Health Data Retention Policies In India

Health data retention policies in India decide how long hospitals and clinics keep patient records, how those records are protected while they are kept, and how they are destroyed afterwards. This guide sets out the binding rules, the 2002 medical ethics regulations, the DPDP Act, 2023 and its 2025 Rules, the IT Act rules and NABH standards, and how to turn them into a workable hospital policy.

What are Health Data Retention Policies

A retention policy has to balance two pressures: records must be available for continuing care, legal cases and audits, but every extra year of storage is another year of exposure to misuse or a breach. In India, that means reading medical record rules and data protection rules together.

Policies of Health Data Retention

A hospital's retention policy should cover these elements:

1. Retention Periods

• Legal minimum: The Medical Council of India has been replaced by the National Medical Commission (NMC) under the NMC Act, 2019. The NMC's own professional conduct regulations of August 2023 were held in abeyance later that month, and the NMC adopted the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 in the meantime. Clause 1.3.1 of those regulations requires doctors to keep the records of indoor patients for 3 years from the start of treatment. This is a minimum, and many hospitals keep records for longer.
• Paediatric records: Many hospitals keep these until the patient reaches the age of majority (18 in India) plus a further period set by hospital policy.
• Special circumstances: Records of chronic illness, mental health or medico-legal cases may need much longer retention, sometimes for the patient's lifetime or indefinitely.

2. Legal Compliance

• Indian law: The Digital Personal Data Protection Act, 2023 requires personal data to be erased once its purpose is served, unless another law requires it to be kept, so the retention period has to rest on a legal or clinical reason. HIPAA, often mentioned in this context, is a United States law and matters only if a hospital handles data covered by it.
• International patients: Organisations handling data of patients from other regions may also need to consider laws such as the EU's General Data Protection Regulation (GDPR), which requires personal data, including health data, to be kept no longer than necessary for its purpose.

3. Data Security

Records must be stored securely for the whole retention period, with encryption and access limited to authorised staff for electronic records, and locked, damage-proof storage for paper files.

4. Disposal of Health Data

After the retention period, shred or incinerate paper records and permanently delete electronic files, including copies on backups. Keep a destruction log of what was destroyed, when, how and on whose authority, so you can show assessors and, if challenged, a court that disposal followed the written policy. Check before destruction that no legal hold applies.

5. Patient Access and Amendments

• Right to access: Under clause 1.3.2 of the 2002 regulations, a doctor should acknowledge a request for medical records from a patient, authorised attendant or legal authority and issue the documents within 72 hours. The DPDP Act also gives individuals rights to access, correct and erase their personal data, and the DPDP Rules, 2025 require such requests to be answered within 90 days once those provisions apply.
• Amendments: If a patient identifies an error, the provider should correct or annotate the record rather than delete the original entry.

6. Special Data Retention Cases

Clinical trial and research data may carry separate retention periods set by ethics committees or research governance frameworks. Records of deceased patients usually follow the general periods unless legal action is pending.

7. State and Institutional Variations

Rules can differ between states, and hospitals may set longer periods for their own or accreditation purposes. The NABH Accreditation Standards for Hospitals (6th edition, effective January 2025) require accredited hospitals to retain clinical records according to their own defined requirements, keep them confidential and secure during retention, and destroy them according to written guidance (standard IMS.6).

Importance of Health Data Retention Policies

• Continuity of care: past records let clinicians see history, allergies and earlier results.
• Legal compliance: records kept for the required period are evidence in legal cases and audits.
• Privacy and security: a defined end date for each record type limits how much data is exposed to breaches.

Key Aspects of Health Data Retention Policies in India

• Retention periods: The binding minimum for indoor patient records under the 2002 regulations is three years. For comparison, a draft Health Data Retention Policy that the National Health Authority (NHA) released for consultation in 2021 proposed ten years for most in-patient and out-patient records and permanent retention for medico-legal records, but it was a consultation draft, not a binding rule.
• Storage: where and how physical and electronic records are kept, so they stay intact and secure.
• Disposal: how records are destroyed once they are no longer needed, so they cannot be recovered.

