How to Choose a Record Custodian: What Health Practitioners Need to Know

For many practitioners, record custodianship is one of the least understood aspects of contingency planning. It often comes up late — usually when someone asks, “Who will hold your records if something happens to you?” The most common response is informal and well-intentioned: a colleague, a practice owner, or a family member. Unfortunately, record custodianship does not work that way. Choosing a record custodian is a legal, ethical, and practical decision with long-term implications for patients, families, and the practitioner’s professional obligations. A custodian is not simply someone who stores records. They carry responsibility for privacy, access, retention, and lawful disclosure for many years after clinical work has stopped. This article explains what record custodianship actually involves, common misconceptions practitioners hold, and how to choose a custodian who can meet these responsibilities safely and lawfully.

What is a record custodian?

A record custodian is the person or entity responsible for the secure storage, retention, and lawful management of patient health records when the treating practitioner is no longer able to do so. This may occur because the practitioner becomes unexpectedly unavailable, retires, closes their practice, or dies or becomes permanently incapacitated. Custodianship includes responsibility for secure storage of records, compliance with retention laws, responding to patient access requests, responding to lawful third-party requests such as subpoenas, ensuring records are not accessed improperly, and arranging lawful destruction once retention periods expire. Custodianship is ongoing — in many cases it lasts seven years or more, and longer for records relating to patients who were minors when treated.

What record custodianship is not

Many practitioners confuse custodianship with convenience or goodwill. A record custodian is not someone who “just holds onto the records,” a colleague doing a favour, a family member storing records at home, an admin staff member with login access, a practice owner who was never the treating practitioner, or a cloud platform or practice management system. A practice management system may store records, but it does not act as a legal custodian. A colleague may be trusted, but trust alone does not create lawful authority.

Why choosing the wrong custodian creates risk

When custodianship is poorly planned, several problems can arise.

Privacy breaches

Records may be accessed by people without lawful authority. This can occur unintentionally when records are stored in shared systems or passed to colleagues without patient consent.

Inability to respond to patient requests

Patients have the right to access their health records. If the custodian does not understand retention laws, access requirements, or retrieval processes, requests may be mishandled or ignored.

Burden placed on families

Families and executors are often left managing records without training, systems, or clarity about what they are legally permitted to do.

Records becoming inaccessible

Subscriptions lapse, logins expire, systems change, or passwords are lost. Over time, records can become effectively irretrievable.

Ongoing professional and legal exposure

Improper record handling can expose the practitioner’s estate to complaints, privacy breaches, or regulatory scrutiny long after practice has ended. These risks are rarely intentional. They arise because custodianship was never properly defined.

Who can be a lawful record custodian?

A lawful custodian must have clear legal authority, the capacity to store records securely, systems to manage access and retrieval, and an understanding of privacy and retention obligations.

The practitioner (while able)

While practising, the practitioner is the custodian of their own records.

A legally authorised representative

An executor or legally appointed representative may act as custodian only if they have the authority and capacity to do so. This role is often underestimated and can be burdensome.

A professional custodianship service

Specialist services exist solely to manage patient health records after practice ends. These services are designed to meet privacy, retention, and retrieval requirements over the long term.

Another practitioner (with conditions)

Another practitioner can only act as custodian if patients have provided consent, the practitioner is lawfully authorised, and appropriate storage and access systems are in place. Informal arrangements between colleagues are rarely sufficient.

Key questions to ask when choosing a record custodian

Choosing a custodian should be an intentional process. Practitioners should work through the following questions before making a decision.

Does this person or entity have lawful authority?

Custodianship must align with privacy law, health records legislation, and consent requirements. Good intentions do not substitute for lawful authority.

Can they securely store records long term?

This includes encryption, access controls, audit logs, secure backups, and protection against unauthorised access.

Can they manage retrieval requests?

Custodians must respond appropriately to patient access requests, authorised third-party requests, and subpoenas or court orders.

Do they understand retention and destruction obligations?

Records cannot be destroyed early. And they must not be kept indefinitely without reason. The custodian must understand the obligations that apply under relevant state, territory, and federal legislation.

Are they independent of emotional or relational pressure?

Family members and colleagues may struggle to decline inappropriate requests or to manage conflict when patients are distressed. Independence matters in a custodian.

Is the arrangement sustainable over many years?

Custodianship often outlasts the practitioner’s working life. Short-term solutions rarely hold up.

Why colleagues are often the wrong choice

Practitioners commonly assume that another practitioner can simply take over records. In reality, colleagues do not automatically have patient consent, may not want long-term responsibility, may change practices, retire, or relocate, may not have appropriate storage systems, and may inadvertently breach privacy obligations. What feels like a supportive solution can quietly become a liability for both parties.

The role of consent in custodianship

Consent is central to record handling. Patients must consent before their records are transferred to another treating practitioner or accessed outside lawful custodianship arrangements. A custodian must understand when consent is required, when consent is not sufficient on its own, how consent must be documented, and how to respond when consent is refused. Without clear processes, custodianship decisions can place patients’ rights at risk.

Custodianship and patient transitions

Record custodianship and a patient’s transition to a new treating practitioner are related but distinct. Custodianship ensures records are protected, retained, and accessible in accordance with Australian law. A patient’s transition to a new treating practitioner is a clinical matter, requiring patient-initiated consent and appropriate transfer processes. A well-structured custodianship arrangement supports patient transitions by making records available when patients request them or when lawful transfer occurs — but it does not itself manage clinical transitions or arrange ongoing treatment.

How custodianship fits into a contingency plan

A contingency plan should clearly state who becomes the custodian if the practitioner is unavailable, when custodianship is activated, how records will be transferred or secured, how patients will be informed, and how access requests will be handled. Custodianship should never be an afterthought.

Why this decision deserves careful consideration

Choosing a record custodian is one of the most important governance decisions a practitioner will make. It affects patient trust, privacy and confidentiality, legal compliance, the burden placed on family, and the practitioner’s professional legacy. A thoughtful custodianship arrangement protects patients long after practice ends and ensures the practitioner’s obligations are met with care and clarity.

A careful choice supports ethical, sustainable practice

Record custodianship is not about preparing for the worst. It is about preparing responsibly. When practitioners choose a custodian deliberately, they reduce risk, support patient rights, and ensure their practice can be managed lawfully and respectfully — even in their absence. That is not just good administration. It is part of ethical, professional practice.