How long should a clinic keep patient records?

There is no single national rule that says "keep every patient record for X years." The honest answer is that it depends on the record and the situation. The figure most clinics anchor to is 3 years for indoor (admitted) patient records, set by regulation 1.3.1 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002. Other records can run shorter or much longer. This is practical guidance, not legal advice, so confirm the period that applies to your state and your practice with a qualified advisor. This guide sits inside our wider series on patient data security for clinics.

The number everyone cites, and what it actually covers

Regulation 1.3.1 reads, almost word for word: every physician shall maintain the medical records of indoor patients for a period of 3 years from the date of commencement of the treatment. That is the source of the "3 years" figure you hear repeated. Two things are worth noticing.

First, it is specifically about indoor patients, meaning admitted patients, in a standard format. It is not a blanket statement that every scrap of paper in your clinic has a three-year life.

Second, the same regulation has a quieter rule that matters just as much: if a patient, their authorised attendant, or a legal authority requests the records, you must issue them within 72 hours. Retention is not only about how long you store records. It is also about being able to find and hand them over fast when someone asks.

Why "it varies" is the real answer

Beyond that core rule, retention periods are not one fixed national number. They shift depending on the type of record and the circumstances:

• Outpatient (OPD) records. There is no single uniform national figure that everyone agrees on for OPD slips and notes. Many clinics keep them for a few years as a matter of practice, but you should confirm what applies to you rather than assume.
• Medico-legal cases. Anything tied to an accident, an MLC, a court matter, or any situation where a dispute is plausible is usually kept much longer, because it may be needed as evidence years down the line.
• Special categories. Certain records carry their own expectations. Records connected to procedures governed by specific laws, such as MTP-related documentation, are commonly cited as needing longer retention. Specialist bodies and individual state rules can also set their own periods.
• Minors. A common, cautious approach is to keep a child's records until well after they reach adulthood, since their own ability to act on those records starts later.

The pattern across all of these: the periods are not settled at a single national figure, and several of them point upward, not downward. When in doubt, the safe default is to keep, not bin, until you have confirmed.

A simple way to run this in practice is to sort records into buckets: routine indoor, routine OPD, medico-legal, and special-category. Each bucket gets its own retention clock. That beats trying to apply one rule to everything.

Where the DPDP Act enters: do not keep data forever either

If the medical rules tell you the floor (how long you must keep records), the Digital Personal Data Protection Act, 2023 speaks to the ceiling. One of its core ideas is storage limitation: you should not hold personal data longer than you need it for the purpose you collected it, or longer than a law requires you to.

For a clinic, that has a clean reading. The medical retention rules give you a legitimate reason to hold records for a defined period. Once that reason is gone and no other law applies, storage limitation says do not just sit on the data indefinitely "in case." Keeping a decade of records you have no reason to keep is its own kind of risk: more data is more to protect, and more to lose if something goes wrong.

So the two rules work together. Retention rules say "keep this long." Storage limitation says "and not pointlessly longer than that." For more on the wider obligations, see our plain-English primer on the DPDP Act for clinics, and on the consent side, patient consent under DPDP.

Disposing of records safely

Disposal is the part most clinics get casually wrong, and it is where a quiet breach can start. A patient record dropped in the regular waste, or a hard drive sold on without wiping it, is a disclosure waiting to happen.

Paper. Do not bin whole files. Shred them, or use a disposal service that shreds and gives you a record of what was destroyed. The goal is simple: the paper should be unreadable after disposal, not just out of sight.

Digital. "Delete" is trickier than it looks. Properly removing a digital record means it is gone from the live system and from the places it quietly lives on: old backups, exported spreadsheets, email attachments, that USB drive in a drawer, the laptop a former staff member used. When you retire a device or end a vendor relationship, treat the data on it as a disposal task, not an afterthought.

Keep a disposal note. A short log of what was disposed, when, and how (for example, "OPD records 2018–2019, shredded, March 2026") is cheap to keep and valuable if anyone ever asks how you handle records. It also forces the habit of disposing deliberately rather than in an annual panic clear-out. For the day-to-day side of locking records down, see securing patient records in a small clinic.

This is the natural bookend to going paperless: once records are digital, "where do all the copies live" becomes the question that decides whether disposal is real or just cosmetic.

A short retention and disposal checklist

1. Sort records into buckets: indoor, OPD, medico-legal, special-category.
2. Set a retention clock per bucket; default to the longer side when unsure.
3. Counting starts from the date treatment commenced, not the file-creation date.
4. Be able to produce any record fast on request (the 72-hour rule).
5. When a record's retention ends and no law applies, dispose, do not hoard.
6. Shred paper; properly delete digital, including backups, exports, and devices.
7. Keep a brief disposal log.
8. Confirm the exact periods for your state and specialty with a qualified advisor.

Where Avinya Plus fits, honestly

Let us be precise about what software can and cannot do here. Avinya Plus does not auto-delete records or run a retention engine that purges files on a timer. Retention is a clinical and legal decision, and it stays yours. We are not going to pretend a piece of software can make that judgement for you, especially when the periods themselves vary and several point toward keeping records longer.

What the platform does do is keep your records structured and exportable, so you stay in control of your own retention. You can export and hand over a patient's full history (which is exactly what the 72-hour request rule is about), and you are not stuck if you ever change tools. Alongside that, role-based access, branch isolation enforced in the database, and an audit trail mean access to those records is governed and logged, not assumed, for as long as you hold them.

Treat retention as a process you own and disposal as a deliberate step, not a drawer you forget about. If you want to see how Avinya Plus keeps records exportable, access-controlled, and audited, book a demo from the menu and we will walk it against your own setup.