Archiving medical records in a physiotherapy practice
After five years of running his practice, Piotr had a cabinet full of patient records and no idea what to do with them.
After five years of running his practice, Piotr had a cabinet full of patient records and no idea what to do with them. He wanted to throw some out because "patients don't come back anyway", while others sat in boxes in a damp basement. He didn't know how long he had to keep them, how to secure them, or whether he could simply destroy them. During an inspection, it turned out he was storing records in conditions that threatened their integrity and confidentiality -- which is itself a breach.
Archiving medical records is an obligation that's easy to forget in the day-to-day running of a practice. Yet the regulations clearly set out how long and in what manner records must be stored, and how to dispose of them lawfully. In this article, we'll walk through retention periods, security rules and the disposal procedure.
Why is archiving a legal obligation?
The obligation to store medical records stems from the Patient Rights and Patient Ombudsman Act of 6 November 2008. An entity providing health services is required to store records for a specified period, in a manner that ensures their confidentiality, integrity and accessibility. This also applies to a sole-trader physiotherapy practice.
On top of that comes GDPR -- records contain health data, so their storage must meet security requirements and the principle of storage limitation.
How long should you keep records?
The Patient Rights Act sets out retention periods. The basic rules:
| Type of record | Retention period |
|---|---|
| Medical records (general rule) | 20 years from the end of the calendar year of the last entry |
| Patient death due to bodily injury / poisoning | 30 years from the end of the calendar year of death |
| X-ray images kept separately from records | 10 years from the end of the year taken |
| Referrals / orders | usually 5 years from the end of the year completed |
| Records for children under 2 | 22 years |
For a typical physiotherapy practice, the general rule is key: 20 years, counted from the end of the year in which the last entry was made in the patient's file. It's worth checking the current wording of the Act, as details are occasionally amended.
From when do you count the retention period?
You count the period from the end of the calendar year in which the last entry was made, not from the first visit. Example: if a patient's last treatment was in March 2026, you count the 20-year period from 31 December 2026 -- meaning you keep the record until the end of 2046.
How to secure paper records
Records kept on paper must be stored in a way that protects against:
- access by unauthorised persons (locked cabinets, rooms)
- destruction (damp, fire, flooding, pests)
- loss and misplacement
Practical rules:
- lockable cabinets, access restricted to authorised staff only
- a dry, ventilated room with an appropriate temperature
- organisation that allows a file to be found quickly
- a log of who has access to the archive
Digital records -- an increasingly common standard
More and more practices keep records electronically (electronic medical records, EDM). This requires a system that ensures:
- integrity -- no possibility of uncontrolled changes to an entry (change history)
- confidentiality -- access control, logging, permissions
- accessibility -- the ability to read records throughout the entire retention period
- backups -- protection against data loss
- export/printing on request for authorised persons
With digital records, regular backups and protection against failure or attack (e.g. ransomware) are especially important.
CTA: Don't have an archiving procedure or a records security policy? FizjoReady's STANDARD package includes a storage and disposal procedure, an access log template and a GDPR compliance checklist. Get your archive in order without the risk. See FizjoReady packages →
Secure disposal -- how to destroy records lawfully
Once the retention period has expired, records may not simply be thrown in the bin. They must undergo secure disposal (destruction) in a way that makes the data unrecoverable. The rules:
- you may only destroy records once the statutory period has expired
- before destruction, you inform the patient of the option to collect their records (to the extent required by law)
- destruction must be permanent (a shredder, or a professional destruction service with a certificate)
- you draw up a destruction certificate (what, when, how)
A disposal certificate is proof that you acted lawfully -- it's worth keeping.
What happens when you close the practice?
Closing the practice does not end the obligation to store records. You must ensure they continue to be stored securely until the statutory periods expire -- for example, by handing them over to the entity taking over, to a designated custodian, or, in certain situations, to the relevant authority. Records must never be left to their own devices or destroyed early.
Security policy and an access log
Proper archiving isn't just about the cabinet or server itself, but also about rules written down on paper. It's worth having a short records storage policy that sets out: where and for how long you keep documents, who has access to them, what the disclosure procedure looks like, and how disposal proceeds once the period expires. Add to this a log of people authorised to access the archive. A complete set of documents like this means that during an inspection by the Sanitary Inspectorate (Sanepid), the Chamber of Physiotherapists (KIF), or in response to a complaint to the Personal Data Protection Office (UODO), you can demonstrate that data is stored lawfully and protected against unauthorised access. It's also real protection in the event of a failure, theft or other incident -- you know who is responsible for what.
Common mistakes
- storing files in a damp basement or in unlocked furniture
- destroying records before the retention period has expired
- no backups for digital records
- no disposal certificate
- leaving records unsecured after closing the practice
Frequently asked questions
How long do I have to keep a patient's file in physiotherapy?
As a general rule, for 20 years, counted from the end of the calendar year in which the last entry was made. There are exceptions, e.g. a longer period in the case of death resulting from bodily injury. Since the details are occasionally updated, it's worth confirming the current wording of the Patient Rights Act, but for typical therapy, assume 20 years.
Can I switch entirely to digital records?
Yes, keeping records electronically is permitted, and is in fact becoming the standard. However, the system must ensure integrity, confidentiality and accessibility throughout the entire retention period, plus backups. You should also make sure access is secured and that records can be printed or exported on request by authorised persons.
Can I throw old patient files in an ordinary bin?
No. Once the retention period has expired, records must be disposed of in a way that permanently prevents the data from being recovered, for example using a shredder or a professional destruction service with a certificate. Throwing files containing health data into an ordinary bin is a breach of GDPR and of confidentiality, and risks a complaint and liability.
What should I do with records when I close my practice?
The obligation to store records continues despite closure. You must ensure they continue to be stored securely until the statutory periods expire, for example by handing them over to the entity taking over or to a designated custodian. You may not destroy them early or abandon them. It's worth planning this in advance and documenting the handover.
CTA: Want an archive that's legally compliant and inspection-ready? FizjoReady's STANDARD package gives you an archiving procedure, a disposal certificate template and a checklist, all in one file. See FizjoReady packages →
Related articles:
- Medical documentation in physiotherapy -- what documents are mandatory?
- How to correctly keep a patient record in physiotherapy?
- GDPR in a physiotherapy practice -- a practical guide for physiotherapists