Regulatory Framework for Health Data Retention in India

• Information Technology Act, 2000: The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 made under this Act treat medical records and history as sensitive personal data, require reasonable security practices and say such data should not be kept longer than required. The DPDP Act omits section 43A of the IT Act, on which these rules rest, once its main provisions come into force.
• Digital Personal Data Protection Act, 2023: India's data protection law, which received assent on 11 August 2023. The Digital Personal Data Protection Rules, 2025 were published in the Gazette on 13 November 2025 and apply in phases: a few provisions apply immediately, the consent manager rule applies after one year (November 2026), and most obligations on hospitals and other data fiduciaries apply after eighteen months (May 2027). The Act does not fix retention periods for medical records; it requires erasure once the purpose is served unless another law requires the data to be kept.
• Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002: Adopted by the NMC in August 2023. They require indoor patient records to be kept for 3 years and requested records to be issued within 72 hours.
• NABH accreditation standards: Not a law, but NABH-accredited hospitals must have a defined retention and destruction process for medical records that keeps them confidential and secure.

Challenges in Implementing Health Data Retention Policies

• Lack of standardisation: with only a short legal minimum and the NHA's 2021 policy still a draft, hospitals set very different periods, so records are handled inconsistently across the sector.
• Data security: digital records bring new vulnerabilities, such as ransomware and unauthorised access by staff, that the policy has to address.
• Mixed paper and digital records: many hospitals hold old paper files alongside newer electronic records, so the schedule has to work for both, including records that were scanned.
• Compliance and enforcement: staff need to know the rules, and the hospital needs systems and named owners to apply them.

Best Practices for Health Data Retention Policies

• Write a retention schedule: list each record type (OPD, IPD, medico-legal, paediatric, imaging, lab, billing), its retention period and the reason for it.
• Audit regularly: check that records are being kept and destroyed as the schedule says.
• Train staff: on handling, storage and disposal procedures, and on how to process patient requests for records.
• Secure the data: encryption, role-based access and secure disposal.
• Apply legal holds: suspend destruction of any record linked to pending litigation, a police case, a consumer complaint or an insurance dispute until the matter is closed, even if its retention period has ended.
• Cover every copy: backups, scanned copies, records held by outsourced labs and storage vendors, and data in old systems being retired all need the same retention and disposal rules.

Role of Technology in Health Data Retention Policies

Electronic health records make a retention policy easier to apply. Retention periods can be set per record type so the system flags records due for review or deletion, access controls and audit logs show who viewed or changed a record, and retrieval for a patient request or legal case takes minutes rather than a search through a records room. Choose a system that can export records in a standard format, so they stay readable for the full retention period even if you change vendors.

Future of Health Data Retention Policies in India

• DPDP obligations taking effect: most obligations under the DPDP Rules, 2025 apply from May 2027. Hospitals will need to map which records they must keep under medical, legal and accreditation rules and erase other personal data once its purpose is served. Watch for any sector-specific rules and for MeitY notifications changing the timeline.
• Digital health: as more facilities link records to patients' ABHA under the Ayushman Bharat Digital Mission, retention and consent will need to be managed consistently across systems.

Why Retained Health Records Matter: Key Uses

A health record, also called a medical record, is a detailed collection of a patient's medical history: diagnoses, treatments, medications, lab results and other relevant health information. Retention matters because these records keep being used long after a visit ends:

• Patient care: a central history reduces repeat tests and helps coordination when a patient changes doctors or facilities.
• Legal protection: records are evidence of the care given in malpractice cases, insurance claims and patient rights disputes, protecting both patients and providers.
• Billing and insurance: records verify the services provided and help prevent fraud.
• Medical research: retained data shows how well treatments work and how diseases progress.
• Public health and policy: aggregated data helps monitor outbreaks and allocate resources.
• Remote care: digital records make telemedicine consultations and follow-up possible.

Conclusion

With the DPDP Act and Rules coming into force in phases up to May 2027, now is the time to review your hospital's retention schedule: keep indoor records for at least the three years the 2002 regulations require, set longer periods where there is a clinical, legal or accreditation reason, and erase other personal data once its purpose is served.

Frequently Asked Questions