Retention rules are the kind of compliance detail that's easy to get wrong in both directions — deleting records too early because you assumed a shorter window, or holding onto everything indefinitely because nobody set a policy. Both are avoidable, and both matter: an indemnity claim, an audit, or a patient's own records request can land years after the episode of care ended, and "we don't have it anymore" is a much worse position to be in than "here it is."
This isn't legal advice — retention obligations sit across NDIS rules, state health-records legislation, and professional-body guidance, and your own indemnity insurer may recommend going further than the legal minimum. Treat this as the practical baseline, and confirm anything specific to your situation with your regulator, professional college, or insurer.
The national benchmark: 7 years, or until 25 for a minor
Across NDIS, general practice, and specialist care, the same benchmark shows up repeatedly, from slightly different sources:
- NDIS: under the NDIS (Provider Registration and Practice Standards) Rules 2018, providers must generally retain participant records for at least 7 years.
- Medical practitioners generally: the Medical Board of Australia's Good Medical Practice code and AHPRA guidance point to the same 7-year minimum from the date of the last entry.
- Minors: the widely-used extension is 7 years after the patient turns 18 — in practice, that means retaining a child's or adolescent's records until they turn 25, not 7 years from the date of the consult.
This 7-years-or-25 pairing is the one number worth actually memorising. Almost everything else below is a variation on it.
Where it gets more specific: state health-records legislation
On top of the national benchmark, several states have their own health-records legislation that's more prescriptive for private-sector providers:
- NSW: the Health Records and Information Privacy Act 2002 requires private-sector health service providers to retain records for at least 7 years after the last occasion a service was provided — or until the patient turns 25 if they were under 18 at the time. This is the most explicit state-level version of the national benchmark.
- Victoria: the Health Records Act 2001 sets out health-records principles for private-sector providers, and in practice, Victorian practices generally align to the same 7-year / age-25 benchmark via AHPRA and professional-college guidance, rather than a separately prescribed retention period.
- Other states and territories: without a standalone private-sector retention statute, providers generally rely on the same AHPRA/Medical Board benchmark as the practical standard their professional college and indemnity insurer will expect.
If you're unsure which rules apply to your specific state and client mix, that's a genuinely reasonable question for your indemnity insurer — they deal with this across every state daily and can tell you exactly what they expect you to be able to produce.
A quick reference table
Role / pathway Minimum retention Minor extension
NDIS provider 7 years Until age 25
GP (general practice) 7 years (AHPRA benchmark) Until age 25
Psychiatrist / specialist 7 years (AHPRA benchmark) Until age 25
NSW private provider 7 years (HRIP Act, explicit) Until age 25
Some indemnity insurers recommend going beyond 7 years for higher-risk work — certain procedures and longer-tail liability areas sometimes carry a 10–15 year recommendation. Worth a direct question to your own insurer rather than assuming the statutory minimum is automatically the safest number for your practice.
Where practices actually get this wrong
- Deleting on the statutory minimum without checking the minor extension. A record for a 15-year-old client isn't due for deletion 7 years after the consult — it's due 7 years after they turn 18. Get this wrong and you've destroyed a record you were legally required to keep.
- No documented retention policy at all. "We keep everything" isn't a policy if nobody's written down when (or whether) anything is ever actually reviewed or destroyed. A one-page written policy — what's retained, for how long, how destruction is verified — is worth more than an unwritten habit, especially if a regulator or insurer ever asks to see it.
- Losing records on practice closure or a change of software. Retention obligations don't pause because you changed practice management systems or the practice itself closed — records need to be exported, retained, or formally transferred, not left behind in a system nobody has access to anymore.
- Confusing a billing audit window with a clinical retention period. Medicare compliance audits typically look back a shorter window than your clinical retention obligation. Don't let "how far back Medicare might audit" set your record-keeping policy — the clinical retention rule is usually the longer, binding one.
Where ScribeUp fits into this — and where it deliberately doesn't
Worth being precise here, because it matters: ScribeUp's zero-retention design means the session audio, the transcript, and the draft note exist only for as long as it takes to generate the document — then they're gone from our side, permanently, with no exception. That's a promise about our systems, not a statement about your retention obligations.
The moment you copy a generated note into your practice management system or EHR, that note becomes your own clinical record, sitting in your system, subject to the retention rules above like any other record you've ever written. ScribeUp never becomes the thing you're relying on to meet a 7-year retention obligation — your own EHR is, exactly as it was before you used any scribe tool at all. Zero-retention on our end and meeting your own retention obligations are two separate promises, not one traded off against the other.
If documentation speed is the part of compliance you're actually short on time for, try ScribeUp free and see how much faster the note itself comes together — retention is still entirely on you, exactly as it should be.
Try ScribeUp free and see how much of this writes itself.
Start free trial