Answer 4 quick questions about any medical document and get a clear retention recommendation — based on IRS rules, Medicare requirements, and legal best practices.
| Document Type | Typical Retention | Authority |
|---|---|---|
| EOBs | 1–3 years | Best practice; match to provider bill cycle |
| Provider Bills | 3 years after payment | Statute of limitations (varies by state) |
| Payment Receipts | 3 years if tax-claimed | IRS limitation period; otherwise varies |
| HSA Receipts | Keep with your tax records | IRS Pub. 969 — substantiation test |
| FSA Receipts | Per your plan document | IRS Pub. 969 — FSA rules + plan doc |
| Denial / Appeal Letters | Duration of dispute + 3 years | Legal best practice |
| Good Faith Estimates | 3 years from service date | No Surprises Act — patient-provider dispute window |
| Prior Authorizations | 3 years from service | Insurance audit window |
The IRS can generally assess additional tax for up to 3 years after you file (6 years if you understate income by more than 25%). Supporting records should be kept until the period of limitations for that return runs out — usually 3 years, but 2 years from payment for refund/credit claims (whichever is later), 7 years for worthless securities or bad-debt claims, or indefinitely if you never filed or filed a fraudulent return. For HSAs, IRS Publication 969 requires records sufficient to show distributions were used exclusively for qualified medical expenses, were not previously paid or reimbursed from another source, and were not taken as an itemized deduction. FSA reimbursements follow your plan document, not an IRS receipt deadline. See IRS — How long should I keep records?
Most states allow medical malpractice claims within 1–3 years from the date of injury or discovery. Some states extend to 7 years for foreign objects or fraud. Keeping your records for at least 3 years after treatment preserves your legal options. If you have a complex or ongoing condition, consider keeping records for 7–10 years.
Medicare requires providers to retain records for 5 years from the date of service. While this requirement applies to providers (not patients), matching this window ensures you have documentation if your provider's records are questioned. Private insurers typically have a 2–3 year audit window.
If you receive a bill that's at least $400 more than your Good Faith Estimate, you have 120 days to initiate a patient-provider dispute. Keep your GFE for at least 3 years from the service date — this covers the dispute window plus the resolution timeline.
EOBVault helps you organize EOBs, bills, and payment receipts in one place. Scan, categorize, and track every medical expense — no account, no cloud.
Try EOBVault Free →Need encrypted backup, attachments, or household views? EOBVault Pro — $9 one-time →