Here is a website that has state by state patient record retention from HealthIT.gov: http://www.healthit.gov/sites/default/files/appa7-1.pdf, from Privacy and Security Solutions for Interoperable Health Information Exchange: Report on State Medical Record Access Laws (August 2009). State laws can be preempted by HIPAA, if they are contrary to HIPAA or less protective.
HealthIT.gov maintains a file of record retention rules by state. Generally speaking, there are different retention periods for different types of health care providers (e.g., physicians and hospitals), and different periods depending on whether the patient is an adult or child, with a child’s record required to be retained for a certain number of years following discharge/last date of contact, or until the child reaches a certain age, whichever period is longer. For example, Alaska requires a record to be maintained by a hospital for seven years following discharge of the patient, or until age 21 for a patient under the age of 19, whichever is longer. As previously noted, some states impose different retention periods for physicians and hospitals. Connecticut requires physicians to maintain the record for 7 years from the last date of treatment, or, upon the death of the patient, for 3 years; whereas hospitals must maintain the record for a minimum of 10 years after the patient has been discharged. In Florida, it is a period of at least 5 years from the last patient contact for physicians and 7 years after the last record entry for hospitals. Many states, including Alaska, Arkansas, California, Colorado, Idaho, Illinois, Kentucky, Maine, Minnesota, Mississippi, Montana, Nebraska, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Utah, Vermont, Washington, West Virginia and Wyoming do not have specific retention periods for physicians in their statutes. In some of these states, state medical boards or state medical societies may set the standard or provide guidance. General statute of limitations provisions may also impact the holding period and should be considered by all health care providers, even those licensed in a state that sets a minimum retention period by statute.