How Long Should a Clinic Keep Patient Records?

Keep patient records for at least three years from the day treatment starts. Keep them for much longer, until the matter is fully closed, for any case that could become medico-legal.

That is the short answer. The rest of this post explains where the three-year figure comes from, when three years is not enough, what a patient can ask you for, and how the DPDP Act fits in. DPDP means the Digital Personal Data Protection Act, 2023. It is India's law on handling personal data. This is a plain summary to help you write a clinic policy. It is not legal advice. For an actual notice or dispute, speak to your own lawyer.

Why record keeping is your own protection

Most doctors think of records as a duty to someone else. They are also your defence. Two years after a visit, nobody remembers what was said in the room. The record is the only version that survives.

When a complaint comes, three things decide how it goes:

• What you wrote at the time of the visit.
• Whether the note is complete. The complaint, your findings, the diagnosis, what you advised, the medicines with dosage, and the follow-up date.
• Whether you can produce it quickly, and in order.

A note that reads "fever, PCM, review SOS" is not a defence. A note that shows what you asked, what you found, what you ruled out, and what you warned the patient about, is. This is the real reason to care about record keeping. Not the rule. The protection.

What the medical council rules expect

The ethics regulations for doctors in India, the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, set out a few plain duties on records:

• Keep the records of your in-patients for three years from the date treatment began.
• If a patient, their authorised attendant, or a legal authority asks for the records, acknowledge the request and give the documents within 72 hours.
• Keep a register of the medical certificates you issue, with the identification details of the person.

Two things to note. First, the three-year duty is written for in-patient records. There is no shorter period for OPD, which means the outpatient department, your normal daily clinic. And there is no sensible reason to keep less, because OPD is where most complaints begin. Second, your state may ask for more. Where a state has adopted the Clinical Establishments Act, registration conditions can carry their own record requirements. So treat three years as the floor, not the target.

Medico-legal cases need longer

Some records should never be cleared at the three-year mark:

• Any case where a complaint, a legal notice, or a police enquiry has already arrived. Keep everything until the matter is finally over, including appeals.
• Injury, assault, poisoning, burns, road accidents, and any death. These are the cases that turn into police or court matters months later.
• Cases involving a child. A person's own time limit to go to court generally starts when they turn eighteen. So a paediatric record can be needed many years after the visit.
• Records that have their own law. Termination of pregnancy records, and records under the PCPNDT Act, which is the law on prenatal sex determination, come with their own rules on the forms and registers you must preserve. Follow those rules as written.

Here is the reasoning behind keeping longer. A consumer complaint can be filed within two years of the cause of action. Most ordinary civil claims carry a limit of about three years. But a court can accept a late filing, and the clock does not always start on the day of the visit. Storing a digital record for ten years costs you almost nothing. Not having one on the day a notice arrives costs you a great deal.

Records a patient can ask for

Patients have a clear right to a copy of their own records. Make it a simple, unemotional process:

• Give a copy. Keep your own master record.
• Acknowledge the request, and write down the date you handed the copy over.
• Include what you generated. Consultation notes, prescriptions, discharge summary, reports in your possession, and the bill.
• Do not delay. The 72-hour limit exists for a reason.

A delay is often what turns an unhappy patient into a formal complainant. Handing over records calmly, on the same day, usually ends the matter there.

What the DPDP Act adds

The DPDP Act looks at the same records from the patient's side. It is built on a few ideas. Take data with consent and for a clear purpose. Collect only what the visit needs. Let the patient see and correct their data. And do not keep personal data after the purpose is over, unless a law requires you to keep it.

That last point is the one clinics worry about. Medical retention rules are exactly the kind of legal requirement the Act allows for. So DPDP does not ask you to delete a record you are obliged to keep.

What it does add is discipline around the record:

• Do not collect details you never needed in the first place.
• Limit who can open a clinical record. The front desk does not need the note.
• Be able to show who opened a record and when.
• Answer access and correction requests instead of ignoring them.

For more on this, see what the DPDP Act means for clinics and how Clyno handles data protection.

Paper files against digital records

No rule says your records must be on paper. A digital record is a record. But the two behave very differently when you actually need one.

• Paper fades, gets misfiled, and does not survive a leaking roof. One missing file is one missing defence.
• Paper has one copy. A digital record can be backed up.
• A digital record can be found in seconds, years later, by name or phone number.
• A digital system can show who wrote each entry and when. A paper file cannot prove that.

An EMR is what makes this practical. EMR means Electronic Medical Record. It is your clinic's digital file for each patient, holding their history, visits, and prescriptions in one place. One warning if you move across. Do not run half paper and half digital. A digital note with the vitals on a loose slip means neither record is complete. Move a whole step at a time, as described in this guide to going paperless, and let the EMR hold the full visit.

The other quiet benefit is completeness. Records get thin when writing them is slow. When the note is written for you as you speak, by an AI medical scribe, the record tends to hold the detail that a rushed handwritten note leaves out. You still read and approve every line.

A simple record policy for a small clinic

One page is enough. Anything longer will not be followed:

1. 1Keep every patient record for a minimum of three years from the start of treatment. The default is keep, never clear.
2. 2Mark medico-legal visits at the time of the visit. Injury, poisoning, assault, accident, death, or any case where a notice has come. Those records are never deleted.
3. 3Keep records of children well past three years.
4. 4Write the note during the visit, not at night from memory.
5. 5Write down consent and the warnings you gave. These are the lines that matter most later.
6. 6Decide who can open what. Give each staff member only the access their work needs.
7. 7Answer a records request within 72 hours, and note the date it was given.

“A record you cannot find is the same as a record you never made.

In short

• Three years from the start of treatment is the minimum for ordinary records.
• Medico-legal cases, paediatric cases, and anything already disputed should be kept until the matter is finally closed, and longer.
• A patient can ask for their records, and you should hand them over within 72 hours.
• The DPDP Act allows you to keep what the law requires. It asks you to limit access and to honour patient requests.
• Digital records remove the practical excuses. Nothing is lost, nothing fades, and everything is searchable.

If your records are still in a cupboard, the easiest way to judge a digital record is to make a few and see how they read. The free trial takes a mobile number and a one-time code, with no card, and runs for seven days. Use it for one afternoon of real patients and look at the notes it produces.