Medical Records of a Deceased Family Member Bring a certified copy of the death certificate and your court-issued letters of appointment when you make the request.
What Happens After the Retention Period Ends
Once the seven-year or 30-year period expires, records can be destroyed, and providers who choose to destroy them must do so properly. Paper records should be cross-cut shredded or pulverized. Electronic storage should be wiped using validated overwriting tools, degaussed, or physically destroyed. Providers should document the date and method of destruction, a description of what was destroyed, and the identity of the person who supervised the process. Improper disposal can trigger the same breach-notification obligations and penalties as any other unauthorized disclosure of health information.
For you as a patient, the destruction rules are the practical reason the retention clock matters. A record that existed last month may not exist next month if the minimum period has run. If you think you might ever need documentation of a past visit, diagnosis, or procedure, request a copy while the record is still required to be on file.