“Keep everything forever” is not a retention policy. Neither is “delete after three years.” A hospital holds case sheets, medico-legal files, images, registers, billing records, consent artefacts, staff records, device logs, quality workpapers, and backups. Their clocks do not all start or stop together.
Build a source-backed schedule by record class. Then prove that systems can hold, retrieve, export, freeze, and dispose of each class under control.
Start with an authority register
For every schedule row, record the source that controls it.
MEDICAL RECORDS RETENTION AUTHORITY REGISTER
Record class: ____________________________________________
Facility, department, and location: ______________________
Central source: __________________________________________
State or local source: ___________________________________
Professional or programme source: ________________________
Court order, contract, research, or payer source: ________
Start event for the clock: _______________________________
Minimum retention: _______________________________________
Longer-period trigger: ___________________________________
Legal-hold or complaint trigger: _________________________
Physical, digital, or hybrid format: _____________________
System of record and backup: _____________________________
Access owner: ____________________________________________
Disposal approver and method: ____________________________
Source checked on: ______________ Next review: ___________
Approved by legal: ______________ MRD: ___________________
Privacy: ________________________ Clinical owner: _________Do not populate the period from memory. Attach the official source, edition or date, scope, and hospital interpretation.
Use government schedules as sources, not universal shortcuts
The 2025 DGHS Hospital Manual lists physical in-patient case records and OPD records or registers at three years, and medico-legal case records and registers at ten years or until disposal of the related court case. It describes digital records as capable of indefinite storage under policy and updated guidance.
The lesson is not “three years.” It is that record type and governing source matter. A facility may face a longer period from state law, a court matter, a programme, professional duty, research requirement, patient age, transplant rule, insurance or contract, or its approved risk decision.
Build the schedule around classes and triggers
| Record class | Start event to define | Longer-hold questions |
|---|---|---|
| OPD register or visit record | Last entry, visit, or closure under source | Complaint, minor, continuing care, state rule |
| In-patient case record | Discharge, closure, or last entry | Litigation, programme, transplant, research |
| Medico-legal record | Source-defined event | Court disposal and legal hold |
| Imaging and reports | Study, report, or episode closure | Linked case, specialty rule, storage source |
| Consent and notice evidence | Event or withdrawal | Linked procedure, claim, complaint, proof need |
| Billing and claim record | Financial close or claim event | Tax, payer, dispute, audit |
| System audit and access logs | Event or system period | Security investigation, contract, incident |
| Quality and incident record | Case closure | Accreditation, legal privilege, investigation |
| Research record | Study milestone | Protocol, sponsor, ethics, regulator |
| Backup copy | Backup generation or rotation | Legal hold and source-record recovery need |
The start event is as important as the number. “Five years” cannot run if nobody knows whether the clock begins at admission, discharge, last visit, closure, adulthood, final claim, or final court action.
Add legal holds before adding deletion
A legal hold pauses normal disposal for defined records. Build the hold route before turning on any automated retention job.
Record the hold authority, scope, identifiers, record classes, systems, custodians, start time, preservation actions, acknowledgements, changes, and release approval. Include paper stores, local drives, email, scanned documents, exports, and backups where they are in scope.
The VMMC and Safdarjung Hospital official retention schedule says a record needed to dispose of another record should not be weeded out until the related issues are finally decided, even if its marked period has expired. That is a practical dependency rule: one file’s clock cannot ignore the case it supports.
Digitisation needs an acceptance test
Scanning paper does not by itself prove completeness, integrity, legibility, or lawful disposal of the original.
Test a batch with:
- page count before and after capture;
- patient and encounter matching;
- front and back where information exists;
- colour or resolution requirements;
- signatures, stamps, annotations, and attachments;
- missing-page and duplicate-page handling;
- search and retrieval by authorised staff;
- immutable or attributable correction history;
- checksum or other integrity control where used;
- approved treatment of the original.
Sample difficult files: foldouts, thermal paper, faint ink, multilingual notes, loose reports, and two patients with similar identifiers. A “scan complete” flag is worthless if nobody can read page four.
Reconcile privacy duties with record duties
The DPDP Act, 2023 governs digital personal-data processing within its scope and commencement framework. The hospital must map privacy duties alongside laws and obligations that require medical records to remain.
Do not promise a patient that every clinical record will be erased on request. Do not use retention law as a reason to keep optional marketing lists forever. Classify the data, purpose, lawful route, record duty, and system copy. Privacy and legal owners must resolve the overlap.
This is also why a deactivated user account, a deleted appointment, and a destroyed medical record cannot share one button.
Dispose with proof
When the approved period has ended and no hold or longer duty applies, create a disposal batch. It should list record class, date range, authority, review result, approvers, method, vendor or witness where used, completion date, exceptions, and certificate or log.
For digital systems, define deletion from the active store, search index, replicas, exports, and backups under the approved architecture. A backup may age out through rotation rather than immediate selective deletion. State that honestly.
Run a pre-destruction sample. Confirm that no record in the batch belongs to the wrong class, a minor or ongoing episode, an open complaint, a linked medico-legal matter, a research hold, or another exception.
Make vendor exit part of retention
Before signing a system contract, test whether the hospital can export a complete, readable record with metadata and history. Record the format, attachments, audit trail, terminology, identifiers, access controls, cost, time, and assistance needed.
Ask what happens to active records, archived records, logs, and backups when the contract ends. Ask how holds survive termination. Ask for deletion evidence only after the hospital has accepted the export and approved the exit.
A platform that stores a record but cannot return it in usable form has changed the retention problem into a captivity problem.
Product boundary
Patient Square is an AI clinical platform, not a legal archive opinion. It does not choose a hospital’s retention period, issue a legal hold, approve destruction, or certify that a scanned record can replace an original.
Verify the current India security posture, product scope, export, access, backup, correction, deletion, and exit behavior. Patient Square does not claim ABDM certification. The hospital’s qualified legal, medical-records, privacy, and clinical owners must approve the schedule and test it against real systems.