What's in this template?
This Data Retention and Destruction Policy template gives Australian healthcare practices the document required by Australian Privacy Principle 11.2 to govern how long personal information is kept and how it is destroyed. It is built directly from the structure of the OAIC's APP Guidelines (Chapter 11), the Guide to Health Privacy and the state health records legislation (NSW HRIPA, Vic HRA, ACT HRPPA), then tailored for medical and allied health settings.
The template covers 14 sections plus a sign-off block:
- Purpose — links the policy to APP 11.2 and state health records legislation
- Scope — clinical, administrative, billing, staff, visitor, CCTV, backups
- Legislative framework — Privacy Act, NSW HRIPA, Vic HRA, ACT HRPPA, Medicare regulations
- Retention schedule — full table with retention periods, trigger dates and storage formats
- Storage during retention — physical, electronic, archive, backup
- Trigger to destroy — five-condition test before any destruction
- Destruction methods — paper, electronic, mobile devices
- Destruction register — log of every destruction event
- De-identification — alternative to destruction
- Patient and staff requests for destruction — APP 11.2 individual requests
- Roles and responsibilities — Privacy Officer, Records Custodian, Practice Manager, IT
- Annual review — destruction reviews and policy updates
- Related documents — full document set
- Approval and review — formal sign-off table
Editable placeholder fields
{{practice_name}},{{abn}}{{privacy_officer}},{{records_custodian}}{{practice_state}}— NSW, Vic, ACT, Qld, SA, WA, Tas, NT{{destruction_provider}}— your secure document destruction supplier{{review_date}},{{next_review_date}}
Retention periods at a glance
The retention schedule in section 4 includes the following minimum periods:
- Adult clinical records — 7 years from last consultation (NSW HRIPA, Vic HRA, ACT HRPPA, RACGP guidance)
- Minor (under 18) clinical records — until age 25 (whichever is later)
- Deceased patient records — 7 years from death
- Medicare and DVA billing records — minimum 7 years (regulation 8AAZA)
- Sterilisation / autoclave logs — 10 years (RACGP IPC guidance)
- Cold chain temperature logs — 5 years
- Workplace incident records — 5 years
- Staff personnel records — 7 years from termination
- CCTV footage — 30 days
- My Health Record audit logs — lifetime of registration
Who needs this policy?
Every Australian healthcare practice that holds personal information. APP 11.2 binds every APP entity, and the state health records legislation in NSW, Victoria and the ACT imposes specific minimum retention requirements that must be reconciled with the destruction obligation.
That includes:
- General practices of any size, including solo GPs
- Specialist medical practices
- Allied health practices (physiotherapy, podiatry, psychology, optometry, dental)
- NDIS providers holding participant information
- Pharmacies, pathology and diagnostic imaging providers
- Aboriginal Community Controlled Health Organisations
- Private hospitals, day surgeries and aged care providers
A common audit finding is that practices keep records "forever" by default. APP 11.2 makes that a breach — destruction (or de-identification) is required once the legal retention period has passed and there is no other reason to keep the information.
APP 11.2 at a glance
Australian Privacy Principle 11.2 requires APP entities to take reasonable steps to destroy or de-identify personal information when it is no longer needed for any purpose for which it can be used or disclosed under the APPs, unless:
- The information is contained in a Commonwealth record
- The entity is required by or under an Australian law, or a court/tribunal order, to retain the information
For healthcare practices, the second exception applies until the state minimum retention period expires (typically 7 years for adults / age 25 for minors). After that the entity must destroy or de-identify, unless another reason to keep the information exists (e.g., active litigation, ongoing complaint, research project with consent).
Privacy Act and state legislation
| State | Statute | Adult records | Minors | |---|---|---|---| | NSW | Health Records and Information Privacy Act 2002 | 7 years | Until age 25 | | Victoria | Health Records Act 2001 | 7 years | Until age 25 | | ACT | Health Records (Privacy and Access) Act 1997 | 7 years | Until age 25 | | Qld, SA, WA, Tas, NT | No state-specific health records law | RACGP recommends 7 years | Until age 25 |
How to customise this template
- Download the Word document and replace every
{{placeholder}}with your details - Set your practice state — the retention schedule defaults already work for NSW, Vic and ACT
- Confirm with your insurer / lawyer if your practice has medico-legal reasons to retain longer than the statutory minimum (paediatrics, obstetrics, mental health are common cases)
- Identify your secure destruction provider for paper records and confirm they provide a Certificate of Destruction
- Confirm electronic destruction methods with your IT support — clinical software vendors generally provide soft-delete; confirm the audit trail is retained
- Schedule the annual destruction review — usually run by the Records Custodian
- Have it approved by the Privacy Officer and practice owner and signed in the approval table
Related templates and tools
This policy is the operational document for APP 11.2. Pair it with:
- Privacy Management Plan — APP 1.2 governance backbone
- Privacy Policy — patient-facing statement of retention
- Health Records Management Policy — RACGP-aligned records lifecycle
- Data Breach Response Plan — for breaches involving the destruction process
- Computer and Information Security Policy — APP 11.1 technical safeguards
Frequently asked questions
How long must Australian medical records be kept?
For adult patients, the minimum is 7 years from the last entry in the record (NSW HRIPA, Vic HRA, ACT HRPPA, RACGP guidance). For minors, records must be kept until the patient turns 25 (or 7 years after the last entry, whichever is later). For deceased patients, 7 years from death. Medicare and DVA billing records have a minimum of 7 years under regulation 8AAZA.
What does APP 11.2 actually require?
APP 11.2 requires APP entities to take reasonable steps to destroy or de-identify personal information when it is no longer needed for any purpose for which it can be used or disclosed under the APPs, unless the entity is required by law to retain it. For healthcare records, the practical effect is "destroy after the legal retention period expires unless there is another reason to keep it".
Are practices allowed to keep records forever?
No. Indefinite retention is the most common APP 11.2 audit finding. Once the minimum retention period has passed, the practice must destroy or de-identify the records unless another exception applies (active litigation, ongoing patient care, research with consent). "We might need them one day" is not sufficient.
What's the difference between destruction and de-identification?
Destruction physically eliminates the information (shredding, secure deletion, drive destruction). De-identification removes identifiers (name, DOB, Medicare number, identifying combinations) so the information is no longer about a reasonably identifiable individual. Both are permitted under APP 11.2; de-identification is useful where data has ongoing analytical value but identification is no longer needed.
Do we need a Certificate of Destruction?
Yes for any externally destroyed paper records. The certificate evidences that destruction occurred to a recognised standard and is retained in the destruction register for at least 7 years. Internal cross-cut shredding is acceptable for low-volume destruction but should still be logged.
Can a patient ask us to destroy their record?
A patient can request destruction under APP 11.2, but the practice can refuse where the legal retention period has not expired or where another exception applies. The Privacy Officer assesses each request and responds within 30 days. The decision and reasons are recorded in the privacy register. After the retention period expires, a patient request to destroy will generally be granted.
Does this policy apply to backups?
Yes. Backups follow the same retention schedule as live records. The destruction event must include destruction of the information from primary, archive and backup storage. Where a cloud vendor holds backups, the practice obtains written confirmation of deletion from primary and backup copies.