Each state has medical records retention periods that typically range from 6-10 years. No matter what the retention is, all records that reach the end of their period must comply with HIPAA and be thoroughly destroyed.