Data Retention

Praxi helps you comply with Australian healthcare data retention requirements by automatically managing record retention periods and secure disposal. Proper data retention is not optional - it is a legal requirement with significant penalties for non-compliance.

Critical Compliance Requirement

Australian healthcare providers are legally required to retain clinical records for a minimum of 7 years from the date of last contact for adult clients. For clients who were minors at the time of treatment, records must be retained until they reach 25 years of age, or for 7 years from last contact, whichever is later. Premature destruction of records can result in:

• Fines up to $500,000 under the Privacy Act
• Professional misconduct findings from AHPRA
• Inability to defend against malpractice claims
• Criminal prosecution in some circumstances :::

Legal Framework

Why Retention Matters

Data retention requirements exist to:

1. Protect clients - Ensure access to their health history for future treatment
2. Support continuity of care - Allow new providers to understand treatment history
3. Enable legal defence - Provide evidence in malpractice or complaints
4. Facilitate research - Allow retrospective analysis with appropriate consent
5. Meet professional standards - Demonstrate compliance with AHPRA requirements

Key Legislation

Legislation	Jurisdiction	Key Requirement
Privacy Act 1988 (as amended 2025)	Federal	APP 11.2 - destroy or de-identify when no longer needed; right to erasure (subject to healthcare exemptions)
Health Records Act 2001	Victoria	7 years adults, age 25 + 7 years minors
Health Records and Information Privacy Act 2002	NSW	7 years adults, age 25 + 7 years minors
Public Health Act 2005	Queensland	7 years from last entry
Health Services Act 2016	Western Australia	7 years minimum
Taxation Administration Act 1953	Federal	7 years for financial records

Minimum Retention Periods

Australian healthcare practices must retain records for minimum periods:

Record Type	Minimum Retention	Legal Basis
Adult clinical records	7 years from last contact	State health records acts
Minor clinical records	Until age 25, or 7 years (whichever later)	State health records acts
Mental health records	7-15 years (varies by state)	Mental health acts
Medicare claims	2 years from claim date	Health Insurance Act
Financial records	7 years	Taxation law
Audit logs	7 years	Privacy Act, professional standards

State Variations and Professional Standards

Retention requirements vary by state and may be extended by professional standards. AHPRA and professional boards may have additional requirements. When in doubt, retain longer — there is no penalty for retaining records beyond the minimum period, but significant consequences for premature destruction. :::

Special Categories

Some record types require extended retention:

Category	Retention Period	Reason
Forensic assessments	30+ years	May be required for legal proceedings
Court-ordered treatment	Indefinite	May be subject to court orders
Research data	Per ethics approval	Usually study completion + 7-15 years
Workers compensation	40 years	Long tail claims
Asbestos/hazardous exposure	40 years	Latent condition claims
Genetic information	Indefinite	Family implications

Retention by State

Clinical Records

State	Adult Records	Minor Records	Mental Health
VIC	7 years	Age 25 + 7 years	15 years
NSW	7 years	Age 25 + 7 years	7 years
QLD	7 years	Age 25 + 7 years	7 years
WA	7 years	Age 25 + 7 years	7 years
SA	7 years	Age 25 + 7 years	7 years
TAS	7 years	Age 25 + 7 years	15 years
NT	7 years	Age 25 + 7 years	7 years
ACT	7 years	Age 25 + 7 years	7 years

Configuring Retention Policies

Default Policies

1. Open Settings → Privacy and review the Data Retention Policy card
2. The default retention policies applied to your practice:

Category	Default	Configurable
Adult clinical	7 years	Yes (increase only)
Minor clinical	Age 25 + 7 years	Yes (increase only)
Medicare claims	2 years	Yes (increase only)
Financial records	7 years	Yes (increase only)
Audit logs	7 years	No

Custom Policies

Create policies for specific needs:

1. Click Add Policy
2. Configure:
   • Policy name
   • Record types affected
   • Retention period
   • Disposal method
   • Review requirements
3. Save policy

Policy Examples

Extended psychiatric records:

• Record type: Mental health clinical notes
• Retention: 15 years from last contact
• Review: Annual audit before disposal

Research participant data:

• Record type: Research-flagged records
• Retention: Per ethics approval + 7 years
• Review: Research committee approval before disposal

Retention Triggers

When Does Retention Start?

