August 28, 2026
3:48 am

How Long Your Medical Information Is Kept

There is no single retention clock. Your hospital chart, your pharmacy history, your insurance underwriting file and the file a life settlement provider builds about you are four separate records, kept by four different organizations, for four different lengths of time — and only some of them are yours to see or correct. If you have just signed a medical release, or you are about to, that distinction is the whole game.

Most people arrive at this question in one of two moods. Either something in a file was wrong and cost them something — a declined application, an underwriting rating, a surprise question at a claim — or they are being asked to sign an authorization and suddenly want to know where the paper goes and how long it stays there. Both are reasonable. Neither is answered by the vague line on the form that says records may be retained "as required by law."

What follows is organized by clock. First the things worth doing in the next 72 hours, because two of them are time-limited. Then the first month, because that is how long a records request and a file dispute realistically take. Figures and rules below are current as of 2026 and each one names who to confirm it with, because retention schedules change when state law changes.

In This Article

Hour 0 to 72: Get Your Own Copies Before Anyone Else Does
What HIPAA Actually Says About Retention (It Is Less Than You Think)
The Underwriting File Is a Different Animal
Days 4 to 30: Request an Accounting and Read the Authorization Line by Line
Where an In-Force Life Insurance Policy Fits Here
The Errors That Actually Show Up, and How to Get Them Out
A Realistic Timeline and What It Costs
Frequently Asked Questions

How Long Your Medical Information Is Kept

Hour 0 to 72: Get Your Own Copies Before Anyone Else Does

Three requests should go out in the first three days, and they are free or nearly free.

1. Turn on the patient portal at every treating facility. Under the information blocking rules issued by the federal Office of the National Coordinator for Health IT (now ASTP/ONC) under the 21st Century Cures Act, electronic health information generally has to be made available to you without unreasonable delay. In practice that means portal access to notes, labs and imaging reports at no charge, usually the same day. This is faster and cheaper than any paper request.

2. Order your MIB file. MIB Group maintains coded underwriting information reported by member life, health, disability and long-term care insurers. MIB is a consumer reporting agency under the Fair Credit Reporting Act, so you are entitled to a free disclosure of your own file, and MIB has long stated that a record stays in its system for seven years from the date it was reported. Request it directly from MIB, not through a third party. Our page on what an MIB report contains explains how to read the codes when it arrives.

3. Write down exactly what you have already signed. Pull every authorization from the last two years, and for each one note the date, the recipient, what it covers, and its expiration date. A HIPAA authorization is only valid for the scope and period printed on it, and you have the right to revoke it in writing at any time — though revocation does not claw back what was already disclosed.

What HIPAA Actually Says About Retention (It Is Less Than You Think)

This is the single most misunderstood point on the subject. The HIPAA Privacy Rule does not set a retention period for your medical record. It sets a six-year retention period for HIPAA’s own paperwork — policies, notices, and signed authorizations — under the administrative requirements at 45 CFR 164.530. How long the clinical chart itself is kept is a matter of state law and Medicare participation rules.

Two federal anchors are worth knowing. The Medicare hospital Conditions of Participation at 42 CFR Part 482 require participating hospitals to retain medical records in retrievable form for at least five years. Critical access hospitals are held to six. Medicare Advantage and Part D contractors work on a ten-year records schedule. State law then layers on top, and state minimums for adult records commonly land in the six-to-ten-year range measured from the last date of treatment, with longer periods for minors. Confirm your own state’s period with the state health department or the board that licenses the provider — do not assume the number from a neighboring state applies.

The practical consequence: a record from 1998 may simply not exist any more, and that is not a conspiracy. If you are trying to document a long-ago diagnosis, the treating physician’s office is usually the first thing to disappear and the hospital the last.

The Underwriting File Is a Different Animal

When you apply for insurance, or when a life settlement provider evaluates a policy, a second file gets built. It is assembled from records the carrier or provider requests using your signed authorization, and it is retained on the requester’s schedule, not the hospital’s.

