As a specialist or general practitioner retiring from private practice, what are the privacy obligations to consider with regard the retention of clinical records? Do things differ if your practice has been sold as a going concern, or that you are simply ending practice without the clinic continuing to operate business as usual?

In simple terms you have three options for managing the patient clinical files. Firstly, you are able to transfer the notes to another provider. This may be somebody purchasing your practice or transferring the notes to another appropriate medical colleague. Secondly, you can give them to the individual patients themselves. Otherwise, you must retain the notes securely.

The Medical Council outlines in their guidance Managing Patient Records[1] that when you leave a practice or retire from it, you should arrange with another doctor to accept responsibility for your patients’ records or let your patients know if they need to collect their records from the practice. If you are a specialist in private practice you should also inform the practitioners who have referred patients to you.

Your obligations regarding managing patient records are set out in the Health Information Privacy Code (HIPC) 2020.[2] Rule 11 requires that you ensure that the health information is only being provided to the patient themselves (or their representative) or ensuring that the patient to whom the information relates approves of the disclosure and transfer of the health information to a separate practice. Rule 8 requires that before the patient file is transferred reasonable steps are taken to ensure that the information is accurate and up to date.

Transferring to another provider

If your practice has been sold as a going concern then the information would transfer to the new owners, allowed under HIPC rule 11 (2) (f) where “…the disclosure of the information is essential to facilitate the sale or other disposition of a business as a going concern”.

It is, however, not uncommon when a clinic is shutting and there is no buyer, for the notes to be transferred to a nearby practice, if the patients have not nominated another practice that they wish to attend having been given an opportunity to do so. In this case it is not business as usual and the practice is not sold as a going concern but the notes of all the patients who have not responded, will simply be transferred.

This does not necessarily mean approaching every patient that has ever been seen in the last ten years and individually asking them, but it might be reasonably achieved by putting a notice in the paper and on your website, and letting all the local GP practices know. The disclosure to the new practice would be allowed under HIPC rule 11(2)(a), as it is directly related to one of the purposes in connection with which the information was obtained (provision of health services). If transfer occurs in these circumstances, individuals should also be updated in a way that reflects HIPC rule 3, making sure individuals are aware of where their information is and how to access it.

A clinic is not able to retain health information for longer than is required. If the patient’s notes have transferred to another practice the clinic should securely destroy remaining copies. However, the HIPC does allow you to retain notes “for the purposes for which the information may lawfully be used”[3] which includes responding to complaints. One practical approach around this is to create a copy or summary of any potentially contentious files. Indeed, the Medical Council guidance[4] goes so far as to state that they “recommend that doctors keep a copy or summary of the patient records that are transferred”. If you consider a complaint is possible related to a particular file, maintaining your own record avoids the situation where a patient may produce selective notes to support a certain viewpoint, and you do not have a complete set of notes that might tell a different story.

It may be that in a shared general practice the clinic retains the notes. If remaining colleagues are going to take over care of the clinical files the patients do need to know how to obtain them. One of the purposes of these regulations regarding retention of medical records from the Privacy Commissioner’s perspective is to ensure that patients are able to access their clinical file if they want to or need to. So as a specialist retiring, you would either need to write to inform the patients seen in the last ten years that your colleague has retained their notes, or when they tried to contact you in the usual way they would be able to be informed of where the notes were to be located. This might depend on how patients would previously have contacted you and whether that mechanism will still exist, such as through shared professional rooms.

When the patient record is transferred this should be by secure electronic system or by registered mail.

Patients themselves take their notes

Another approach is to offer for patients (or their representative) to collect their clinical file themselves. Once again there are some files you may wish to still retain a copy or summary of, to avoid having nothing documented to work from later in responding to a complaint.

Retaining the notes

If you are required to retain the notes, because they are not going to another provider or the patient, you are required to do so for ten years, beginning on the day after the date shown in the health information as the most recent date on which a provider provided services to that individual.[5] This would then need to be the clinical file in its entirety. As a specialist it would not suffice, for example, to consider that you had written a letter to the GP, with a copy to the patient, because it is possible you would have additional information about your assessment and treatment that did not go into this report. You would need to keep all that additional information.

There are some circumstances when you might consider keeping records for longer than ten years. For example, in situations where it is likely that the patient might want to access the old records in the future such as children with significant health problems, or patients with long-term medical conditions.[6]

If you are going to retain the notes, HIPC rule 5 requires that the health information you possess is kept safe from loss, unauthorised access or any other misuse. There are multiple ways this can be achieved but it might include encrypting any digital patient records to ensure they are not easily accessible by anyone but you. Physical files can be stored as long as they are secure, and there are companies that provide this service. Scanning and digitalising physical files then securely destroying the physical files is an alternative approach.

Ultimately, if there were to be Privacy Commissioner scrutiny of this matter, the most important consideration is that a health agency has considered its obligations and the risks to the information, and put in place security measures that are appropriate to the sensitivity of the information and the amount of information held. An obvious risk is unwarranted disclosure or access to the information, but other factors such as loss of access and environmental factors (such as weather or pests) should also be considered. Essentially, it is a reasonableness assessment – the types of measures taken to secure one to five patient files will be slightly different to the security of 1,500 files, for example. In the latter instance, utilising a business dedicated to safely and securely storing, protecting and managing files might be expected, whereas the former will not require as much investment.

Should you be contemplating retirement from private practice, what happens to the clinical files may not be straightforward. A medicolegal consultant at Medical Protection would be pleased to discuss this with you in advance.