Data Privacy & Medical Records · Practical guide
Medical Records Retention in the Philippines
A clinic preparing to move discovers boxes of old patient charts. Some patients have not returned for years. Other files contain operative records, psychiatric consultations, or documents connected with a complaint. Scanning the files would save space, but deciding what may be destroyed requires a review of the records and the obligations attached to them.
Medical records preserve the history of a patient's care. They support later treatment, allow patients to understand what happened, and may become evidence in a dispute. Philippine retention requirements reflect these different purposes: the applicable period depends on the kind of record, the governing regulatory framework, and any continuing reason for preservation.
The rules governing retention
The Department of Health's Records Disposition Schedule, approved by the National Archives of the Philippines and disseminated through Department Circular No. 2021-0226, sets periods for specific categories of health records. The circular is addressed to government and private health facilities, among other recipients. Its entries distinguish patient charts from departmental report copies, films, certificates, and registers. DOH DC No. 2021-0226 and approved schedule.
The Data Privacy Act of 2012 supplies the broader retention principle. Section 11(e) permits retention for the original purpose, legal claims, legitimate business purposes, or as provided by law. A facility therefore needs a reason for keeping identifiable health information, including after its ordinary retention period has elapsed. RA No. 10173, section 11(e).
Additional requirements may arise from participation in the Philippine Health Information Exchange, specialized laboratory rules, or the public-records framework. Workplace exposure records, research files, insurance claims, and billing documents also need to be classified under their own applicable requirements.
Retention periods under the DOH schedule
The 2021 schedule provides 10 years after discharge for inpatient health records and seven years after the last consultation for outpatient health records. Other categories have separate periods and qualifications. The selected entries below must be read with any additional requirement applicable to the facility or record, including the PHIE provisions discussed in the next section.
Where the schedule divides retention into active use and storage, both form part of the total period. A chart transferred to an archive remains subject to preservation and confidentiality duties.
| Record category | Period in the approved schedule | Qualification to check |
|---|---|---|
| Inpatient health records | 10 years total: five active and five in storage | After discharge. The listed contents include doctors' orders, progress notes, nursing notes, consent forms, and operative and anesthesia records. Special remarks apply to some supplemental records. |
| Outpatient health records | Seven years total: three active and four in storage | After the last consultation. |
| Emergency-room records, non-medico-legal | Seven years total: three active and four in storage | After the last consultation. |
| Emergency-room records, medico-legal | 25 years total: 10 active and 15 in storage | The remarks also refer to seven years after case resolution; see the explanation below. |
| Psychiatric records | 25 years total: 10 active and 15 in storage | The schedule permits retention beyond 25 years if necessary; the entry does not specify a starting event. |
| Records of infants delivered, under the neonatal intensive care unit entry | Until the child reaches 18 | The inpatient delivery/newborn block also has an age-18 remark. Check these specific entries when classifying the records. |
| Dental records | Permanent | This is a distinct record category in the schedule. |
| Radiology results, departmental file copy | Two years | The entry covers CT, MRI, ultrasound, and X-ray results. A report incorporated into a patient chart must also be considered within that chart's retention requirements. |
| X-ray films, non-medico-legal | Five years | This entry concerns films; it does not establish the period for every type of digital image or report. |
| X-ray films, medico-legal | 10 years total: five active and five in storage | A separate entry from medico-legal emergency-room records. |
Source: Approved DOH Records Disposition Schedule, printed schedule pages 2–5, items 5–6, 12, 16, 27, 31, and 34–35.
The starting event matters. If an outpatient last consulted in June 2020 and returned in August 2026, the continuing chart's last consultation is now in 2026. Counting seven years from the date the chart was first opened would use the wrong reference point.
Medico-legal emergency records require a further check. Alongside the 25-year total, the schedule states: “From the date of record and/or 7 years after the case has been resolved.” The records officer and legal officer should review both dates and document the applicable disposal date. Records still needed for an unresolved case should remain under preservation.
The age-18 provisions concern the infant and delivery-related entries identified in the schedule. They do not establish a general disposal date for every pediatric record. A different classification or a continuing legal obligation may require longer preservation.
Health information exchanged through PHIE
The Health Privacy Code implementing Joint Administrative Order No. 2016-0002 provides a separate retention provision within the Philippine Health Information Exchange framework. Part 2, Rule 1, section 10(C) states 15 years for paper and electronic medical records and lifetime storage for medico-legal cases, qualified by “Subject to existing regulations.” Its scope clause concerns processing within PHIE. Health Privacy Code, Part 1, section 4; Part 2, Rule 1, section 10(C).
The significance of that scope appears in NPC Case No. 21-357. A hospital invoked the PHIE guidelines when resisting parents' access to their deceased daughter's records. The National Privacy Commission rejected that reliance, explaining that the issuance concerns information exchange through PHIE and cannot curtail rights under the Data Privacy Act. The ruling addressed access; it did not resolve the relationship between competing retention periods. NPC resolution dated 3 July 2025, page 6; read the case.
A facility should establish whether its records fall within the PHIE framework before adopting a disposal date. Where both the Code and the DOH schedule appear to govern the same records, written DOH clarification should be sought and the affected files preserved while the conflict is resolved. The later date of the 2021 circular, by itself, is insufficient to establish that every earlier requirement has been displaced.