Three components usually show up. The attending physician statement — the summary a doctor’s office prepares in response to a request. The prescription history pulled from a pharmacy benefit data aggregator, which typically reaches back five to ten years and is the fastest way an underwriter learns about a condition you forgot to mention. And the MIB coded report described above.

Carriers generally retain underwriting files for the life of the policy plus a period after termination set by state insurance record retention rules — often several years past the contract’s end. Ask the carrier’s privacy officer in writing for its retention schedule; a company that will not answer that question in writing is telling you something.

If a life settlement is under consideration, the file also includes any life expectancy reports commissioned on you. Those are ordered from specialist underwriting firms, are typically treated as stale after roughly six to twelve months, and are shared with prospective purchasers. Understand that before you sign — see how the medical release works in a settlement.

Record type	Who holds it	Typical retention	Confirm with
Hospital chart	Hospital	At least 5 years under Medicare rules at 42 CFR Part 482; state law often 6-10 years	State health department
Physician office chart	Practice or its successor	Set by state law; commonly 6-10 years from last treatment	State licensing board
HIPAA paperwork (authorizations, notices)	Covered entity	6 years under 45 CFR 164.530	The provider’s privacy officer
MIB coded report	MIB Group	7 years from the date reported	MIB directly; free FCRA disclosure
Carrier underwriting file	Insurer	Policy life plus a state-set period	Carrier privacy officer, in writing
Life expectancy report	LE firm and provider	Treated as stale after roughly 6-12 months	The provider, before you sign

The Underwriting File Is a Different Animal

Days 4 to 30: Request an Accounting and Read the Authorization Line by Line

Two rights are worth exercising in the first month.

The right of access. Under 45 CFR 164.524, a covered entity generally must act on your request for your records within 30 days, with one 30-day extension available if it notifies you in writing. Fees have to be reasonable and cost-based; the flat-fee shortcut that used to apply to third-party directives was struck down in federal litigation in 2020, so what you are charged now depends on your state’s cap and the format you request. Electronic copies through a portal are usually free. If you are getting stonewalled, the complaint route is the HHS Office for Civil Rights, and there is a filing deadline — generally 180 days from when you knew of the problem.

The right to an accounting of disclosures. Also under the Privacy Rule, you can ask a provider for a list of certain disclosures it made of your information, going back up to six years. It excludes disclosures you authorized and disclosures for treatment, payment or operations, so it will not show the life insurer you signed a release for — but it will show subpoenas, public health reporting and research disclosures you never heard about.

While you wait, read the authorization you are being asked to sign against four questions: what categories of information does it release, to whom, for what purpose, and on what date does it expire. If any of those four is open-ended, ask for it to be narrowed. Our explainer on what a HIPAA authorization covers goes through the required elements.

Where an In-Force Life Insurance Policy Fits Here

Honestly: for most people asking this question, the policy is not the point, and the right answer is to leave it alone. Medical record retention is a privacy and accuracy problem, not a cash flow problem. Selling a policy will not delete a file.

There are two narrow places the policy genuinely intersects. First, if you are considering a settlement, signing the medical authorization is the step that creates a new copy of your records in a new organization’s hands, and you should understand the confidentiality terms before you sign rather than after. State viatical and life settlement laws built on the NAIC model act impose confidentiality duties on providers and brokers and restrict onward disclosure of an insured’s identity and health information; ask for those terms in writing. What happens to your information after a closing is covered in privacy after a policy is sold.

Second, if an error in your records has been suppressing your policy’s valuation — a diagnosis that was ruled out, a medication you no longer take, a hospitalization coded to the wrong person — correcting the record can matter financially. That is a reason to fix the file first and only then ask what the policy is worth.

Selling is the wrong move if the face amount is small, if the policy is a burial policy already sheltered from a benefits asset test, if the insured is in good health for their age, or if a surviving spouse is counting on the death benefit. In those cases a records cleanup is worth doing on its own merits and the policy should stay exactly where it is.

The Errors That Actually Show Up, and How to Get Them Out

Four patterns account for most of what people find.

