How long must an Indian clinic keep medical records?

Every clinic owner has heard "three years". It is one of those numbers that circulates without its source attached, which is a problem, because the source is narrower than the number suggests and there is a second number that matters more.

Where three years comes from

The Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 say it plainly. Regulation 1.3.1 requires every physician to maintain the medical records of indoor patients for three years from the date of commencement of treatment, in the standard proforma at Appendix 3.

Regulation 1.3.2 carries the obligation that actually generates complaints. Where a request for records is made by the patient, an authorised attendant, or legal authorities, it must be acknowledged and the documents issued within 72 hours.

Why a 2002 regulation is still the operative one

This is the part where a lot of what you will read online is wrong, and confidently so.

The NMC published the Registered Medical Practitioner (Professional Conduct) Regulations, 2023 on 2 August 2023. Three weeks later, after sustained objection from the IMA and others, the Commission put them in abeyance and confirmed they would not be operative until a further gazette notification. The 2002 code was restored with immediate effect.

That abeyance has not been lifted. So any article dated August 2023 describing your new record-keeping duties is describing rules that never came into force. If your clinic policy was drafted from one of those, it is built on a regulation that does not exist.

"Indoor patients" is carrying a lot of weight

Read 1.3.1 again: it says indoor patients. A purely outpatient clinic is not squarely inside that three-year duty at all.

This is not permission to bin OPD records. It means the three-year figure was never the governing constraint for most small clinics, and treating it as a ceiling — "we are past three years, we can delete" — is the wrong inference from the wrong rule.

The number that should actually drive your policy

Under section 69 of the Consumer Protection Act, 2019, a consumer complaint must be filed within two years of the cause of action arising. Medical negligence claims are overwhelmingly brought this way, since deficiency in service covers medical practitioners and hospitals.

Two years sounds shorter than three, which is why it gets misread as reassuring. It is not, for two reasons. The clock runs from the cause of action, which may be identified long after the consultation. And the commission may admit a late complaint where the complainant shows sufficient cause and the commission records its reasons.

So the practical horizon is not three years and not two. It is "long enough that a claim arriving late still finds a record", and the only party harmed by a missing file is the doctor who cannot evidence what was done.

Where DPDP pulls in the opposite direction

Retention is no longer a one-way ratchet. Under the DPDP framework, a data fiduciary must erase personal data on withdrawal of consent or once the purpose is served — unless retention is necessary for that purpose or required by law.

For clinics that carve-out does most of the work: records you are obliged to keep, you keep. But it only functions if you can say which category a given record falls into. A clinic with no written retention schedule cannot answer an erasure request correctly in either direction. It will either delete something it was obliged to keep, or refuse a request it had no grounds to refuse.

The DPDP compliance deadline is May 2027, and a retention schedule is one of the few pieces of that work worth doing early, because it is cheap now and expensive to reconstruct later.

The 72-hour clock is the one that catches clinics

In practice, retention is rarely what goes wrong. Production is.

A request arrives — often from a lawyer, sometimes from a patient's family, occasionally from a court. The clock is 72 hours. If the answer involves a locked room, a year-wise stack of registers and a staff member who remembers roughly when the patient last came, 72 hours is not realistic, and the failure is documented in the acknowledgement you were obliged to give.

This is the honest argument for structured records over an archive: not that paper is illegal, but that paper cannot reliably answer a three-day deadline for a patient you saw in 2019. Moving the current file forward while leaving the archive on paper is usually the right compromise.

A retention policy that fits on one page

1. Indoor patient records — the 2002 regulation's three-year minimum, from commencement of treatment.
2. Outpatient records — set your own period deliberately, informed by the consumer-complaint horizon rather than the three-year figure.
3. Records governed by their own statutes — biomedical waste, PCPNDT and similar regimes each carry their own retention periods; those override anything you decide.
4. A named person and a route for records requests, so the 72-hour clock starts against a process rather than whoever picks up the phone.
5. A written basis for refusing erasure, so a DPDP request meets a policy instead of an improvisation.

Write it down once. The value is not the document; it is that the answer stops depending on who is at the desk.

This summarises published regulations and is not legal advice. Retention periods under other statutes may be longer; confirm your position with a qualified advisor before setting clinic policy.