In short: records are kept as long as they are needed for care and to meet legal duties, then archived or
disposed of securely. Each facility sets its own periods within the law and professional guidance.
1. Principles
- Keep personal data no longer than necessary for the purpose it was collected for.
- Keep medical records long enough to support continuing care, protect patients and meet legal and professional requirements.
- Dispose of data securely so it cannot be reconstructed.
2. Who decides
Each facility, as data controller, sets its retention schedule, following applicable law and guidance from the Ministry of Health and the relevant professional councils. GomoClinic supports this through its Records Filing & Retention tools, which record where each patient file is held and the date it may be retained until.
3. Typical categories
| Record | Kept for |
|---|---|
| Adult medical records | The period set by the facility's schedule, counted from the last episode of care. |
| Children's and maternity records | Longer periods, usually until the child reaches adulthood plus the adult period. |
| Financial records (bills, receipts, ledgers) | As required by tax and accounting law. |
| Staff and payroll records | As required by employment and tax law after employment ends. |
| Audit trail | At least as long as the records it relates to. |
4. In the system
- Clinical and financial transactions are corrected through tracked voids, reversals and amendments rather than deleted, so the history stays intact. The few items that can be deleted (such as drafts or a mistyped allergy) are written to the audit trail with their previous content.
- Users who leave are deactivated rather than deleted, so their past actions remain attributable.
- Duplicate patient records are merged, not deleted, and the merge is logged.
5. Secure disposal
When records reach the end of their retention period, electronic copies are permanently erased and paper records are shredded or incinerated under supervision. Disposal of whole sets of records is approved by the facility and documented.