Wrong-patient merges. Two patients with similar names and dates of birth get their charts blended. This is the most damaging error and the hardest to unwind, because the bad data propagates into every downstream copy.

Rule-out diagnoses recorded as diagnoses. A physician orders a test to exclude a condition; the working code stays in the chart forever and reads as a confirmed condition to an underwriter years later.

Stale medication lists. A drug discontinued in 2019 still appears in the pharmacy history an underwriter buys in 2026.

Coded MIB entries you never saw. These come from prior insurance applications, not from treatment.

For a provider record, HIPAA gives you the right to request an amendment, and the provider generally has 60 days to respond, with a 30-day extension. If it refuses, you can file a written statement of disagreement that must travel with the record. For an MIB entry, the dispute process runs through the Fair Credit Reporting Act, which gives the reporting agency a defined investigation window — typically 30 days. Send everything certified mail and keep the receipts.

A Realistic Timeline and What It Costs

Set expectations before you start. Portal access: same day to a week. A written records request to a hospital release-of-information department, often outsourced to a copy service: two to six weeks in practice, inside the 30-day rule only some of the time. Fees vary widely by state, from free for an electronic copy to per-page charges that can run to $50 or more for a thick chart — as of 2026, ask for the fee schedule in writing before you authorize the copy, and ask specifically for the electronic format, which is usually the cheapest.

An MIB disclosure typically arrives within a few weeks of the request. An amendment fight takes 60 to 90 days. A settlement file’s medical retrieval — the step families are usually surprised by — commonly runs two to six weeks and is the leading cause of delay in the whole process.

If your reason for asking is that a policy decision is pending, get the record situation squared away first. To have a policy looked at once your file is in order, send the policy cover page for a free review or call (732) 978-9575. Nothing in this page is legal or medical advice; for a records dispute with real stakes, an attorney who handles health privacy matters or your state’s health department is the right next call.

Frequently Asked Questions

Does HIPAA say how long my doctor must keep my records?

No. That is the most common misconception. HIPAA requires six-year retention of its own documentation, such as signed authorizations and privacy policies, under 45 CFR 164.530. The clinical chart itself is governed by state law and by Medicare participation rules, which set at least five years for participating hospitals. Confirm your state’s period with the state health department.

How long does MIB keep information about me?

MIB has long stated that a coded record remains in its system for seven years from the date it was reported by a member insurer. Because MIB is a consumer reporting agency under the Fair Credit Reporting Act, you can request your own file free of charge and dispute anything inaccurate. Order it from MIB directly rather than a paid intermediary.

Can I take back a medical authorization I already signed?

You can revoke a HIPAA authorization in writing at any time, but revocation works going forward only. Anything already disclosed in reliance on the authorization stays disclosed and cannot be recalled. That is why the time to narrow the scope and the expiration date is before signing, not after. Send the revocation certified mail and keep proof of delivery.

What does a life settlement provider do with my medical records?

It orders records under your signed authorization, has a life expectancy firm review them, and shares the underwriting package with prospective purchasers. State laws modeled on the NAIC viatical and life settlement act impose confidentiality duties and restrict onward disclosure of your identity and health details. Ask for those terms in writing before you authorize anything.

How much can a hospital charge me for my own records?

Fees must be reasonable and cost-based, and states cap them differently. Electronic copies through a patient portal are usually free, which is why that request should go first. Paper copies of a thick chart can run into the tens of dollars or more. As of 2026, ask for the written fee schedule and request electronic format before you authorize the copy.

Something in my record is wrong. What is the actual process?

For a provider record, submit a written amendment request; the provider generally has 60 days to respond, with one 30-day extension, and if it refuses you may file a statement of disagreement that must accompany the record. For an MIB entry, dispute through the Fair Credit Reporting Act process. Keep certified mail receipts for both.

Find out what your policy is worth — free, confidential, no obligation.

A 15-minute educational review covers your eligibility, every alternative, and a realistic view of what each path would net you.

Call (732) 978-9575 · Request a review online →

Table of Contents