Clinical Records Retention Policies For Allied Health

How long do you actually need to keep patient records in your allied health clinic?

The reassuring answer is that you don't need to guess. For many Australian clinics, a sensible clinical records retention policy starts with a clear baseline: keep adult patient records for at least 7 years from the last entry, and keep records for children until they turn 25. From there, you adjust for your profession, state or territory, funding arrangements and risk profile.

Because clinical records contain sensitive health information, retention is also a privacy issue. Your data retention policy should explain not just how long you keep records, but how you store them, who can access them, how patients can request them, and how you securely dispose of them when the time comes.

How Long Do You Need To Keep Allied Health Records?

In most allied health clinics, you should plan to keep adult patient records for at least 7 years after the last consultation or entry, and records for children until they turn 25.

This is the common retention benchmark used across Australian healthcare. It's also built into health records laws in some states and territories, including New South Wales, Victoria and the ACT. Even if your clinic is outside those places, using this baseline can give you a consistent and defensible approach.

Your exact retention period can depend on:

• Your state or territory, as some health records laws set specific minimum periods.
• Your profession, especially if you're registered with Ahpra and your National Board has record keeping expectations.
• Your funding sources, such as NDIS, workers compensation, Medicare-related programs or private health insurance arrangements, including any NDIS privacy obligations.
• Your insurer's requirements, including professional indemnity insurance conditions.
• The type of record, as some business, incident, employment or funding records may need to be kept under separate rules.

For example, Priya runs a small physiotherapy clinic in Geelong. Her clinical records retention policy says adult patient files are kept for 7 years after the patient's last appointment. If a patient was 14 at their last appointment, Priya keeps that record until the patient turns 25. She also checks her insurer's policy wording and any funding agreement requirements before disposing of older files.

A good policy will name your default retention periods, but it should also allow you to pause disposal if there's a complaint, audit, professional conduct issue, unpaid account dispute or other reason you may still need the record.

What Should A Clinical Records Retention Policy Cover?

Your clinical records retention policy should cover the full record lifecycle: creation, storage, access, retention, transfer and secure destruction.

A short policy is fine if it's clear and practical. The goal is to help your team know exactly what to do on a busy clinic day, not to create a document that sits untouched in a folder.

What Counts As A Clinical Record?

Your policy should define what your clinic treats as a patient record. This will usually include:

• Intake forms and consent forms
• Referral letters and reports
• Assessment notes and treatment plans
• Progress notes and clinical observations
• Test results, images and measurements
• Communications with patients, carers, GPs and other providers
• Billing notes that include health information
• Incident notes, complaints and follow-up actions
• Telehealth records, emails, portal messages and SMS notes that relate to care, including under any telehealth terms you use

If your clinic uses multiple systems, this definition matters. For example, a treatment note in your practice management software, a scan uploaded to cloud storage and a clinician's clinical email may all form part of the patient record.

Who Is Responsible For Records?

Your policy should also say who is responsible for record management and privacy compliance. In a small clinic, that may be you as the owner or practice principal. In a larger clinic, you may nominate a practice manager, privacy officer or clinical lead.

Set out who can:

• Create and edit records
• Approve record access requests
• Move records between systems
• Authorise secure destruction
• Respond to privacy complaints or data breaches

Templates can be a useful starting point, but they often miss clinic-specific details such as your software, contractor arrangements and state-based rules. Your policy works best when it reflects how your clinic actually runs.

Do Privacy Laws Apply To Your Allied Health Clinic?

Yes, privacy laws will almost always apply to your allied health clinic because health information is sensitive information.

Under the Privacy Act 1988, private health service providers are generally covered by the Australian Privacy Principles, even if their annual turnover is under $3 million. That means small allied health clinics often have privacy obligations that other small businesses may not have.

The Australian Privacy Principles deal with how you collect, use, disclose, store and give access to personal information. For a clinic, this includes patient names, contact details, health histories, treatment notes, images, reports and billing information where it identifies the patient.

Your privacy obligations usually include:

• Having a clear and accessible clinic privacy policy
• Collecting health information only where it's reasonably necessary for your services
• Getting consent where required, especially for sensitive information, using clear consent forms where appropriate
• Telling patients how their information will be used and disclosed
• Keeping patient information secure
• Giving patients access to their information unless a legal exception applies
• Destroying or de-identifying information when you no longer need it and you're not required to keep it
• Managing eligible data breaches under the Notifiable Data Breaches scheme

Some states and territories also have health privacy laws. For example, New South Wales has the Health Records and Information Privacy Act 2002, Victoria has the Health Records Act 2001, and the ACT has the Health Records (Privacy and Access) Act 1997. If your clinic operates across borders or sees patients remotely, it's worth checking which rules apply to your business.

How Should You Store And Secure Patient Records?

You should store patient records in a way that protects them from loss, unauthorised access, misuse and accidental disclosure.

Under Australian privacy law, security isn't just an IT issue. It covers your systems, people, physical clinic space, contractors and day-to-day habits. A good patient records policy should make security easy for your team to follow.

