Record-keeping retention rules for Australian healthcare practices

Ask a practice manager how long they need to keep a patient’s health records and you will often get a number plucked from memory — seven years, ten years, forever. The real answer is more nuanced and depends on the type of record, the age of the patient at the time of treatment, and the jurisdiction in which your practice operates. Getting it wrong in either direction — destroying records too early or hoarding records indefinitely without a destruction protocol — carries its own risks. This guide sets out the framework that applies to Australian private healthcare practices and gives you the building blocks of a defensible retention policy.

Why retention rules matter beyond the obvious

Healthcare practices accumulate records across multiple categories: clinical notes, diagnostic images, pathology results, prescription records, consent forms, referral letters, accounts and billing records, employee files, and insurance documents. Each category may be governed by different legislation, professional standards, and limitation periods for legal claims.

Retaining records beyond their required period is not automatically safe. Unnecessary retention increases your exposure under the Privacy Act 1988 — APP 11.2 requires entities to take reasonable steps to destroy or de-identify personal information that is no longer needed for any purpose. Retaining data you no longer need creates storage costs, increases your cyber security attack surface, and complicates a data breach response. A documented retention schedule with a regular destruction protocol is therefore as important as the retention rules themselves.

The patchwork of Australian retention law

There is no single Commonwealth statute governing health record retention for private practices. The obligations come from multiple sources:

• State and territory health records legislation — each jurisdiction has its own rules. For example, in Victoria the Health Records Act 2001 sets minimum retention periods; in New South Wales the Health Records and Information Privacy Act 2002 and associated guidelines apply; Queensland’s Hospital and Health Boards Act 2011 covers public sector records, while private practices follow professional standards.
• Professional registration standards — bodies such as the Medical Board of Australia, Nursing and Midwifery Board, and Australian Health Practitioner Regulation Agency (AHPRA) publish retention guidance as part of their professional standards. These are not legislation but can be treated as the professional baseline.
• The Limitation Acts in each state and territory set the period within which a patient may bring a claim for negligence. Because records are your primary defence, retaining them at least until the limitation period has expired is essential. For adults, this is generally six years from the date the cause of action arose; for minors, time does not start running until they turn 18.
• Commonwealth tax and employment records — the Australian Taxation Office requires business records relevant to tax obligations to be retained for five years; the Fair Work Act 2009 requires employee records to be kept for seven years.

The critical rule for records of minors

For patients who were minors at the time of treatment, retention periods are measured from the date the patient turns 18, not the date of treatment. A child treated at age three must have their records retained at least until they turn 25 in most jurisdictions — effectively a minimum of 22 years from the date of treatment. This rule catches many practices off guard when they are purging old files. Any record destruction workflow must cross-check the patient’s date of birth, not just the date of last service.

A practical retention schedule for common record types

The following is a general guide based on professional standards and state legislation. It is not a substitute for jurisdiction-specific legal advice, and practices in regulated areas such as mental health or assisted reproduction should verify applicable rules with their registration body.

• Adult clinical records (general practice, allied health, specialist) — minimum seven years from the date of last entry, or the applicable limitation period, whichever is longer. Many practices adopt ten years as a practical standard.
• Records of patients who were minors — retain until the patient’s 25th birthday or seven years from the date of last entry, whichever is later.
• Obstetric records — retain for 25 years from the date of the last entry, given the long window in which birth-related claims may arise.
• Diagnostic images (X-rays, MRI, CT) — minimum seven years for adults; until age 25 for minors. Some radiology practices retain imaging indefinitely given low storage costs and diagnostic value.
• Pathology request forms and results — minimum seven years; coordinate with your pathology provider on their own retention obligations.
• Consent forms — retain with the relevant clinical record for the same period.
• Billing and financial records — five to seven years for tax and Medicare compliance purposes.
• Employee records — seven years from the date of employment termination under the Fair Work Act.

Building a documented retention and destruction policy

A retention policy is only as useful as its implementation. The policy document itself should specify: the categories of records held by the practice, the applicable retention period for each category, the person responsible for periodic review, the approved destruction method for each record type, and a requirement that destruction is recorded in a destruction register.

Secure destruction is mandatory for health records containing personal information. Paper records must be shredded or incinerated — not placed in a general recycling bin. Electronic records must be irreversibly deleted using a method that prevents recovery; simply moving a file to the recycle bin does not meet this standard. Cloud-hosted records require confirmation from your provider that deletion is genuinely irreversible and does not persist in backups beyond a defined period.

Your destruction register — even a simple spreadsheet entry — should record: the date of destruction, a description of the records destroyed, the retention period that has been satisfied, and the name of the person who authorised and carried out the destruction. This record should itself be retained permanently or for a minimum of seven years.

Electronic health records and cloud storage — additional considerations

Most Australian practices now operate primarily digital record environments, using cloud-based practice management systems or electronic medical record platforms. Electronic records carry the same retention obligations as paper records; the format does not alter the legal requirement.

Additional considerations apply when records are stored in the cloud or managed by offshore administrative staff:

• Confirm your PMS vendor’s data residency arrangements. If your health records are stored on servers outside Australia, your obligations under APP 8 regarding cross-border disclosure are engaged, and you should confirm the vendor’s contractual commitments to APP-equivalent protections.
• Ensure your service agreement with your cloud provider addresses data portability — your ability to export complete records — and what happens to your data if you terminate the contract or the vendor ceases to operate.
• Offshore administrative staff who manage record filing, archiving, or destruction workflows must be trained in your retention schedule and must understand that they do not have authority to initiate destruction unilaterally. A documented approval workflow, with the Australian practice principal as the final authoriser, is the appropriate control.
• Conduct an annual review of your retention schedule against any updates to state legislation, AHPRA standards, or ATO guidance. Assign a named staff member as the owner of this review.

Looking ahead — digital health and retention complexity

The expansion of the My Health Record system and the increasing integration of wearable and remote-monitoring data into clinical practice will add new layers of retention complexity over the coming years. The Australian Digital Health Agency’s national clinical terminology and data standards work is likely to influence how retention obligations are defined and enforced for digital health data.

Practices that already have a structured retention policy and a disciplined document management workflow will adapt to these changes with minimal disruption. Those operating without documented processes will find it significantly harder to demonstrate compliance as regulatory expectations evolve.

Investing in good record-keeping infrastructure now — whether through a capable PMS, a disciplined offshore admin team, or both — is one of the highest-return compliance investments a practice can make. The alternative, responding to a complaint or a legal claim without adequate records, is considerably more expensive. This article provides general information only. Healthcare practices should seek advice from a health law specialist or their professional registration body to confirm the retention obligations that apply to their specific practice type and jurisdiction.