How Long Should a Clinic Keep Patient Records in India?
Keep patient records for at least three years, and longer where a state law or a pending case requires it. The three-year figure appears in the medical council's rules for in-patients, in the Dental Council's rules for out-patients and in-patients alike, and in the Clinical Establishments standard for clinics. No national rule sets a longer period for an outpatient clinic, but a clinic has to be able to hand a patient their records within 72 hours of a request, so the records also have to be easy to find.
The medical council rule: three years, for in-patients
Clause 1.3.1 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, which the National Medical Commission still applies:
"Every physician shall maintain the medical records pertaining to his / her indoor patients for a period of 3 years from the date of commencement of the treatment in a standard proforma laid down by the Medical Council of India and attached as Appendix 3."
The clause names indoor patients only. Appendix 3, the standard proforma, lists the fields a record should have: name, age, sex, address, occupation, date of first visit, a clinical note of the case, provisional diagnosis, investigations with reports, diagnosis after investigation, advice, follow-up, observations and the doctor's signature.
The NMC's 2023 conduct regulations, which also spoke of in-patients, were held in abeyance on 23 August 2023 (NMC notice), so the 2002 text is the one in force.
Dentists: three years, out-patients included
The Dental Council of India's Revised Dentists (Code of Ethics) Regulations, 2014, clause 3.3.1, covers records of "out- patients and in-patients", to be "preserved for a minimum period of three years". A dental clinic keeps every patient's record for three years at least, whether or not the patient was admitted.
Clinics under the Clinical Establishments Act
In the states that have adopted the Clinical Establishments Act, 2010, the minimum standard for clinics says: "Copies of all records and statistics shall be kept with the clinical establishment concerned for at least 3 or 5 years or in accordance with any other relevant Act" (standard CEA/Clinic-009, clause 9.2, MoHFW).
The central rules under the same Act also ask for electronic records. Rule 9(iv) of the Clinical Establishments (Central Government) Rules, 2012 says clinical establishments "shall maintain and provide Electronic Medical Records or Electronic Health Records of every patient as may be determined and issued by the Central Government or the State Government". The IMC Regulations point the same way: "Efforts shall be made to computerize medical records" (clause 1.3.4).
Giving records to patients: 72 hours
Clause 1.3.2 of the IMC Regulations:
"If any request is made for medical records either by the patients / authorised attendant or legal authorities involved, the same may be duly acknowledged and documents shall be issued within the period of 72 hours."
Paper files in a cupboard make this the hardest rule to meet. A record you can search by name, phone or OP number, and print or send as a PDF, meets it in minutes.
Medicine registers
Two retention periods in the Drugs and Cosmetics Rules, 1945 apply to a clinic that holds a drug licence. Supply of Schedule H1 medicines is recorded in a register kept "for three years" (rule 65(3)(1)(h)). For Schedule X medicines the prescription is written in duplicate, and the licensee keeps one copy "for a period of two years" (rule 65(9)(a)).
Medico-legal cases
We found no national rule that sets a retention period for medico-legal case records. Because a court case can begin years after treatment, ask your lawyer or your professional indemnity insurer how long to keep the records of any case that may become a dispute.
What the DPDP Act changes
The Digital Personal Data Protection Act, 2023 treats a clinic as a data fiduciary for its patients' personal data. Three provisions matter here:
- Consent. Consent has to be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)). A registration form that says what the clinic records and why, and that the patient signs, is the plain way to get it.
- Emergencies. Personal data may be processed without consent "for responding to a medical emergency involving a threat to the life or immediate threat to the health" of a person (section 7(f)).
- Erasure, unless the law requires retention. Personal data is to be erased once the patient withdraws consent or the purpose is no longer being served, "unless retention is necessary for compliance with any law for the time being in force" (section 8(7)). The retention periods above are such requirements, so the DPDP Act does not shorten them.
The DPDP Rules, 2025 were notified on 13 November 2025. Most of the obligations on data fiduciaries, in rules 3 and 5 to 16, come into force eighteen months after that date, which is mid-May 2027.
A practical policy for a small clinic
- Keep every patient's record, out-patient or in-patient, for at least three years from the last visit, and longer where your state's rules or the Clinical Establishments standard set a longer period.
- Keep any record that may become part of a dispute until your lawyer or insurer says you can destroy it.
- Make records findable by name, phone and OP number, so you can meet a 72-hour request.
- Keep a register of medical certificates and a copy of each certificate, as clause 1.3.3 of the IMC Regulations requires.
- Get written consent at registration that says what you record and why.
MyClinicDesk keeps each patient's registration, consent signature, visits, prescriptions and bills on one record, backed up every night, and finds any patient by name, phone or OP number. If you are still on paper, our free OPD register format and patient registration forms are a place to start.
This article quotes public regulations and is not legal advice. Confirm your obligations with your State Medical Council or Dental Council.