Health Records Management Policy Template for Australian General Practices

What's in this template?

This health records management policy covers the full lifecycle of patient health records. It maps to RACGP 5th edition Criterion C6.2, Patient health record systems. In the 6th edition, published on 26 August 2026, the same subjects sit under four criteria: CG1.A (digital clinical information systems), CG3.D (clinical documentation and communication records), CG5.B (transfer of patient health information) and F9.B (authorised access to clinical information and official documents). Accreditation assessments still use the 5th edition. The policy covers 18 sections:

1. Purpose: standards for creating, maintaining, accessing, storing, retaining, transferring, and disposing of records
2. Scope: all patient records (electronic and paper), all staff who access records
3. Practice Management System: PMS details (name, version, vendor)
4. Record Creation and Documentation Standards: contemporaneous recording, minimum documentation requirements, abbreviation standards, corrections and addendums
5. Patient Identification: unique records, identity verification, duplicate record merging, Medicare/IHI recording
6. Record Access and Security: role-based PMS access, audit logs, paper record storage
7. Results Management: electronic and paper result workflows, ordering practitioner responsibility, abnormal result flagging, safety-net audit system
8. Correspondence and Communication: incoming/outgoing correspondence, secure clinical messaging, patient communication documentation
9. Patient Access to Records: APP 12 rights, 30-day processing, fee structure, refusal grounds, APP 13 corrections
10. Record Transfer: to another practice (copy provided, original retained, secure transmission), from another practice (review and incorporation)
11. Retention Periods: adults (7 years), children (until 25), mental health (check state requirements), records under legal proceedings
12. Record Disposal: secure electronic deletion, cross-cut shredding, certified destruction, destruction register
13. Backup and Disaster Recovery: daily backup, offsite storage, quarterly testing, paper fallback
14. My Health Record: participation, upload procedures, staff training
15. Audit and Quality Improvement: annual documentation audit, results safety-net audit, duplicate record audit
16. Training: PMS induction training, annual documentation standards refresher
17. Related Policies: Privacy, IT Security, Clinical Handover, Informed Consent, Training
18. Review History

For a structured clinical record that sits inside this policy, see the Medicare Healthy Kids Check Record: one entry per check, written for that child, with the record review checklist an MBS or PSR review would apply.

Editable placeholder fields

• {{ }}Practice name{{practice_name}}, {{ }}ABN{{abn}}, {{ }}Practice address{{practice_address}}, {{ }}Phone{{phone}}, {{ }}Email{{email}}
• {{ }}Pms name{{pms_name}}, {{ }}Pms version{{pms_version}}, {{ }}Pms vendor{{pms_vendor}}: your practice management system details
• {{ }}Results review days{{results_review_days}}: safety-net days for unreviewed results
• {{ }}Secure messaging platform{{secure_messaging_platform}}: e.g. HealthLink, Medical Objects
• {{ }}Results audit frequency{{results_audit_frequency}}, {{ }}Practice principal name{{practice_principal_name}}, {{ }}Review date{{review_date}}, {{ }}Next review date{{next_review_date}}

How to customise this template

1. Download and fill in all {{ }}Placeholder{{placeholder}} fields. Start with your PMS details
2. Set your results safety-net timeframe: e.g. 7 business days for results to be reviewed before escalation
3. Confirm retention periods for your state/territory. The template provides general guidance, but check your jurisdiction
4. Review your PMS access levels: ensure role-based access is configured correctly
5. Set up your results audit: decide on frequency and who coordinates it
6. Brief all staff on documentation standards, particularly the requirement for contemporaneous, legible records

Frequently asked questions

How long must we keep patient records?

Generally: 7 years from the last entry for adult patients, and until the patient turns 25 for children. Check your state/territory legislation as some jurisdictions have longer requirements. Records involved in complaints or legal proceedings must be kept until the matter is resolved.

Can we go fully paperless?

Yes. Most practices now operate primarily with electronic records. The key is ensuring your PMS meets documentation standards, has appropriate backup and security, and maintains an audit trail. Keep paper-based fallback procedures available for system outages.

What about My Health Record uploads?

Section 14 covers My Health Record participation. Staff should be trained in upload procedures and understand which documents are uploaded (Shared Health Summaries, Event Summaries). Patient consent and access control preferences must be respected.

Can I use this for AGPAL or QPA accreditation?

Yes. Both accrediting bodies assess against RACGP 5th edition Criterion C6.2; in the 6th edition the same subjects sit under CG1.A, CG3.D, CG5.B and F9.B. Surveyors will check documentation quality, access controls, results management processes, and retention/disposal procedures.