Who Owns The Patient Medical Record
Ownership of Patient Medical Records
Patients often assume they “own” their medical records, especially in the context of the Protection of Personal Information Act (POPIA). In South Africa, however, the legal position is more nuanced: patients generally have a right to access their health records, but the responsibility for creating, maintaining, and retaining those records rests with the healthcare practitioner or healthcare entity that compiled them.
Legal position
The National Health Act requires healthcare providers to create and maintain health records, while the Health Professions Council of South Africa (HPCSA) sets retention expectations for practitioners. In practical terms, this means that a patient may request a copy of their records, but that does not automatically give them the right to demand deletion where record-keeping is required by law.
Retention of records
As a general rule, health records should be kept for as long as possible, and at minimum for six years where no other rule applies. Records relating to minors should be retained until at least the patient’s 21st birthday, while records for mentally incapacitated patients should be kept for life. Certain categories require even longer retention, including occupational health and safety records, which should be kept for 20 years after treatment, and records involving slow-developing conditions, which should be retained for at least 25 years.
Where a specific statute imposes a longer retention period, that legal requirement takes precedence over general guidance. Practitioners should therefore apply the longest applicable retention rule in each case.
Deletion and destruction
When records may lawfully be destroyed, disposal must be secure and documented. Paper records should be shredded or incinerated, while electronic records must be permanently deleted using secure methods that prevent recovery. A destruction log should be maintained, including the patient’s details, the date of destruction, and the method used.
If records are stored in the cloud, practitioners should confirm with the service provider that deletion has been completed across all systems and backups where possible. This is particularly important to ensure compliance and to reduce the risk of unintended data retention.
Responding to patient requests
When a patient requests deletion, the response should be calm, clear, and legally grounded. Practitioners should explain that records cannot simply be deleted because legal and professional obligations require retention, but they can offer access to copies of the records and invite the patient to raise any concerns in writing.
Written requests are advisable because they create a proper record of the interaction and allow the practice to seek legal or compliance guidance where needed. This approach protects both the patient’s rights and the practitioner’s obligations.
Practical takeaway
The key principle is simple: patients have a right to access their records, but not an unrestricted right to have them deleted. Practitioners must balance privacy, access, and retention duties carefully, and should only destroy records when doing so is lawful, secure, and properly documented.