At a glance
India’s medical-council rules set a minimum of three years from the last entry for indoor patient records — a floor, not a ceiling. Accreditation-approved facilities typically hold clinical records for five years, and many providers keep records longer for continuity or dispute risk. The DPDP Act doesn’t shorten either clock — the retention period a health-records rule sets is itself a legal-obligation basis for holding data that long. What the Act adds is the duty to erase the record once neither that rule nor an ongoing treatment purpose needs it.
Educational resource only. This explains how medical-record retention rules interact with the erasure duty under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
The situation
“How long do we have to keep this patient’s file?” is one of the most common compliance questions a clinic or hospital asks, and it’s usually answered with a guess rather than a written rule. That gap matters more under the DPDP Act than it used to — not because the Act shortens the retention period, but because it expects providers to actually know the answer and delete accordingly, rather than defaulting to “forever, just in case.”
The baseline: what medical-council rules require
The statutory floor is three years, and it applies to indoor patient records specifically. Under the medical-council’s Professional Conduct, Etiquette and Ethics Regulations, a physician is required to maintain a register of medical certificates issued and to preserve indoor (in-patient) case records for a minimum of three years from the date of the last entry. This is the legal baseline every hospital and clinic must clear — not a target to stop at.
Why many providers hold records longer
Accreditation standards and clinical practicality both push the real-world number above three years. Facilities with NABH (National Accreditation Board for Hospitals) accreditation typically commit to retaining indoor records, operation notes, anaesthesia records and other clinical documentation for a minimum of five years — a higher bar than the statutory floor, driven by accreditation requirements rather than the DPDP Act. Beyond that, many providers hold records longer still for continuity-of-care reasons (a returning patient’s history) or because a claim or dispute can surface years after treatment — particularly for paediatric cases, where a longer hold until the patient reaches adulthood is common practice. None of this is a requirement under the DPDP Act; it’s the underlying medical-records regime the Act layers on top of.
How DPDP’s erasure duty fits alongside this
The DPDP Act’s erasure principle doesn’t compete with the medical-council retention floor — it applies to what’s held beyond it. A retention period set by a health-records rule (three years for indoor records, five for a NABH-accredited facility’s clinical documentation) is itself a legal obligation — a recognised basis under the Act (Section 8) for holding the data that long, independent of whether the patient’s consent for treatment is still active. Where the Act bites is afterwards: once the applicable retention period has passed and there’s no ongoing treatment relationship or other legal duty to keep the record, its purpose-and-erasure logic expects the provider to actually delete it — not retain it indefinitely because no one owns the deletion step.
Building a retention schedule that actually works
A written, per-record-type schedule is what turns this from a grey area into a routine. Practically, that means naming:
- Indoor/in-patient case records — the three-year statutory floor, or five years if NABH-accredited, whichever the facility is bound by.
- Outpatient and diagnostic records — often held on a shorter, provider-set basis unless a specific rule sets a floor.
- Records with a live treatment relationship — held for as long as the relationship continues, independent of any fixed clock.
- Records under dispute or investigation — held until the matter resolves, regardless of the standard clock.
Log the last-entry date per record so the clock is calculable, not remembered, and build the purge into whatever system holds the records — a paper register or the clinic’s software — rather than leaving it to an annual “should we clear this out” conversation that rarely happens.
What happens to records when a clinic closes or changes hands
A clinic shutting down or a solo doctor retiring doesn’t end the retention duty for patient records still inside their statutory window — it just raises the question of who now holds it, and patients have a real, practical stake in that answer. A patient whose treating doctor has retired or whose clinic has closed may need their record years later — a new doctor requesting history, an insurance claim, a legal matter — and “the clinic doesn’t exist anymore” isn’t a satisfying answer if it was avoidable. Where a practice is sold or a doctor joins another facility, records within their retention window should transfer with clear continuity — ideally communicated to patients (a notice of the transfer and how to request their records from the new custodian) rather than assumed. Where a solo practice or small clinic closes with no successor, the closing doctor should arrange a defined custodian — another practitioner, a records-management service, or, per applicable medical-council guidance where it exists — for records still within the retention window, and make a reasonable effort to inform patients how to reach their records rather than simply archiving them with no accessible point of contact.
FAQ
What happens to a patient’s records if their doctor retires or the clinic closes?
Records still inside their statutory retention window need a defined custodian — ideally communicated to patients — rather than being left inaccessible. A practice sale or merger should carry the records and the retention duty forward to the new custodian.
What’s the minimum time a clinic must keep patient records?
Three years from the date of the last entry for indoor/in-patient case records, under medical-council regulations — a floor, and NABH-accredited facilities commit to five years for clinical documentation.
Does the DPDP Act require deleting records after three years?
No — the Act doesn’t set the clock; the medical-records rule does, and holding data for that period is itself a lawful basis under the Act. The Act’s role is requiring deletion after that period ends, once there’s no ongoing purpose.
Can we keep a patient’s records longer than the minimum “just in case”?
Yes, and many providers do — for continuity of care or dispute risk, especially for paediatric patients. The point isn’t to delete at the earliest possible moment; it’s to have a written reason for however long you actually hold the data, not an unwritten “keep everything forever” default.
Do outpatient records follow the same three-year rule as indoor records?
The three-year figure is specifically tied to indoor/in-patient case records under medical-council rules; outpatient and diagnostic retention often follows the provider’s own documented schedule unless a specific rule applies — set it out in writing either way.