How Long to Keep Medical Records in South Africa: HPCSA Rules

Updated 2026-07-06 · Written for South African healthcare practitioners by Sphygmos.

The HPCSA's Guidelines on the Keeping of Patient Records (Booklet 9) set the retention rules every registered practitioner in South Africa is measured against: not less than six years from the date the record became dormant, and considerably longer for minors, mentally incompetent patients and occupational exposure. The guidance also fixes what a record must contain, how it may be corrected, who owns it and what happens to it when a practice closes. This guide sets out those requirements and what falls on the practitioner who cannot produce a record when a claim or complaint arrives.

The baseline: six years from the date the record became dormant

The HPCSA guidance states that health records should be stored for a period of not less than six years as from the date they became dormant. The clock runs from dormancy, the point at which the record stops being used, not from the patient's first consultation, so a patient seen regularly over a decade produces a record whose retention period only starts when the file goes quiet.

The guidance applies to practitioners in private practice, including managed health care organisations, as well as practitioners employed in the public service. Six years is a floor, not a ceiling: the guidance adds that where statutory obligations prescribe a retention period for particular records, the practitioner must comply with those obligations.

Longer periods: minors, mental incapacity, occupational exposure

The six-year baseline gives way to longer periods that the HPCSA guidance spells out:

Minors under 18: records should be kept until the patient's 21st birthday, because a minor has up to three years after reaching 18 to bring a claim. The guidance applies this equally to obstetric records.
Mentally incompetent patients: records should be kept for the duration of the patient's lifetime.
Occupational health: the guidance states that in terms of the Occupational Health and Safety Act 85 of 1993, health records must be kept for 20 years after treatment.
Conditions that take long to manifest, asbestosis being the guidance's example: the HPCSA recommends keeping records for not less than 25 years.
Provincial hospitals and clinics: records may only be destroyed if the destruction is authorised by the Deputy Director-General concerned.

What counts as the record, and what it must contain

The HPCSA defines a health record as any relevant record made by a health care practitioner at the time of or subsequent to a consultation, examination or the application of health management. That reaches well past the clinical note: referral letters in both directions, laboratory reports and slides, X-ray films and reports, ECG traces, photographs and recordings, clinical trial data, insurance and disability forms, and death certificates all form part of the record.

For every patient consulted, the guidance requires the practitioner to enter and maintain at least the patient's identifying particulars, the bio-psychosocial history including allergies and idiosyncrasies, the time, date and place of every consultation, the assessment and proposed clinical management, medication and dosage prescribed, details of referrals, the patient's reaction to treatment including adverse effects, test and imaging results, the periods the patient was booked off work with reasons, and written proof of informed consent where applicable. Paper records must be kept in non-erasable ink, and erasure fluid may not be used.

Alterations: the record may never lose information

The guidance is categorical that no information or entry may be removed from a health record. An error may be corrected by placing a line through it in ink and making the correction, with the date of the change entered and the correction signed in full, and the original entry must remain intact and fully legible. Later additions must be dated and signed in full, and the reason for an amendment should be specified on the record.

These rules are what separates a defensible record from a suspect one. A record that shows its own history, every correction dated, signed and explained, carries weight in a dispute; a record with deletions or overwritten entries invites the opposite inference.

Storage requirements: paper, electronic and the POPIA overlay

The HPCSA requires health records to be stored in a safe place, and records in electronic format to be safeguarded by passwords. Its guidance on electronic archiving, written for compact disc storage, fixes the standard it expects of any electronic store: media that cannot be overwritten so that old information is preserved while new information is added, encryption and password protection of the records and all copies, a read-only working copy in the practitioner's rooms, and a backup copy kept at a physically different site so the two can be compared if tampering is suspected.

POPIA runs alongside this. Section 19 of the Protection of Personal Information Act requires appropriate, reasonable technical and organisational measures against loss, damage, unauthorised destruction and unlawful access. And while POPIA's section 14 says records of personal information must not be retained longer than necessary, it expressly permits retention that is required or authorised by law, which is exactly what the HPCSA retention periods and other statutes are. The two regimes stack: keep the record as long as the retention rules demand, and keep it secure the whole time.

