The NHS General Dental Services contract (part 13, paragraph 205) requires the contractor to keep patient records for up to two years after a course of treatment has finished. However, holding onto them for longer than this may prove a vital part of your defence if you receive a claim.
Our current advice on the retention and destruction of clinical records is as follows.
Not all patient records are handled in the same way. When considering how to categorise records and their retention, it can be helpful to think of patients coming under one of four different headings.
These patients attend more or less regularly. There is every justification for retaining these records indefinitely, to assist in the ongoing care of the patient.
Patients who have not attended for 10 years
Ten years is the minimum period recommended in the revised NHS advice on retention, but it might be premature to simply destroy the records of patients who haven't attended for more than a decade, and we would not recommended doing so.
Destroying these patients' records could mean that any claims about events from more than 10 years ago are difficult to defend, potentially putting you at risk. We therefore advise adopting a retention protocol where all records of patients who have not re-attended are reviewed after 10 years. We doubt the ICO would be too critical of such a protocol.
There are arguments for retaining the records of these patients beyond ten years:
- in case the patient re-attends or a subsequent dental professional requests information on past treatments
- against the risk of litigation (and we do have experience of claims being made 'out of the blue' many years after the treatment in question)
- for forensic identification of the deceased.
Patients who have not attended for 10 years, but where a clear exception justifies continued retention
This category might include patients who have made a claim (or intend to bring one), former child patients who have not reached 25 years old, or brain damaged patients to whom the statute of limitations does not apply.
Where patients have died, there's an argument for disposing of their dental records three years and four months after the date of their death. Generally speaking, under the statute of limitations a deceased patient's executors or personal representatives have a maximum of three years from the date of death to start legal proceedings in pursuit of any claim made on the patient's behalf, and a further four months to serve those proceedings.
The way in which you store your records should comply with a patient's legal right to confidentiality and your professional obligation to respect confidentiality.
The GDC states that, 'you must not leave records where they can be seen by other patients, unauthorised staff or members of the public'.
The General Data Protection Regulation (GDPR) came into force on 25 May 2018. This requires that you don't keep personal data for any longer than necessary, but the ICO's report Information Governance in Dental Practices acknowledged that the previous Data Protection Act of 1998 did not define how long is necessary for any particular type of data - and the same is true of the GDPR.
Data controllers are therefore faced with making a judgement, and to do so properly it's crucial to know what data is held, to have a protocol for its retention (that sets out a retention schedule and rationale), and to regularly review both the retention of data, as well as the protocol itself. To routinely retain records 'indefinitely' to be on the safe side is no longer an option.
Disposal and destruction of records
Disposal of records should be done in such a way that patient confidentiality is protected, and in accordance with national and local waste disposal requirements. It's worth noting that local authorities have regarded study casts as clinical waste, which must be handled, stored and disposed of appropriately.
Our general advice around destroying records includes these points.
- If you do need to destroy records, be sure that they're not needed for dento-legal purposes.
- Review all records carefully before destroying.
- Electronic records can be especially difficult to destroy, as files can remain on a hard drive. Seek specialist IT advice when disposing of electronic records.
- Disposal of paper records should only be carried out in a way that protects patient confidentiality, such as shredding.
- We recommend that you indefinitely retain records where there has been an adverse incident or complaint, even if it was satisfactorily resolved at the time.
If you're outsourcing the destruction of records, you should use a licensed confidential waste disposal company and have a suitable written agreement with them that acknowledges the records' confidential nature, and confirms that the company will take all reasonable steps to protect that confidentiality.
This guidance was correct at publication 28/08/2019. It is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.