How long must you keep medical records in Australia?

The standard rule across Australia is 7 years from the date of last service for adults, and until the patient turns 25 for minors. Records of deceased patients are typically retained for 7 years from the date of death. The exact statute changes by state: Victoria, NSW, and the ACT have dedicated Health Records Acts; Queensland, South Australia, Western Australia, Tasmania, and the Northern Territory rely on the Privacy Act 1988 (Cth) Australian Privacy Principle 11, professional Board codes, and common law duty of care. The 7-year-and-age-25 rule is the consistent retention floor across all eight Australian jurisdictions for private practices.

Limitation periods for personal injury claims by former minors generally do not start running until the minor turns 18. Retaining records to age 25 gives you the standard 7-year window after the patient is legally able to bring a claim. This is the rule embedded in every state Health Records Act and the rule professional Boards (RACGP, AHPRA, the Dental Board, the Psychology Board, and others) consistently apply.

Victoria has the Health Records Act 2001 (Vic). Health Privacy Principle 4.2 sets the retention rule: 7 years from the date of the last service for adults, until age 25 for minors. The Act applies to all health service providers in Victoria, public and private. Public providers also have obligations under the Public Records Act 1973 (Vic). Mental health services should additionally consider the Mental Health and Wellbeing Act 2022 (Vic).

New South Wales has the Health Records and Information Privacy Act 2002 (NSW), with Health Privacy Principle 12 setting the retention rule. Adults: 7 years from the date of last service. Minors: until age 25. Public health organisations also comply with the State Records Act 1998 (NSW) and the Health Records and Information Privacy Regulation 2022 (NSW), which includes specific clauses on retention by closed practices.

Queensland does not have a private-sector health records statute equivalent to NSW or Victoria. Private practices in Queensland follow the Privacy Act 1988 (Cth), specifically APP 11.2 (which requires de-identification or destruction once the information is no longer needed for any purpose), the common law duty of care, and the retention guidance issued by AHPRA and the relevant professional Boards. The functional retention floor is the same: 7 years from last service for adults, until age 25 for minors. Queensland Health (the public sector) follows the Information Privacy Act 2009 (Qld) and the Public Records Act 2002 (Qld).

These four jurisdictions do not have a dedicated private-sector health records statute. Private practices rely on the Privacy Act 1988 (Cth) APP 11, professional Board codes, and common law duty of care. The retention floor in practice is 7 years for adults and to age 25 for minors. South Australia's Code of Fair Information Practice and Tasmania's Personal Information Protection Act 2004 (Tas) apply to public sector providers. Western Australia's Health Services Act 2016 (WA) imposes confidentiality obligations on the WA public health system. The Northern Territory's Information Act 2002 (NT) applies to NT public sector agencies.

The ACT has the Health Records (Privacy and Access) Act 1997 (ACT). Schedule 1 Privacy Principle 6 sets the retention rule and applies to both public and private providers in the Territory. Adults: 7 years from last service. Minors: until age 25. Deceased: 7 years from death. The Territory Records Act 2002 (ACT) imposes additional retention obligations on public providers.

The legal retention floor is the same: 7 years for adults, to age 25 for minors. However, RANZCR and major Australian indemnity insurers commonly recommend 10 or more years of retention for high-risk imaging modalities (mammography, paediatric imaging, MRI for suspected malignancy) because of the long latency for delayed-diagnosis claims. The statute is the floor; clinical risk and indemnity guidance often pushes practical retention longer.

The retention clock for a deceased patient starts at the date of death, not the date of last service. The minimum is typically 7 years from the date of death across all Australian jurisdictions. If the estate is being administered, a coronial inquest is on foot, or a claim has been foreshadowed, you must extend retention until the matter is fully concluded, regardless of where you are in the 7-year window.

Early destruction can result in regulatory penalties under state Health Records legislation (in Victoria, NSW, and the ACT), professional misconduct findings by AHPRA, adverse evidentiary inferences in civil proceedings, and breach of APP 11 obligations under the Privacy Act 1988 (Cth). In some jurisdictions, unlawful destruction of health records carries fines into the tens of thousands of dollars for organisations. If a claim, complaint, or coronial matter is foreshadowed, you must place the record on legal hold and not destroy it under any circumstances until the matter is resolved.

APP 11.2 requires you to take reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed. This is a positive obligation, not just a permission. In practice, well-run practices apply a periodic destruction cycle, document the destruction (what, when, by whom, on what authority), and apply a legal hold to anything subject to a complaint, claim, or inquiry. Indefinite retention 'just in case' is not consistent with APP 11.

Paper records should be cross-cut shredded or incinerated by a certified secure destruction provider. Electronic records require forensic deletion: standard delete or recycle bin operations are not sufficient. Where electronic records are stored on cloud or third-party systems, you must obtain written confirmation from the vendor that the data has been securely deleted from all environments, including backups. Maintain a destruction log recording what was destroyed, when, by whom, and the authority for destruction (typically a record disposal policy clause).

Under APP 13 and equivalent state principles, individuals can request correction of their information, but the Australian Privacy Principles do not include a general 'right to be forgotten' equivalent to the EU GDPR. Healthcare providers have a competing legal obligation to retain records for the minimum statutory period. You should generally refuse deletion requests where retention is required by law, document the reason for refusal, and inform the patient of their right to escalate to the relevant Privacy Commissioner.

Records do not stop being subject to retention obligations because the practice closes. Options on closure include: transferring records to a successor practitioner with patient consent; using a secure storage service that meets APP 11 obligations; or, where a practitioner retires and no successor exists, advising patients of the transfer destination and providing a mechanism for ongoing access. Some Health Records Acts (NSW, Victoria, ACT) have specific 'closed practice' provisions. Notify the relevant Privacy Commissioner and Board where required.

No. The calculator consolidates publicly available state and federal legislation, plus professional Board guidance, into a single 30-second lookup. It does not constitute legal advice. For practice-specific obligations (especially around mental health records, deceased estates, foreshadowed claims, or complex multi-jurisdiction operations), consult your legal advisor or contact the relevant Privacy Commissioner.