How long must a clinic keep medical records in India? The 3-year rule, the 72-hour rule, and what applies to an OPD.

Keep every patient record for at least 3 years. That is the number in regulation 1.3.1 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, which the National Medical Commission re-adopted in August 2023 after putting its own 2023 regulations on hold. The regulation is written for indoor (admitted) patients and counts the 3 years from the date treatment began. A separate regulation, 1.3.2, says that when a patient, an authorised attendant or a legal authority asks for records, the request is acknowledged and the documents are issued within 72 hours. Nothing in the regulations fixes a shorter period for OPD records, and nothing stops you keeping them longer.

What the 2002 regulations actually say

The regulations were notified by the Medical Council of India on 11 March 2002 (No. MCI-211(2)/2001/Registration), published in the Gazette of India on 6 April 2002, and last amended on 8 October 2016. Section 1.3, "Maintenance of medical records", has four parts.

• 1.3.1: "Every physician shall maintain the medical records pertaining to his / her indoor patients for a period of 3 years from the date of commencement of the treatment in a standard proforma laid down by the Medical Council of India and attached as Appendix 3."
• 1.3.2: "If any request is made for medical records either by the patients / authorised attendant or legal authorities involved, the same may be duly acknowledged and documents shall be issued within the period of 72 hours."
• 1.3.3: a doctor keeps a Register of Medical Certificates with full details of every certificate issued, records the patient's signature or thumb mark, address and at least one identification mark, and keeps a copy of each certificate.
• 1.3.4: "Efforts shall be made to computerize medical records for quick retrieval."

Chapter 7 lists what counts as professional misconduct. Regulation 7.2 covers records directly: a doctor who does not maintain indoor patient records for three years as per regulation 1.3, and refuses to provide them within 72 hours when the patient or an authorised representative asks, commits misconduct. A complaint on this goes to the state medical council, which can act against the doctor's registration.

The Appendix 3 format

Appendix 3 is a one-page proforma. Its fields are: name of the patient, age, sex, address, occupation, date of first visit, clinical note (summary) of the case, provisional diagnosis, investigations advised with reports, diagnosis after investigation, advice, follow up, date and observations, signature in full, and name of the treating physician. If your OPD card or software captures these fields for each visit, you already hold a record in the prescribed shape.

The 2023 NMC regulations: notified, then put on hold

On 2 August 2023 the NMC notified the Registered Medical Practitioner (Professional Conduct) Regulations, 2023 (No. R-12013/01/2022/Ethics). Regulation 13 of that text changed the records rule in three ways: inpatient records to be kept for 3 years from the date of last contact rather than from the start of treatment; records to be supplied within 5 working days rather than 72 hours; and fully digitised records within 3 years of publication, abiding by the IT Act and data protection laws.

Three weeks later the NMC reversed course. The Registered Medical Practitioners (Professional Conduct) (Amendment) Regulations, 2023, dated 23 August 2023 and published in Gazette of India No. 596 of 24 August 2023, say the 2023 regulations "are hereby held in abeyance with immediate effect" and "shall not be operative and effective till further Gazette Notification on the subject by the National Medical Commission". The same notification adopts the 2002 regulations "with immediate effect" as if made under the NMC Act, 2019.

We checked the NMC's e-gazette and circulars pages on 22 October 2026. The abeyance notification is the latest entry on professional conduct. Until a new one appears, the 2023 numbers are not rules you can be held to, and the 2002 numbers are.

What the Clinical Establishments Act and the 2012 rules add

The Clinical Establishments (Registration and Regulation) Act, 2010 applies in the first instance to Arunachal Pradesh, Himachal Pradesh, Mizoram, Sikkim and the Union territories, and to any other state that adopts it by resolution under article 252 of the Constitution. If your state has adopted it, or has its own clinical establishments law, registration carries record-keeping conditions on the clinic itself, separate from the doctor's duty under the conduct regulations. Our clinic registration guide covers which law applies where.

Section 12(1)(iii) of the Act makes "provisions for maintenance of records and reporting as may be prescribed" a condition of registration and continuation. The Clinical Establishments (Central Government) Rules, 2012 (G.S.R. 387(E), 23 May 2012) fill that in at rule 9(iv): "the clinical establishments shall maintain and provide Electronic Medical Records or Electronic Health Records of every patient as may be determined and issued by the Central Government or the State Government as the case may be, from time to time". Rule 9 names no retention period; it points to whatever the Centre or your state issues.

