Medical Record Custodianship vs Medical Record Storage: What’s the Difference?

Ask most practitioners what they need to do with their records when they retire, and the answer tends to be some version of: “store them somewhere safe.” That instinct is right, but it only captures part of what is actually required. The fuller answer involves a concept that is worth understanding clearly: medical record custodianship.

These two terms — storage and custodianship — are often used interchangeably, including by bodies and publications that should know the difference. For a practitioner planning a practice exit, treating them as synonyms can lead to arrangements that look adequate but leave significant gaps.

What medical record storage means

Storage, in the straightforward sense, refers to where records are kept. A secure server. An encrypted cloud folder. A physical archive facility. Storage is about location, security, and access controls — making sure records are not lost, damaged, or accessed by people who should not have them.

Storage is necessary. But it is not sufficient. A record that is safely stored but has no one authorised to manage it, respond to requests about it, track its retention period, or arrange its eventual destruction is not being properly managed. It is simply sitting somewhere.

What medical record custodianship means

Custodianship refers to the ongoing legal responsibility for a set of records. A custodian is not just holding files — they are taking on accountability for everything that happens to those records over their full retention period.

In practical terms, that means a health record custodian is responsible for storing the records securely, yes — but also for responding to authorised requests for access, verifying the identity and authority of people requesting records, tracking when individual records reach the end of their required retention period, and carrying out lawful destruction with appropriate documentation when that time comes.

Custodianship also requires authority — the legal standing to make decisions about the records. Someone can have physical or digital access to a set of records without having any authority over them. A colleague with login details, a family member with a copy of the files, a document storage company holding physical folders: none of these arrangements, by themselves, create a lawful custodian. Authority needs to be formally established.

Why the distinction matters after practice closure

When a practice is operating, the treating practitioner is effectively the custodian of their patients’ records — they hold the records, they manage access, they make decisions about disclosure, and they carry the responsibility. Custodianship and day-to-day practice are intertwined.

When a practice closes or a practitioner retires, that built-in custodianship ends. The records do not stop needing to be managed — but the person who was managing them is no longer in practice. A new arrangement needs to take their place.

This is where the difference between storage and custodianship becomes critical. A storage arrangement answers the question: “Where will the records be?” A custodianship arrangement answers the fuller set of questions: “Who has authority over the records? Who will respond to access requests? Who will track retention periods? Who will carry out lawful destruction?” If only the first question is answered, the others remain open — often falling to the practitioner’s family or estate, who are rarely equipped to deal with them.

Who can be a medical record custodian?

A health record custodian needs to have both the practical systems to manage records correctly and an appropriate lawful basis for holding health information. This is a higher bar than it might seem.

A colleague who agrees to hold records as a favour is not a custodian in any meaningful legal sense. Under the Australian Privacy Principles, health information can generally only be held for the purpose for which it was collected — primarily, providing a health service. A colleague who is not providing a health service to those patients will typically not have a proper basis for holding, accessing, or managing those records, regardless of their good intentions.

Family members face similar constraints. They may have physical access to records, but they do not have the authority, the knowledge of privacy law, or the systems needed to respond to access requests or manage retention correctly.

A properly constituted medical record custodian is a person or entity with formal authority over the records, a documented arrangement governing how the records will be managed, the systems and processes to respond to access requests lawfully, and the capacity to carry out retention management and eventual destruction in line with Australian law.

What to look for in a custodianship arrangement

When evaluating whether an arrangement constitutes genuine custodianship rather than storage alone, the key questions are whether the arrangement establishes clear legal authority over the records, whether there is a defined process for handling access and retrieval requests from patients, legal representatives, and other authorised parties, whether retention periods are being actively tracked, whether there is a documented process for lawful destruction, and whether the arrangement is backed by appropriate insurance and compliance infrastructure.

If the answer to any of these is unclear, the arrangement is likely closer to storage than custodianship — and the gaps will need to be filled by someone, at some point.

Making the right arrangement

For practitioners planning retirement or practice closure, the goal is to put a custodianship arrangement in place — not just a storage arrangement. The records need somewhere to be, yes. But they also need someone with authority, systems, and accountability to manage them properly for as long as the law requires.

PracMinders’ Legacy Plan is built around this distinction. It provides formal record custodianship — not just secure storage — including verified authority, access and retrieval management, retention tracking, and lawful destruction processes. For practitioners who want to prepare the groundwork before they exit practice, the Legacy Readiness Plan organises the information and access arrangements needed to establish custodianship smoothly when the time comes.

For a broader overview of what compliant long-term record management involves, see our article Medical Record Storage in Australia After Retirement or Practice Closure.