Retention, deletion, and patient requests
A patient's request to delete a chart requires an assessment of the facility's continuing obligations. Withdrawal of consent does not automatically eliminate another lawful basis for retaining the information. The facility should explain any applicable preservation duty and the reason the record remains necessary. DPA Implementing Rules, section 34(e).
Longer retention also needs justification. The implementing rules prohibit indefinite storage for an undetermined future use. A facility retaining records beyond the scheduled period should document the purpose and review it periodically. Once the applicable obligations and justified purposes have ended, the records should enter the authorized disposal process. DPA Implementing Rules, section 19(d)–(e).
Records connected with a complaint or legal claim
A demand letter alleging negligent treatment, a PRC complaint, a subpoena, or a pending investigation should trigger a review before routine destruction. The Data Privacy Act expressly recognizes retention for establishing, exercising, or defending legal claims. RA No. 10173, section 11(e).
For example, a hospital may be reviewing an old surgical chart for disposal when the patient's family formally alleges negligence. The facility should identify and preserve the chart and related evidence while counsel assesses the claim. Relevant electronic records, audit trails, and communications may also need to be protected from routine deletion.
A written preservation instruction should identify the records covered, the reason for the hold, and who may authorize its release. Keeping the instruction under review helps the facility preserve necessary evidence without allowing a temporary hold to become unexplained permanent storage.
Additional safeguards for government records
Section 18 of RA No. 9470, the National Archives of the Philippines Act of 2007, requires prior written authority from the NAP Executive Director for the disposal or destruction of public records. An approved retention schedule establishes how records are classified and retained; a particular disposal still requires the statutory authority. RA No. 9470, sections 16–19.
Government hospitals should coordinate disposal through their records officers and the applicable NAP procedure. The completion of a retention period does not, on its own, authorize staff to shred public records. This additional public-record requirement should be distinguished from the DOH circular's inclusion of private health facilities among its recipients.
Laboratory reports, slides, and specimens
DOH Administrative Order No. 2022-0007, Philippine Standards on the Retention Period of Documents, Records, Slides and Specimens in Clinical Laboratories, addresses laboratory retention separately. The appropriate entry in its annex should be consulted for the particular material concerned. DOH laboratory issuance register; official DOH release of AO No. 2022-0007.
A laboratory's specimen and a copy of its report incorporated into a hospital chart serve different records functions. Disposal of a specimen under its applicable schedule does not establish that the report may also be removed from a chart that must still be preserved.
Medical records after a corporate contract ends
In NPC Advisory Opinion No. 2020-009, the Commission examined electronic records of pre-employment examinations conducted by a clinic for corporate clients. The contracts contemplated return or deletion of records when the service ended. The NPC explained that the clinic and corporate client could have separate purposes as personal information controllers, each requiring its own retention assessment. Payment for the examination did not determine that assessment. NPC Advisory Opinion No. 2020-009.
A clinic's contract should therefore identify the records each party holds, its lawful retention grounds, patient-access arrangements, and secure return or disposal procedures. Any requirement to delete records at termination must accommodate applicable clinical recordkeeping obligations. Patients should also be informed of the retention and deletion time frame. Read the opinion.
Digitization and preservation of originals
Scanning a chart changes its storage format. Under the Health Privacy Code's section 10(B), digitization serves preservation rather than destruction. The facility must separately assess whether the original may be disposed of under the applicable rules, including NAP authorization for public records. Health Privacy Code, Part 2, Rule 1, section 10(B).
Before replacing paper with a digital archive, staff should verify that every page, signature, attachment, and relevant annotation is legible and complete. The archive must remain retrievable and protected against alteration or loss. Planning should cover backups, access controls, and migration when software or service providers change. These measures support the availability, integrity, and confidentiality required by the DPA's security framework. RA No. 10173, section 20.
A practical retention and disposal procedure
A written policy should give staff a clear sequence for handling records:
- Classify the record. Identify whether it is a patient chart, report, image, register, certificate, or specimen, and establish who holds it.
- Identify the governing requirements. Match it to the DOH schedule and any applicable PHIE, specialized, or public-record requirement.
- Record the starting event. Use the specified trigger, such as discharge or the last consultation. Flag permanent entries and any uncertainty requiring resolution.
- Check for continued preservation. Review ongoing treatment, complaints, investigations, court orders, and other documented reasons for retention.
- Obtain the required approval. Secure NAP authority for public-record disposal and follow the facility's applicable authorization procedure.
- Destroy securely and document the action. Record the category, date range, authority, destruction method, date, and responsible persons without unnecessarily reproducing clinical details.
NPC guidance calls for disposal that leaves paper information unreadable and digital information irretrievable. A contractor handling disposal must be subject to appropriate confidentiality and data-protection terms. Intact charts in ordinary waste and recoverable files on discarded devices expose patients' information after the facility has ceased using it. NPC guidance on retention and disposal.
For the clinic preparing to move, an inventory is the practical starting point. Each category can then be assigned to continued use, protected storage, permanent preservation, or authorized disposal, with a recorded basis for the decision.