Some state rules do fix a number. The Assam Clinical Establishments (Registration and Regulation) Rules, 2016, rule 16(2), require that "copies of all records and statistics shall be kept with the Clinical Establishments concerned for at least 3 years or in accordance with any other relevant Act in force at the time". We could not read the other state rule texts on the central portal this session, so check your own state's rules rather than assuming they match Assam.

Paper or digital, and what the DPDP Act adds

The 2002 regulations ask only that efforts be made to computerise records; they do not require paper. The 2012 central rules name electronic records as the thing to maintain and provide. A digital record that carries the Appendix 3 fields, prints cleanly, and can be handed over within 72 hours satisfies both.

The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) is the other law that touches a digital record. Section 3 applies it to personal data collected in digital form or collected on paper and digitised later, so a clinic that types the parchi into software is in scope. A clinic that decides why and how patient data is processed is a Data Fiduciary under section 2(i). Section 8(5) asks for reasonable security safeguards. Section 8(7) says personal data is erased once consent is withdrawn or the purpose is no longer served, "unless retention is necessary for compliance with any law for the time being in force". The 3-year duty under regulation 1.3.1 is exactly that kind of law, so the DPDP Act does not force a clinic to delete records it is required to keep. Section 11 gives the patient a right to a summary of the personal data being processed.

The Act comes into force on dates the Central Government notifies. The DPDP Rules, 2025 were notified on 14 November 2025, and the Press Information Bureau describes an eighteen-month period for phased compliance. A clinic that already restricts who can open a record, and can say who opened it, is most of the way there. How we handle this is on the security page.

What counts as a record in an OPD

The regulations say "medical records" and give the Appendix 3 format; they do not list document types. For an OPD, the working list is whatever you would need to reconstruct a visit if asked.

• The OPD card or parchi for each visit: complaint, findings, provisional diagnosis, advice. This is the Appendix 3 record.
• A copy of every prescription you issued. Regulation 1.4.1 requires your registration number on each one, and regulation 3.7.1 requires the prescription to say if you dispensed medicine yourself.
• Investigation reports the patient brought back, or at least a note of what was advised and what the result was (Appendix 3 has a field for this).
• Consent forms for any procedure done in the clinic.
• The Register of Medical Certificates and a copy of each certificate, under regulation 1.3.3.
• Money receipts, which regulation 1.4.1 also expects to carry your registration number. Keep them with the visit; they prove the date of contact.

A retention policy for a small OPD

Write it down once, put it in the clinic's policy file, and run it the same way every year.

1. Keep every visit record for a minimum of 3 years, counting from the first visit of a course of treatment. This mirrors regulation 1.3.1 and sits within what the Assam rule asks of an establishment.
2. Do not purge at exactly 3 years. A dispute, an insurance query or a council complaint can surface after the floor has passed, and the regulations do not stop you keeping records longer.
3. Store paper by year and by patient number, in a dry cupboard the receptionist can reach. If you have gone digital, make sure a printout for any single patient takes minutes.
4. Restrict access. Only the doctor and the person at the desk should be able to open a record, and someone should be able to say who opened what. That is the DPDP section 8(5) safeguard in plain form.
5. Take a backup you control. Whatever software you use, export the whole clinic's data periodically and keep the file somewhere the clinic owns.
6. If you destroy old paper, destroy it so it cannot be read, and note the date and the year range destroyed.

When a patient asks for a copy

This is the part of the rule that gets tested. Regulation 1.3.2 covers requests from the patient, an authorised attendant, or a legal authority. Regulation 7.14 separately bars disclosing a patient's secrets to anyone else except in the listed situations, such as a court order. The two questions at the desk are who is asking, and how fast you can respond.

1. Take the request in writing, even a WhatsApp message or a line in the register, with the date and time. The 72-hour clock starts here.
2. Check who is asking. The patient: give the copy. A relative or attendant: ask for the patient's written authorisation, or the patient's own message, before releasing anything. Police, court or an insurer: ask for the letter or order and keep a copy of it with the record.
3. Acknowledge the request on the day. Regulation 1.3.2 asks for an acknowledgement as well as the documents.
4. Issue the copy within 72 hours. A photocopy of the OPD card and prescriptions, or a printout from your software, is enough; the regulation does not prescribe a format for the copy.
5. Note on the file what was given, to whom, and when. If the request came from a legal authority, note the reference number.