How long must an Indian clinic keep patient records?
2026-09-30 · MedSlay
"How long do I have to keep patient records?" has a short answer and a long footnote. The short answer is three years. The footnote is where clinics get caught out, because three years is the point below which you must not fall, not the point at which throwing things away becomes safe.
This is an orientation for practising doctors, not legal advice. Retention duties come from several places and they move; read the current official text, and take advice where a matter is live.
Where the three years comes from
The Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 require a doctor to maintain the medical records of indoor patients for three years from the commencement of treatment, in a standard format set out in the regulations. The National Medical Commission succeeded the MCI in 2020 and the professional conduct rules have been revised and revisited since, so check the text current for you rather than a summary of it.
Two details catch people out. It runs from the commencement of treatment, not from discharge — on a long admission the clock is already running while the patient is still in the bed. And it names indoor patients, which does not make OPD records unregulated; it means they are governed by everything below instead.
Three years is a floor, not a policy
What you should actually keep is set by who might come asking, and when.
is ordinarily to be filed within two years of the cause of action arising — and a cause of action can arise well after the treatment did.
suits, again running from the cause of action rather than from the visit.
reach majority. A record of treatment given at six may still matter fifteen years later.
until the matter is genuinely closed, not until a timer expires.
- Consumer complaints. Under the Consumer Protection Act, 2019 a complaint
- Civil claims. The Limitation Act, 1963 allows three years for most civil
- Minors. Where the patient was a child, time can run from the date they
- Medico-legal cases. Anything with a police or court dimension is kept
None of these are retention rules. They are the reason a record you were entitled to destroy is the one you wish you still had.
What counts as "the record"
More than the consultation notes. If a file is requested, the whole of it is expected:
- Case sheet, progress notes and nursing charts
- Prescriptions issued, and the medicines actually administered
- Consent forms, including consent that was later withdrawn
- Investigation reports, and the images themselves where you hold them
- Operative notes and the discharge summary
- Referral letters, certificates issued, and the register of them
- Billing and insurance claim documents
A record that is complete in the cupboard but scattered across three systems and a WhatsApp thread is not complete in any way that helps you.
The 72-hour rule
The same regulations require that where a patient or an authorised attendant asks for their records, the request is acknowledged and the documents supplied within 72 hours. Three days is not long if the file has to be found in a room, photocopied and collated by someone who also runs the front desk.
Treat retrieval time as part of the retention duty, because in practice it is.
DPDP pulls the other way
Keeping everything forever used to be the cautious default. It no longer is. The Digital Personal Data Protection Act, 2023 expects personal data to be erased once the purpose it was collected for is served, unless retention is required by law or the person consents to more. Health records have strong legal grounds for retention — but "we never delete anything" is not a ground, and neither is "it might be useful".
The two duties meet at a written policy: long enough for the exposure above, bounded enough for DPDP, and documented so both answers are the same. More on the wider obligations in what DPDP means for a clinic.
A retention policy that fits on one page
- List what you hold, by category rather than by file — OPD notes, admission records, imaging, consents, claim documents, certificates.
- Set a period for each category, taking the professional minimum as the floor and your realistic exposure as the guide.
- Write down the reason beside each period. A policy you cannot justify is one you will abandon the first time someone questions it.
- Name one person who owns it. Retention without an owner is not a policy, it is a hope.
- Test a retrieval. Pick a two-year-old file at random and see how long it takes to produce it completely. That is your real 72-hour answer.
- Review it once a year, and whenever the rules change.
Storage is where policies fail
Paper does not keep for three years by being left alone. It fades, floods, burns and is eaten, and none of that is a defence. Digital storage removes those failure modes and introduces its own: access control, restorable backups, and an audit trail.
In-patient records carry the heaviest version of this, because the file is built by several people over several days and is the one an insurer or a court is most likely to want in full — how an IPD file holds together goes into that.
Where MedSlay fits
Records live against the patient rather than in a folder: consultations, prescriptions as proper documents, admissions with their day-by-day charts, discharge summaries and claim files. Consent is captured granularly and can be withdrawn without the withdrawal itself being lost. An activity log shows who accessed what and when. Retrieval is a search, not a search party.
None of that decides your retention periods — that is a clinical and legal judgement, and it should be. What it changes is whether the policy you write is one you can keep. See what the system does.