Trigger	Record Types	Calculation
Last service date	Clinical records	7 years from last appointment
Last contact	Client profiles	7 years from any contact
Claim date	Medicare claims	2 years from submission
Invoice date	Financial records	7 years from invoice
Creation date	Audit logs	7 years from event

Minor Client Retention

For clients under 18 at last contact:

1. Calculate age 25 date
2. Calculate 7 years from last contact
3. Use whichever date is later
4. Example:
   • Last contact: Age 16 (2024)
   • Age 25: 2033
   • 7 years from contact: 2031
   • Retain until: 2033

Retention Dashboard

Viewing Records Status

Retention is enforced automatically — records inside a retention period cannot be erased, and erasure requests show the retention reason per record. A consolidated view covers:

Section	Content
Summary	Total records, retention status
Approaching Disposal	Records within 90 days of disposal eligibility
Requires Review	Records flagged for manual review
Recently Disposed	Audit trail of disposals

Retention Indicators

Status	Meaning	Icon
Active	Within retention period	Green
Approaching	90 days from disposal eligibility	Yellow
Eligible	Ready for disposal review	Orange
Hold	Legal or administrative hold	Red
Disposed	Securely destroyed	Grey

Record Holds

When to Apply Holds

Apply holds when:

• Legal proceedings ongoing or anticipated
• Complaints under investigation
• Research requirements
• Regulatory audits
• Client disputes
• Insurance claims

Creating a Hold

Legal holds are applied at the document level:

1. Open Clients → [Client] → Documents
2. Select the document(s) and choose the legal hold action
3. Record the reason for the hold

Subpoena matters apply holds as part of the subpoena workflow — see Subpoena Management.

Hold Management

Action	Process
View holds	Held documents are badged in the client's Documents tab
Release hold	Requires authorisation and a documented reason
Audit holds	Review active holds regularly (monthly suggested)

Legal Holds

Never release a legal hold without written authorisation from legal counsel. Document all hold decisions. :::

Disposal Process

Automatic vs Manual Disposal

Type	Records	Process
Automatic	System logs, temporary files	Disposed without review
Reviewed	Clinical records, client data	Requires manual approval
Never auto-dispose	Legal holds, flagged records	Manual only

Disposal Workflow

1. Identification - System identifies eligible records
2. Review - Compliance officer reviews list
3. Approval - Practice owner approves disposal
4. Notification - Stakeholders notified
5. Disposal - Secure deletion executed
6. Audit - Disposal logged permanently

Disposal Review

For each record scheduled for disposal:

1. Review records flagged for disposal (disposal is driven by approved erasure requests and retention expiry)
2. Review record details:
   • Last activity date
   • Retention calculation
   • Hold status
   • Related records
3. Select action:
   • Approve disposal
   • Extend retention
   • Apply hold
4. Document decision

Secure Destruction

Destruction Methods

Data Type	Method	Standard
Database records	Cryptographic erasure	NIST 800-88
File attachments	Secure overwrite	DoD 5220.22-M
Backup copies	Scheduled purge	Per retention policy
Paper records	Cross-cut shredding	AS/NZS 4998.2

Certificate of Destruction

After disposal:

1. System generates certificate
2. Certificate includes:
   • Records disposed
   • Disposal method
   • Date and time
   • Authorising officer
   • Verification hash
3. Certificate retained permanently

Backup Considerations

Disposed data is also removed from:

• Active database
• Replicated copies
• Point-in-time backups (after rotation)
• Offline archives (scheduled purge)

Client Data Requests

Right to Erasure (Privacy Act 2025)

The Privacy Act 2025 amendment introduced a formal right to erasure for individuals, similar to GDPR's right to be forgotten. However, healthcare providers retain strong grounds to refuse or defer erasure requests where clinical records must be maintained under health records legislation.

Praxi implements the right to erasure through a structured erasure request workflow with the following statuses:

Pending → Approved (or Partially approved) → Processing → Completed. A request can also be Rejected at review, or end as Failed if the erasure hits an error and needs attention.

