What happens to patient records when a clinic closes? The retention duty does not end with the lease. Who keeps the files, for how long, and what to tell patients.

When a clinic closes, its patient records still have to be kept for at least 3 years and handed over within 72 hours to a patient who asks. Those duties sit with the doctor under regulations 1.3.1 and 1.3.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, not with the premises, so they follow the doctor when the clinic shuts or the doctor leaves. The DPDP Act, 2023 does not force deletion of records a law requires you to keep. What no rule we found says is who should hold the files after closure or how they move; that has to be decided by the clinic, in writing, before the last day.

Who is responsible for the records after closure?

The doctor who treated the patient. Regulation 1.3.1 reads: "Every physician shall maintain the medical records pertaining to his / her indoor patients for a period of 3 years from the date of commencement of the treatment in a standard proforma laid down by the Medical Council of India and attached as Appendix 3." Regulation 1.3.2 adds that a request "either by the patients / authorised attendant or legal authorities involved" is acknowledged and the documents "shall be issued within the period of 72 hours". Regulation 7.2 makes not keeping the records for three years and refusing to provide them within 72 hours professional misconduct. None of these clauses depends on the clinic still trading. The 3-year period is written for indoor patients; for an OPD, 3 years is the sensible floor, as explained in how long to keep medical records.

Where your state applies a clinical establishments law, the establishment carries a separate duty. Section 12(1)(iii) of the Clinical Establishments (Registration and Regulation) Act, 2010 makes "provisions for maintenance of records and reporting as may be prescribed" a condition of registration and continuation. The Ministry's standard for clinics and polyclinics with dispensary under that Act (CEA/Clinic-009) says, at 9.2: "Copies of all records and statistics shall be kept with the clinical establishment concerned for at least 3 or 5 years or in accordance with any other relevant Act in force at the time". The Assam rules of 2016 say "at least 3 years" at rule 16(2). Neither text says what happens when the establishment closes.

Does the DPDP Act require you to delete records when you close?

No. Section 8(7) of the Digital Personal Data Protection Act, 2023 says a Data Fiduciary shall erase personal data when consent is withdrawn or "as soon as it is reasonable to assume that the specified purpose is no longer being served", but it opens with the words "unless retention is necessary for compliance with any law for the time being in force". The record duty in regulation 1.3.1 is that kind of law. The Act's own illustration under section 8 makes the same point for a bank that must keep identity records for ten years after an account closes: "Since retention is necessary for compliance with law, Y shall retain X's personal data for the said period."

Two DPDP points still apply once section 8 is in force, which under G.S.R. 843(E) of 13 November 2025 is eighteen months from that notification. Section 8(7)(b) requires the Data Fiduciary to "cause its Data Processor to erase any personal data" it made available, which matters when the clinic stops paying for software that holds the records. And section 8(5) security safeguards keep applying for as long as you hold the data, closed clinic or not. See our DPDP guide for clinics for the dates.

Can records be handed to another doctor or clinic?

The rules do not forbid it and do not describe it. The Ministry's Electronic Health Record Standards for India, 2016 frame the relationship this way: "The physical or electronic records, which are generated by the healthcare provider, are held in trust by them on behalf of the patient", and the data in them "is owned by the patient himself / herself". Read with regulation 7.14, which bars disclosing a patient's secrets outside the listed exceptions, the safe course is that records move to a new custodian only when that custodian is taking over the care of those patients or is the doctor who treated them, and patients are told. Where a successor doctor takes over the practice, a written handover that names the records, the date and the custodian protects both sides.

A closure plan, step by step

1. Fix the custodian in writing: the treating doctor, a partner who continues, or a successor clinic. One name, one address, one phone number.
2. Inventory what exists: OPD cards or parchis by year, prescription copies, the Register of Medical Certificates under regulation 1.3.3, consent forms, and any software account.
3. Export everything held in software before the subscription ends. Check that the export opens and that a single patient's history can be found in it.
4. Ask the software vendor in writing to erase its copy once your export is confirmed, and keep the reply. That is your section 8(7)(b) instruction to a Data Processor.
5. Store paper records somewhere dry, locked and reachable. If they go home with the doctor, they are still clinic records under the same 72-hour rule.
6. Tell patients where to ask for records: a notice at the premises for the last weeks, a line on the clinic's Google listing or website, and a reply to anyone who messages.
7. If a partner or a successor takes over, sign a short handover note listing the records, the date, and that the receiving doctor will answer requests within 72 hours.
8. Diarise the end of the retention period. Destroy paper so it cannot be read, and note the year range and date destroyed.
9. If your state's clinical establishments authority registered the clinic, check its rules for a surrender or closure intimation and file it.

When one doctor leaves a multi-doctor clinic

The clinic keeps operating and keeps the records; the leaving doctor keeps the duty for the patients they treated. In practice that means two agreements on the way out: the clinic will answer record requests for those patients within 72 hours and tell the departing doctor when a legal authority asks, and the departing doctor can get a copy of a record when a complaint or court matter involves them. Put both in the exit letter. Do not let a doctor take the only copy of the files.