Maintaining Patient Records

The GCC has recently received enquiries regarding the records of patients. The maintenance and security of these records is an essential requirement for all healthcare professionals, and we want to share answers to some of the more frequently asked questions.

How long must patient records be kept and maintained?

Chiropractors must maintain records about patients for eight years from a patient's last visit. If the patient is a child, records must be kept until their 25th birthday or 26th birthday if aged 17 at the end of treatment.

This eight-year requirement, which aligns with those for general NHS hospital records, aims to ensure that patients can access their recent health records. However, it also protects registrants if patients complain about their care. 

The length of time that records must be maintained varies across health and social care; for example, mental health records must be kept for 20 years.

Can a patient see their records?

Yes. Standard H7 of the Code states that patients have the right to access their records, as required by law. Furthermore, the patient does not need to explain their reasons for viewing their records. They can also nominate another person, such as a solicitor, to access their records, but only after written consent has been provided. 

There are some exceptions to this rule, such as where seeing the records may cause serious mental or physical harm or if it contains confidential information about another person.

Finally, under General Data Protection Regulation (GDPR), patients cannot be charged an administrative fee for accessing their records.

Can patients request their records to be transferred to another practice or healthcare professional?

Yes. As patient records belong to a patient, they can request that the records be moved to another practice or healthcare professional. However, registrants must not disclose or transfer patient files until the patient, or their legal representative, has provided explicit written consent.

Finally, a reasonable administrative fee for this service is permissible.

Can a patient request that their records be destroyed under GDPR rules?

Yes and No. Under GDPR rules, patients have a legal right to request that their information is deleted. However, the eight-year rule for maintaining patient records takes priority. Therefore, a registrant can refuse this request until the eight-year rule (or 25/26 rule for children) has been met.

I am closing my practice. Do I still need to maintain the patient records?

Yes. If the practice is closing, reasonable efforts must be taken to contact all patients and inform them of the closure. Plans must also be put in place to ensure the safekeeping of patient records. This plan may include entering into a contract with an organisation or healthcare professional to undertake this responsibility. Finally, these arrangements must be publicised so patients can obtain their records if desired.

We would recommend all registrants read the GCC guidance on Confidentiality, which can be found in the Guidance and Toolkits section of the Registrant Resource Centre.