Each erasure request tracks:

Field	Description
Request date	When the client submitted the request
Status	Current stage of the request (see above)
Entities affected	Which records are in scope
Exceptions	Records exempt from erasure with legal basis cited
Legal basis	Legislation citations for each retained record
Processing date	When erasure was executed

When a client requests data erasure:

1. Log the request - Clients can submit it themselves from the client portal, or staff record it against the client's record
2. Evaluate the request against retention requirements
3. If retention period complete and no holds apply:
   • Approve the erasure request
   • System processes deletion across all relevant records
   • Generate certificate of destruction
   • Provide confirmation to client
4. If retention still required (most common for healthcare):
   • Document erasure exceptions with specific legal basis (e.g., Health Records Act 2001 s.12, AHPRA record-keeping standards)
   • Partially process erasure for non-clinical data where possible
   • Explain legal retention obligations in writing
   • Offer restriction of processing (limited access)
   • Schedule future deletion when retention expires

Erasure Exceptions

Healthcare providers must document the specific legal basis for each record retained despite an erasure request. Praxi tracks these exceptions per entity with Healthcare Act citations to demonstrate compliance. Penalties for non-compliance with the Privacy Act 2025 can reach $50 million AUD. :::

Grounds to Refuse Deletion

You may (and usually must) refuse deletion requests for:

Reason	Explanation
Legal retention obligation	Health records legislation requires retention
Professional standards	AHPRA requires clinical record maintenance
Ongoing treatment	Records needed for continuity of care
Legal proceedings	Actual or anticipated legal action
Medicare requirements	Claiming records must be retained
Public interest	Research, public health, quality assurance

Responding to Requests

1. Verify client identity (prevent fraudulent requests)
2. Acknowledge request within 7 days
3. Assess records affected
4. Check for holds (legal, administrative)
5. Review retention requirements
6. Execute deletion OR provide written explanation of refusal
7. Document the request, your assessment, and response
8. Respond within 30 days

Reporting

Retention Reports

Report	Content	Frequency
Retention Summary	All records by status	Monthly
Approaching Disposal	90-day forecast	Monthly
Disposal Audit	Disposed records log	Quarterly
Hold Status	Active holds summary	Monthly

Generating Reports

1. Go to Reports → Compliance
2. Select report type
3. Set parameters
4. Generate and export

Audit Evidence

For compliance audits, export:

• Retention policy documentation
• Disposal certificates
• Hold records
• Decision logs
• Exception reports

Compliance Monitoring

Regular Reviews

Review	Frequency	Owner
Policy review	Annually	Practice Owner
Pending disposal	Monthly	Compliance Officer
Active holds	Monthly	Compliance Officer
Retention calculations	Quarterly	System + review

Exceptions

Document any retention exceptions:

1. Record affected
2. Standard policy
3. Exception applied
4. Reason
5. Authorising officer
6. Review date

Practice Closure or Sale

If Your Practice Closes

Special retention rules apply when a practice closes:

1. Notify clients - Give reasonable notice and offer records transfer
2. Transfer arrangements - Arrange with another provider to hold records
3. Retention continues - Retention periods still apply after closure
4. AHPRA notification - Notify AHPRA of practice closure
5. Storage arrangements - Secure archival for remaining retention period

If You Sell Your Practice

When selling a practice:

1. Client notification - Inform clients of ownership change
2. Consent for transfer - Obtain consent for record transfer (implied or explicit)
3. Contractual obligations - Include retention obligations in sale agreement
4. Ongoing liability - Consider ongoing responsibility for records created

Practitioner Death or Incapacity

If a sole practitioner dies or becomes incapacitated:

1. Executor responsibilities - Estate executor must arrange record custody
2. Transfer to another practitioner - Preferred option
3. Secure archival - If no practitioner available
4. Retention continues - Full retention period still applies

Best Practices

1. Conservative approach - When uncertain, retain longer (no penalty for over-retention)
2. Regular reviews - Monthly disposal queue review
3. Document decisions - Record all retention decisions with reasons
4. Train staff - Ensure team understands requirements and consequences
5. Legal consultation - Consult for edge cases and closure scenarios
6. Backup verification - Ensure backups follow same policies
7. Annual policy review - Update retention policies as legislation changes
8. Succession planning - Document what happens to records if practice closes

Troubleshooting

Retention Calculation Wrong

If retention date seems incorrect:

1. Check client date of birth (minor calculation)
2. Verify last contact date
3. Review applicable policy
4. Check for manual extensions
5. Contact support if discrepancy persists

Record Won't Dispose

If a record can't be disposed:

1. Check for active holds
2. Verify related records
3. Check audit log access
4. Review linked appointments
5. Contact support for system holds

Related

• Compliance Overview
• Audit Logs
• Managing Clients
• Organisation Settings

Was this page helpful?