Practical Security Steps For Digital Records

If you use practice management software, cloud storage or a patient portal, your policy should cover:

• Unique logins for each team member
• Strong passwords and multi-factor authentication where available
• Different access levels for reception staff, clinicians, contractors and managers
• Regular access reviews when staff leave or change roles
• Secure backups and a plan for system outages
• Encryption for laptops, devices and portable drives
• Rules for using personal devices or working from home
• Secure email, portal or file transfer processes for reports and referrals

Be careful with shared inboxes and shared logins. They might feel convenient, but they make it harder to track who accessed or changed a record.

Practical Security Steps For Paper Records

If you still keep paper records, your policy should cover:

• Locked storage for files when not in use
• Clear desk rules in reception and treatment rooms
• Sign-out processes if files are moved around the clinic
• Secure scanning processes before paper files are archived or destroyed
• Access rules for students, locums and contractors
• Secure storage for archived records, not just spare cupboards or garages

If paper files are scanned and the paper originals are destroyed, make sure the scanned copy is complete, readable and stored securely. Your policy should say who checks this before destruction happens.

Can Patients Access Or Correct Their Records?

Yes, patients generally have a right to request access to their records and ask for corrections if information is inaccurate, out of date, incomplete, irrelevant or misleading.

Under the Privacy Act, you need to respond to access requests within a reasonable period. Many clinics use 30 days as an internal target because it's practical and aligns with common privacy expectations, but some state health records laws may set their own timeframes or processes.

Your policy should explain:

• How patients can make an access request
• Who in your clinic reviews the request
• How you confirm the patient's identity
• When you may need patient consent before releasing records to another person
• Whether you charge a reasonable administration fee for providing access, if allowed
• How you handle requests from parents, guardians, lawyers, insurers or other providers
• When you may refuse access because an exception applies

For example, if a parent requests records for a 16-year-old patient, you may need to think carefully about consent, the young person's capacity, any court orders you know about and the risk of harm. The right approach can depend on the facts, so this is an area where tailored advice can be helpful.

Corrections are different from deleting clinical opinions. If a patient disagrees with part of a record, you may be able to add a note of their requested correction or statement rather than removing the original clinical note. Your policy should give clinicians a clear process so they don't alter records in a way that creates confusion later.

How Do You Dispose Of Old Clinical Records Safely?

You should only dispose of clinical records when the retention period has ended and there's no ongoing legal, clinical, insurance or business reason to keep them.

Before destroying anything, check whether the file is connected to:

• An active or recent patient relationship
• A complaint, incident or professional conduct matter
• An insurance notification or potential claim
• A funding, NDIS, workers compensation or Medicare-related audit
• An unpaid invoice dispute where the record may be relevant
• A legal hold or formal request for records

If none of these apply and the retention period has expired, your disposal process should be secure and recorded.

Secure Disposal Methods

For paper files, secure disposal usually means using a reputable confidential shredding provider or cross-cut shredding process. For digital files, pressing delete may not be enough. You may need permanent deletion, secure wiping or de-identification, depending on your system.

Your policy should require a disposal register that records:

• The patient file or record category destroyed
• The relevant date range
• The reason the retention period had ended
• The destruction method
• The person who approved it
• The date destruction occurred

You don't need to keep a copy of the destroyed clinical content in the register. The point is to show you followed a controlled process.

What Happens If You Sell, Close Or Move Your Clinic?

If you sell, close or move your clinic, you still need to manage patient records carefully and lawfully.

Clinical records aren't just ordinary business assets. They contain sensitive health information, so you need to think about patient privacy, continuity of care and any consent requirements before transferring or giving access to records.

If you're selling your allied health clinic, your sale documents should deal with:

• Whether patient records transfer to the buyer or stay with you
• How patients will be notified
• How patients can opt out or request transfer to another provider
• Who handles access requests after completion
• How records will be stored during the transition
• Confidentiality obligations for the buyer, seller and staff
• What happens to records that shouldn't transfer

If you're closing the clinic, your plan should cover how patients can obtain copies of their records, where records will be stored, and who will manage access requests after closure. Simply handing records to a third party without a privacy plan can create problems for both you and your patients.

If you're moving to a new software provider, treat the migration as a record management project. Check that all records transfer properly, backups are secure, old accounts are closed, and your contract with the software provider has privacy, confidentiality and data handling protections.

Key Takeaways

• A clinical records retention policy should set clear rules for keeping, accessing, storing and securely disposing of patient records.
• Many Australian allied health clinics use at least 7 years from the last entry for adult records, and until age 25 for children's records, as the baseline.
• Health information is sensitive information, so your Privacy Act obligations apply even to many small clinics under the usual $3 million turnover threshold.
• Your patient records policy should cover digital systems, paper files, contractors, access requests, corrections, backups and secure destruction.
• If you're selling, closing or moving your clinic, plan the transfer or storage of records early so privacy and continuity of care are handled properly.

If you'd like help with your clinical records retention policy, clinic privacy policy, patient access process or health information handling clauses, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.