In this second article in a series exploring record-keeping by Dr Volker Hitzeroth, medico-legal consultant, and Dr Yash Naidoo, dento-legal consultant, at the Medical Protection Society, the experts unpack ownership of health records and when – and if – it is safe to delete it.
Hitzeroth and Naidoo write:
Imagine this scenario: a call comes through from a patient you saw some months ago. They are audibly upset and want every record you hold of them to be deleted. They offer no explanation and don’t want a copy, they just want it gone today.
Something in you wants to help, because the patient is distressed and the request sounds simple enough, but another part of you that has read the odd medico-legal article is unsure. Both instincts fire at once, and you are not certain which is right.
That hesitation is the whole subject of this article, because the answer isn’t obvious, and getting it wrong can harm both you and the patient.
First question: whose records are they, actually?
Most patients believe their records are theirs. It’s an understandable assumption but it’s wrong. The patient’s instinct is based on the provisions of the Protection of Personal Information Act (POPIA). We have all absorbed the idea that those data about us belong to us, that we can ask for this back, and that an organisation should delete our information once it has done with it.
For most kinds of personal data, that is broadly the shape of things, but health records are not most kinds of data.
Two things serve to override the patient’s deletion request. The first is the National Health Act (NHA), which requires that a health record be created and maintained for every patient. The second is the HPCSA’s guidance, which requires practitioners to keep records for a set number of years.
POPIA itself makes room for both: it says personal information should be kept only as long as the purpose lasts, unless retention is required or authorised by law. For health records, retention is required by law.
POPIA, the NHA and the HPCSA are not fighting each other, they are pulling in the same direction: keep the records, keep them securely, and do not dispose of them until you are genuinely allowed to.
HPCSA (Booklet 9) outlines that the record is owned by the practitioner, or by the entity that generated it. What the patient owns is a right of access to the information. They can see the record and obtain the information in it, but ownership and access are two different things, and the difference matters enormously the moment someone asks you to destroy something.
So, when the caller demands deletion, they are asking you to do something with property that is yours to manage, and which you are – in some cases – legally obliged to keep. You can usually give them a copy. You generally cannot give them an erasure. It is tempting to frame all of this around the practitioner’s own exposure, but that misses something important.
The records often protect the patient as much as the clinician, and sometimes the demand to delete them is a sign of exactly that.
Consider why a patient might want their history to vanish. Some are simply frightened about privacy and deserve reassurance. But a clinical record is also evidence, and not only in a medico-legal sense.
It can expose a non-disclosure on a life insurance or other application, where a patient declared themselves healthy and the file says otherwise. It can matter in criminal proceedings. In dentistry the point is especially vivid, because dental records are a recognised tool for identifying victims and perpetrators, and have resolved many a case where nothing else could.
A request to erase a record is occasionally a request to erase a trail. That is not a judgment about any individual patient, but it is a reason the duty to retain exists, and a reason to be slow to override it on the strength of a phone call.
So, how long must you keep them?
This is the part everyone frequently gets wrong. The number that floats around is “six years”, and it is right, but only as a floor, and only sometimes. The HPCSA’s position is that the default is “as long as possible”.
The guidance says records should ideally be kept indefinitely, especially where electronic storage makes that practical. Six years is the minimum, not the target.
Six years runs from the date the record became dormant, which occurs at the last consultation, not the first. Every time you see the patient again, the clock resets.
For minors, the HPCSA recommends keeping records until at least the patient’s 21st birthday. That figure is deliberately cautious. A minor’s claim generally cannot prescribe until at least a year after they reach the age of majority, and commentators differ on precisely how the period runs from there, which is exactly why keeping the file comfortably beyond that point leaves you on the safe side of any argument.
The guidelines also outline the length of time that other records should be kept:
• The records of mentally incapacitated patients should be kept for the duration of the patient’s life.
• Occupational Health and Safety Act records must be kept for 20 years after treatment.
• For slow-developing conditions, the classic example being asbestos-related disease that can surface decades later, the recommendation is no less than 25 years.
Any statutory retention period that applies to your specific context trumps all of the above. If a law says keep it longer, then keep it longer.
Underneath all of these is a need to balance the cost of storing records for a long time against the cost of not having them when a complaint or claim arrives. The records are cheap but being unable to account for yourself is not.
That is why “keep them longer” almost always wins. The file you destroy at year six is the file you may desperately need at year seven.
When you finally can destroy them, do it properly
Eventually records do reach the end of their life and may be destroyed. The guidance here is thinner than you would expect, so a few sound principles fill the gap:
• Destroy them in a way that prevents reconstruction. Paper should be shredded or formally incinerated, not binned intact. Neither the skip behind the building, nor the Saturday braai fire are proper disposal methods.
• Keep a register of what you destroyed.
Not the records themselves, but a log including the patient’s name, date of birth, and the period of clinical contact. If anyone ever asks why a file no longer exists, the register is your answer.
Electronic records are harder to dispose of than they look. The old advice was to overwrite existing data with random data or physically destroy the drive.
That may still hold for hardware you control but most practices now keep records in cloud systems and practice software. With cloud systems, backups may persist well beyond the moment you press “delete” on your device. Here you have to rely on the provider’s deletion guarantees.
Treat “deleted” as an assertion to verify with your provider, not a fact to assume. If you outsource destruction, put a confidentiality agreement in place and obtain a certificate of destruction confirming the job was done.
So, what do you tell the distressed patient on the phone?
The honest answer to give is that you cannot simply delete their records. Explain that it is not your preference, but a duty placed on you by the NHA, the HPCSA and supported by the law, and that it protects them as much as it constrains you.
You can offer them a copy of the record, and it would be valuable to discuss whatever has concerned them. You can also reassure the patient that their information is stored securely and seen by no one without proper authority.
If they still insist, ask them to put their request in writing and explain that you will take advice on it before responding. Then, contact your indemnifier or insurer to get advice on your obligations and next steps.
This is about making sure you do right by both the patient and yourself, rather than making an irreversible decision under pressure on a phone call. A request in writing also gives you, and anyone advising you, something clear to work from.
Members can contact MPS to request expert advice and support on a range of issues related to records management.
See more from MedicalBrief archives:
Healthcare data protection in a mushrooming AI-driven sector
POPIA is coming into force – are you ready?
Confidentiality key to securing patients’ trust