4 Medical image retention determines how long every CT, MRI, X-ray, ultrasound and mammogram stays in the hospital archive, and therefore how large that archive becomes. Retention rules come from several overlapping sources: federal regulations, state laws, accreditation standards, professional guidance and the hospital’s own policies. The longest applicable requirement usually wins, and for some patients and study types that means decades. This article explains the main sources of medical image retention requirements in the United States, how hospitals typically structure retention policies, how retention differs internationally and what it all means for imaging storage. It is general information, not legal advice; hospitals should confirm requirements with counsel and their health information management team. For the storage architecture behind imaging archives, see our hub on PACS and VNA storage. Federal minimums in the United States Several federal rules set floors for hospitals in the US: Medicare Conditions of Participation. Hospitals participating in Medicare must retain medical records in their original or legally reproduced form for at least five years (42 CFR 482.24). For radiologic services, the regulations require copies of reports and printouts, and films, scans and other image records as appropriate, to be kept for at least five years (42 CFR 482.26). Mammography Quality Standards Act (MQSA). FDA regulations require facilities to keep original mammograms and reports for the longest of: at least five years; at least ten years if no additional mammograms of the patient are performed at the facility; or any longer period required by state or local law (21 CFR 900.12). HIPAA. HIPAA does not set retention periods for medical records or images. It governs privacy and security while the data is held, and it requires certain compliance documentation to be kept for six years, which is often confused with a medical record rule. Federal rules are minimums. State laws frequently require longer periods. State laws Most states set their own retention requirements for hospital records, and many apply them to imaging. Common patterns include: A fixed number of years after the last patient encounter or discharge for adults, often in the range of five to ten years. For minors, retention until the patient reaches the age of majority plus a number of years, which can extend retention well into adulthood. Specific rules for certain record types, such as mammography, which may exceed federal minimums. Longer periods for records related to certain conditions or procedures. Because requirements vary so widely, multi-state health systems often adopt a single policy that meets the strictest applicable rule, simplifying operations at the cost of more storage. Other drivers of longer retention Beyond statutes, several factors push hospitals to keep images longer: Statutes of limitations for malpractice claims, especially for minors, where the limitation period may not begin until the patient reaches adulthood. Clinical value of priors. Comparison with earlier studies is central to radiology. Many radiologists want access to older images, particularly for oncology follow-up and screening. Research and teaching, where de-identified image sets may be retained under separate governance. Litigation holds, which suspend deletion for specific patients or studies. Institutional caution, where the absence of a deletion process results in de facto permanent retention. How hospitals structure image retention policies A typical policy groups imaging into categories, each with a defined period: Adult diagnostic imaging: a fixed number of years after the study or last encounter. Pediatric imaging: until the patient reaches a defined age, plus a number of years. Mammography: per MQSA and state law, often longer when priors support ongoing screening. Studies under legal hold: retained until the hold is released. Research and teaching collections: governed separately. Policies should also address non-DICOM content, such as photos and video, which is increasingly stored in enterprise imaging archives, and outside studies imported from other facilities. International examples Retention requirements outside the US differ by country and sometimes by region: Many European countries set retention through national health record laws, with periods ranging from several years to decades, and GDPR requires that personal data not be kept longer than necessary for its purpose. National health services often publish records management codes of practice with recommended retention for imaging and reports. Cross-border health systems must reconcile different national rules and data residency requirements. Health systems operating in multiple countries usually maintain retention schedules per jurisdiction rather than a single global rule. What retention means for imaging storage Retention policy is the single largest driver of archive size. If most images are retained for many years and pediatric images for decades, the archive grows almost every year with very little leaving it. Storage implications include: Capacity planning must account for accumulation, not just new data. Long-lived platforms: images will outlive several hardware generations, so storage that refreshes in place without migration reduces risk and cost. Integrity over time: images must remain bit-for-bit intact for decades, which requires checksums and periodic verification. Retention enforcement: immutable storage can prevent premature deletion, protecting against mistakes and ransomware. Defensible deletion: at the end of retention, images should be deleted on schedule with records of what was removed. data deletion verification explains how to evidence it. Retention after mergers and system changes Retention gets more complicated when hospitals merge, affiliate or replace systems. An acquired hospital may bring an archive kept under a different state’s rules, a different policy or no policy at all. Images migrated from a retired PACS may arrive without reliable metadata about patient age or study type, making it hard to calculate expiry dates. Before consolidating archives, it is worth agreeing how inherited images will be classified and which policy applies to them. Recording the source system and original acquisition date for every migrated study preserves the information needed to apply retention correctly later. Outside images present a similar challenge. Studies imported from other facilities for comparison or second opinions may be retained under the receiving hospital’s policy, or may be treated as reference copies with shorter retention. Either way, the policy should say so explicitly, since outside studies can account for a meaningful share of archive growth. Why many hospitals never delete images Despite clear retention periods, many hospitals have never deleted an image. Common reasons include PACS that lack automated deletion, uncertainty about which rule applies to each study, concern about malpractice exposure and the simple fact that keeping data has seemed cheaper than deciding what to remove. As archives reach petabyte scale, that calculation changes. A defensible, automated deletion process can reclaim substantial capacity, though it must be designed with clinical, legal and health information management input. The cost picture is covered in the cost of health data retention. Building a retention program for imaging Inventory all imaging archives, including departmental systems and non-DICOM content. Map each study type and patient group to the longest applicable rule. Have the policy reviewed by counsel, health information management and clinical leadership. Implement retention metadata in the VNA or PACS so each study has an expiry date. Use immutability to protect studies during their retention period. Support legal holds that override expiry. Automate deletion at the end of retention, with logs. Review the policy when laws, services or affiliations change. Checklist: medical image retention and storage Confirm federal, state and accreditation requirements for each study type. Apply pediatric and mammography rules carefully. Choose a single strictest-rule policy or per-jurisdiction schedules. Model archive growth with retention included. Ensure storage verifies integrity over decades. Protect retained images with immutable copies. Implement defensible deletion with records. Plan for storage that refreshes hardware without migrating images. Putting it together Medical image retention is set by a mix of federal minimums, state laws, clinical practice and legal caution. In the US, five years is a common federal floor, mammography has its own rules and state laws often extend retention, especially for minors. Because images may be kept for decades, the storage platform has to scale, preserve integrity, enforce retention and eventually delete on schedule. Treat retention as a design input for imaging storage, not an afterthought. Frequently asked questions How long do hospitals have to keep X-rays and scans? In the US, Medicare Conditions of Participation require at least five years, and many state laws require longer, especially for minors. Hospitals often adopt the strictest applicable rule. How long must mammograms be kept? Under MQSA regulations, at least five years, or ten years if no further mammograms of the patient are performed at the facility, or longer if state or local law requires. Does HIPAA require medical images to be kept for a certain time? No. HIPAA governs privacy and security of health information but does not set retention periods for medical records or images. Why are pediatric images kept longer? Many state laws and malpractice statutes of limitations run until the patient reaches adulthood plus a number of years. Can hospitals delete old medical images? Yes, once all applicable retention periods have passed and no legal hold applies. Deletion should follow an approved policy and be logged. Further reading PACS and VNA storage Medical imaging storage growth PACS vs VNA storage PACS on S3 object storage The cost of health data retention
