disposing of patient recordsSometimes a complaint or clinical negligence claim can arise years after treatment. Consequently, Eric Easson, dentolegal adviser at the DDU, explains the importance of retaining and the secure storing of patient records.

Clinicians should retain clinical records for at least the minimum period recommended in national guidance or required by statute. For patients who regularly attend the practice, there is justification for retaining these patient records indefinitely to assist in the ongoing care of the patient.

One of the key principles of the General Data Protection Regulation (GDPR) is to prohibit the retention of personal data for longer than is necessary. Although 10 years is the minimum period recommended in the NHS advice on retention.

Therefore it is premature to simply destroy the records of patients who haven’t attended for more than a decade.

The DDU often receives requests for assistance many years after an event has taken place. An absence of patient records can it make it significantly harder to mount an effective defence against any allegations.

Consequently, it is advisable to adopt a retention protocol, where all records of patients who have not re-attended are reviewed after 10 years and consideration given to whether it is justifiable to retain the patient records longer than the minimum period. 

There are other benefits to retaining the records of these patients beyond 10 years, including:

  • In case the patient re-attends or a subsequent dental professional requests information on past treatments
  • Against the risk of litigation
  • For forensic identification of the deceased.

Additionally, it is advisable to retain the records of patients who may not have attended the practice for 10 years but where a clear exception justifies continued retention.

Such patients may include those who have, or intend, to make a claim, former child patients who are not yet 25 years old, or brain damaged patients to whom the statute of limitations does not apply.

Under the statute of limitations following the death of a patient, the executor or representative has a maximum of three years from the date of death to start legal proceedings in pursuit of any claim made on the patient’s behalf. And a further four months to serve those proceedings. However, these terms are subject to review should somebody make an application to court on behalf of the patient.

There is also a time limit on compensation, which is three years from the date of knowledge of an injury or negligence.

However, again a court ruling may extend this. For minors, this limit is from the age of 18.

Storing patient records

Regarding the storing of dental records, the GDC says: ‘You must not leave records where other patients, unauthorised staff or members of the public can see them’. It is also important to store patient records in line with the patient’s legal right to confidentiality.

This is outlined in the GDPR, which requires you not to keep personal data for any longer than necessary. But the ICO’s report Information Governance in Dental Practices acknowledged that the previous Data Protection Act of 1998 did not define how long is necessary for any particular type of data.

This is also the case with GDPR. Therefore it is important to establish protocols which clearly set out which data you hold. Set out how long you will retain it for and the reasoning behind any decisions.  

Disposal of records

Dispose of records in such a way that you protect patient confidentiality, and in line with waste disposal requirements. Our general advice around destroying patient records includes these points:

  • If you do need to destroy records, be sure that you do not need them for dentolegal purposes
  • Review all records carefully before destroying them
  • Electronic records can be especially difficult to destroy. Files can remain on a hard drive. Seek specialist IT advice when disposing of electronic records
  • Carry out disposal of paper records in a way that protects patient confidentiality, such as shredding
  • We recommend indefinitely retaining records where there has been an adverse incident or complaint. Even if it was satisfactorily resolved at the time.


If you’re outsourcing the destruction of patient records, you should use a licensed confidential waste disposal company and have a suitable written agreement with them.

This should acknowledge the records’ confidential nature, and confirm the company will take all reasonable steps to protect that confidentiality.

For more information If you have any concerns then contact the DDU or your own dental defence organisation for further guidance and support or visit www.theddu.com.