Medical Record Storage in Australia After Retirement or Practice Closure

When a practitioner retires or closes a practice, one question comes up reliably: what do I do with the medical records? It sounds like a straightforward logistics problem. In practice, it is more complicated — and the arrangements that seem simplest are often the least adequate.

Medical record storage after practice closure is not just about where the files go. It involves ongoing legal obligations that continue long after the last appointment has been kept. Understanding what those obligations actually require is the first step to meeting them properly.

What the law says about keeping medical records in Australia

Under Australian privacy and health records legislation, patient health records must be retained for a minimum of seven years from the date of last contact for adult patients. For patients who were treated as minors, records must be retained until the patient turns 25, or for seven years from the date of last entry — whichever is the longer period. Some states and territories impose additional retention requirements beyond these federal minimums.

These obligations do not end when a practice closes or a practitioner retires. The records remain a legal responsibility regardless of whether the practice is still operating. Whoever holds those records — whether that is the practitioner, an estate executor, or a formally appointed custodian — continues to carry obligations around how the records are stored, who can access them, and how they are eventually destroyed.

What “medical record storage” usually means — and why it often falls short

When most practitioners think about medical record storage after retirement, they think about a location: an external hard drive, a cloud folder, a USB drive handed to a colleague, a box in a storage unit. The records are somewhere safe. That feels like the problem is solved.

It is not. Knowing where the records are is only the beginning. What the law requires is not just physical or digital security — it requires that someone with proper authority is managing those records, can respond to requests for access, is tracking when retention periods expire, and will carry out lawful destruction when the time comes.

A hard drive in a drawer does not do any of that. Neither does a cloud storage folder with no one authorised to act on it.

What medical record storage after practice closure actually involves

Properly managed medical record storage for a closed or retired practice has several components that general storage — of the kind offered by document management companies — does not address.

Verified authority

There needs to be a person or entity with clear legal authority over the records. This is not the same as having access to them. Authority means the right to make decisions about the records: who can see them, when they can be released, how long they must be kept, and when they can be destroyed. Without verified authority, even well-meaning management of records can create privacy and legal problems.

Authorised access and retrieval

Patients retain the right to access their own health information after a practice closes. Legal representatives, insurers, and courts may also require access to records. Someone needs to be able to receive these requests, verify the requester’s authority, and respond lawfully. This requires specific knowledge of what constitutes a valid request, what documentation is needed, and what the law permits or requires in each circumstance.

Retention management

Retention periods vary depending on the patient’s age at the time of treatment, the jurisdiction, and in some cases the profession. A practice with patients of different ages, treated over many years, may have records subject to several different retention timelines running simultaneously. Someone needs to track when each set of records reaches the end of its retention period so that destruction can be carried out lawfully — and so that records are not destroyed prematurely.

Lawful destruction

When retention periods expire, records must be destroyed in a way that permanently protects patient privacy. Deletion of a file is not always sufficient. The destruction process needs to be documented, and in many cases a record of the destruction itself must be retained for compliance purposes.

Why general document storage is not the right answer

There are many companies in Australia that offer medical document storage — secure facilities, barcoded files, retrieval on request. These services are well suited to hospitals and large organisations that have their own compliance infrastructure and simply need physical space for archived records.

They are not designed for the situation facing a retired practitioner or a closed solo practice. A document storage company holds your boxes. It does not hold authority over your records. It cannot verify patient identity, assess the lawfulness of an access request, manage retention timelines for individual patients, or carry out lawful destruction with the appropriate documentation. The box is safe. Everything around it — the authority, the obligations, the responses to requests — remains your problem.

The difference between storage and custodianship

The term that better describes what a closed or retired practice actually needs is medical record custodianship. Custodianship encompasses storage, but it also encompasses authority, access management, retention, and destruction. A custodian is not simply holding files — they are taking on the ongoing responsibility for managing those records in line with Australian law for the full retention period.

This distinction matters when you are evaluating what arrangements to put in place. The question is not just “where will my records be stored?” It is “who will have authority over them, respond to requests, manage retention, and carry out lawful destruction when the time comes?”

For more on this distinction, see our article Medical Record Custodianship vs Medical Record Storage: What Is the Difference?

Planning your arrangements before you retire

The time to put medical record storage arrangements in place is before you retire or close your practice — not after. Once a practice has closed and a practitioner is no longer active, the practical difficulties of arranging custodianship increase significantly. Systems may have lapsed, PMS access may have expired, and the people who need to act may be less familiar with the practice than you are.

If you are planning for retirement but not yet ready to formally hand over your records, the Legacy Readiness Plan is designed to prepare the groundwork in advance — documenting the information and access arrangements needed so that custodianship can be established smoothly when the time comes, or if something unexpected happens before then.

If you are retiring now or closing your practice, the Legacy Plan provides lawful, professional custodianship of your patient health records after practice closure. It covers the full scope of what compliant long-term medical record storage requires: secure transfer, authorised access management, retention tracking, and eventual lawful destruction — with an audit trail throughout.

Getting it right from the start

Medical record storage after retirement or practice closure is not a one-time task. It is an ongoing responsibility that can span years or even decades. The practitioners who manage this well are the ones who treat it the same way they treat any other professional obligation: by putting a proper arrangement in place, with the right authority and the right documentation, before it becomes urgent.