Retention and disposal of patient/client records
Patient/client records created and received by services within the NSW public health system should be maintained in accordance with retention requirements outlined in the:
Back to topRetention and disposal of administrative records
Administrative records specific to the NSW public health system should be maintained in accordance with retention requirements outlined in the:
This authority should be used in conjunction with other general retention and disposal authorities that apply to the NSW public sector, such as those applying to general administrative, personnel and financial records.
Back to topStandards for records management
Under the provisions of Part 2 of the State Records Act 1998 ('Records management responsibilities of public offices'), public health organisations which are part of the NSW public health system are required to meet standards for records management that are issued by State Records NSW.
Back to topPublic access arrangements for health records
Patient identifying health records are subject to an access direction that closes the records to public access for 110 years. There is an exception for records created by the former Liverpool Asylum 1890-1959 which are open to public access.
For a complete list of access directions that cover the NSW public health sector see MHNSW.
Back to topBackground to the disposal of public hospital patient/client records
Public hospitals came under the jurisdiction of State Records NSW in 1999, with the passing of the State Records Act 1998. Prior to that disposal of patient records was regulated by the Department of Health Circular 89/13. This was a schedule for patient and clinical records which identified permanent and temporary records, and gave retention periods. This Circular was used in public hospitals, and community health services, as the basis for records disposal programs, until it was withdrawn for use after the proclamation of the State Records Act 1998 on 1 January 1999.
GDA5 covering patient records (heavily based on the Department of Health Circular) was issued in 1999. In 2004 it was revised and the General retention and disposal authority: Public health services - patient/client records (GDA17) was issued. In May 2019 a revised version of GDA17 was issued.
Back to topManaging the disposal of multiple patient files
Public health services may be managing hybrid systems where there are paper and digital records for the same patient. In some cases, it is not possible to identify if an earlier file relates to an existing patient because of common names, changes of address or insufficient recording of details. Some of these files may have been inherited from another health provider with very little in the way of listing or control systems.
For admitted patients, it is best practice to retain records relating to the same patient as if they were part of the same record (often referred to as the one patient/one file rule), and not to destroy any parts until the minimum retention period for the later admission has been reached. It is not always possible to determine whether a previous file will be relevant or not for the current care of a patient, and they may show a pattern of incidents - this is especially so for vulnerable patients.
However, if the case files have reached the minimum retention period, and they do not relate to a current patient, or it is not actually possible to tell if they relate to a current patient, health services should institute the normal internal approval processes to destroy the records. Retaining patient records beyond what they are required for clinical purposes, or for longer than the minimum retention periods set out in this authority, could be a breach of privacy legislation.
This advice relates primarily to patients who are admitted to hospitals (entries 1.1.1 and 1.1.2). In cases where an admitted patient has also attended outpatients clinics or community – based health care, a risk assessment should be conducted to confirm whether it is appropriate to apply the lesser retention period.
Back to topInterpretation of disposal triggers in GDA17
It is very important that triggers are appropriately interpreted and understood by those implementing the authority. Sometimes they rely on information from elsewhere in the organisation, e.g. date of birth of an employee. Where possible, the organisation should build the recording of the dates or required information into standard records procedures so staff will know, for example, when a file should be marked as inactive or closed. Without this information being recorded, sentencing cannot take place in a streamlined or efficient manner.
After last attendance or official contact or access by or on behalf of the patient
Access by or on behalf of the patient refers to any use made of the record or access to the records for any purpose directly concerning the patient, such as attendance by the patient, provision of a report to another health care worker or agency, access under subpoena, inspection by the patient or their legal representative. Access for research, quality assurance, audit or educational purposes or by next of kin checking medical history does not constitute access by or on behalf of the patient.
Please note that for some entries, the minimum disposal action is qualified by the term ‘whichever is longer’ e.g. entry 1.1.1:
Retain minimum of 15 years after last attendance or official contact or access by or on behalf of the patient or until patient attains or would have attained the age of 25 years, whichever is longer, then destroy
This means it is not just a case of 15 years after last attendance, or until they reach the age of 25. If a 17 year old is admitted their record will not be eligible for destruction until they reach the age of 32 (depending on the length of the stay).
Until patient attains or would have attained the age of 25 years
This requires patient/client records to be retained until the patient attains, or would have attained (in cases where the date of birth of not known or the patient dies), until the age of 25 is reached.
In accordance with the relevant legislative requirements and/or national standards and guidelines
In some cases the retention of records is mandated by legislation or standards, for example, the National Pathology Accreditation Advisory Council standards or the Assisted
Reproductive Technology Act 2007. Where specified in the disposal authority these instruments should for the disposal of records.
After action completed:
This is the most common disposal trigger in the authority. 'Action completed' refers to the final transaction of business, i.e. the final document is attached to the file and the file is closed. An action does not include a file movement or audit (unless the organisation determines an audit is an action).
In the case of paper-based registers the date of the last entry in the register may be a suitable trigger for when action is completed (providing all actions associated with the matters recorded in the register have been completed). In the case of electronic registers, however, it may be more appropriate to apply the disposal action to individual entries in the register rather than the register as a whole (as the last action on the register as a whole may be indefinite). In this case the trigger can be calculated from the last time an individual entry in the register was updated or amended, or from when the data has become obsolete (i.e. when all the business for which the record was maintained has been completed).
Until ceases to be of administrative or reference use:
This trigger usually applies where ongoing use of the records is likely to be short term, or where ongoing reference use of the records is linked to the conduct of business processes and the determination of appropriate periods for retention relies on an organisation's assessment of its own business needs and uses. This can vary from one organisation to another depending on the nature of its business.
For the purposes of implementing the authority and facilitating the production of reports or triggers for the review of these records as part of a regular disposal program the organisation may wish to define a standard retention period for these types of records. Suitable standard retention periods can be defined through discussions with business units or action officers who use the records.
Back to topManaging the calculation of triggers and disposal processes
Public offices need to consider and plan how they are to manage the implementation of triggers. For some it may be possible to automate the process. For example, a date of birth may be entered into the public office's system and automatically applied as a 'after date of birth' trigger in the records management system.
If automation is not possible, the development of business rules or procedures may be required to ensure that information is communicated by the relevant business unit to the records management unit so that the trigger is applied.
When disposal dates have been reached, procedures should also be in place to ensure the circulation of lists or details of records proposed for destruction to relevant action officers for internal authorisation and approval before any disposal action takes place. These officers can identify if circumstances have changed, e.g. extensions of contracts or legal cases, which will affect the implementation of disposal decisions and may warrant the retention of records for longer periods as appropriate.
Published December 2016/Updated October 2020/Updated November 2022
Back to top