Ownership, practice closure and the death of a practitioner

In state institutions, records and images are the property of the institution, which retains the originals; copies must be made available to the patient or referring practitioner on request, for which a reasonable fee may be charged under the Promotion of Access to Information Act. Where patients have paid for records and images, as in private practice, the guidance requires that they be allowed to retain them, unless the practitioner needs to hold them for a period to monitor treatment, and a patient who needs the originals to protect an interest must be allowed to obtain them.

A practice that closes must inform all its patients in writing within three months of closure: that the practice is closing on a specific date, that patients may ask for their records to be transferred to a practitioner of their choice, and that remaining records will be kept in safekeeping for at least 12 months by an identified practitioner or health institution, with confidentiality preserved.

When a practitioner dies, the records form part of the estate and are administered by the executor. If another practitioner takes the practice over, the records carry over and patients must be informed of the change and of their right to move their records elsewhere. If not, the executor informs patients in writing, transfers records as requested, and keeps the remaining files in safekeeping for at least 12 months.

What thin or missing records cost

The HPCSA's own guidance names the risk: a practitioner's defence in a negligence case is handicapped by the absence of records, and retention decisions must weigh that occasional case against the cost of storage. With minors able to sue up to three years after reaching majority, a record destroyed too early can be the difference between a defended claim and an undefendable one.

The exposure is also professional. The HPCSA states that its guidelines form an integral part of the standards of professional conduct against which a complaint of professional misconduct is evaluated, and the record-keeping booklet is one of those guidelines. And under POPIA, losing patient records or exposing them to unauthorised access engages the security safeguard and breach notification duties, with the Information Regulator able to impose administrative fines of up to R10 million.

How Sphygmos helps

Sphygmos keeps every record organised on the patient timeline, where it stays complete, dated and retrievable for as long as the retention rules require. Notes, documents and results attach to the patient they belong to, corrections never destroy what came before, and access stays under the doctor's control in one POPIA-conscious workspace. When a query, claim or complaint surfaces years after the consultation, the record is where it should be.

See Sphygmos, the clinical operating system for South African doctors

Frequently asked questions

How long must medical records be kept in South Africa?

HPCSA guidance requires health records to be stored for not less than six years from the date they became dormant. Longer periods apply to minors, whose records are kept until the patient's 21st birthday, mentally incompetent patients, whose records are kept for the patient's lifetime, and occupational health records, which the guidance states must be kept for 20 years after treatment under the Occupational Health and Safety Act.

How long do you keep medical records for minors in South Africa?

Until the patient's 21st birthday. The HPCSA's reasoning is that a minor has up to three years after reaching the age of 18 to bring a claim, so the record must survive to age 21. The guidance applies the same rule to obstetric records.

How long must occupational health records be kept?

The HPCSA guidance states that in terms of the Occupational Health and Safety Act 85 of 1993, health records must be kept for 20 years after treatment. For conditions that take a long time to manifest, such as asbestosis, the HPCSA recommends keeping records for not less than 25 years.

Can a doctor destroy old patient records?

Only once the applicable retention period has run, and even then the HPCSA asks practitioners to weigh the cost of storage against the risk of facing a negligence claim without records. Records in provincial hospitals and clinics may only be destroyed with the authorisation of the Deputy Director-General concerned. POPIA permits retention that is required or authorised by law, so keeping records for the HPCSA periods is lawful under both regimes.

Who owns medical records in South Africa?

In state institutions the records are the property of the institution, which keeps the originals and provides copies on request under the Promotion of Access to Information Act. In private practice, HPCSA guidance requires that patients who have paid for records and images be allowed to retain them, subject to the practitioner holding them for a period where needed to monitor treatment, and patients must be allowed the originals where they need them to protect an interest.

Can patient records be stored electronically in South Africa?

Yes. HPCSA guidance requires electronic records to be safeguarded by passwords, and its electronic archiving conditions require storage that preserves old information rather than overwriting it, encryption and password protection of records and copies, and a backup kept at a physically separate site so tampering can be detected. POPIA section 19 adds a general duty to take appropriate, reasonable technical and organisational measures against loss and unlawful access.

What happens to patient records when a practice closes?

The practitioner must inform all patients in writing within three months of closure that the practice is closing on a specific date, that they may have their records transferred to a practitioner of their choice, and that remaining records will be kept in safekeeping for at least 12 months by an identified practitioner or health institution, with confidentiality preserved throughout.

Sources

This guide is general information for healthcare practitioners, not legal advice. Verify current legislation and HPCSA guidance before relying on any detail.