HPCSA record keeping: how long to keep client notes

How long must psychologists keep client records in South Africa?

Booklet 9 sets these minimum periods:

In the booklet’s own words, health records “should be stored for a period of not less than six (6) years as from the date they became dormant”.

Two details are easy to miss. The six years run from when the record became dormant, which means the last contact, and not from the first session. And six years is a minimum. Other laws or your indemnity insurer may require you to keep certain records longer.

How long to keep records of minors under the HPCSA guidelines

For a client under 18, the record is kept until their 21st birthday. The HPCSA gives the reason: a minor has up to three years after turning 18 to bring a claim.

In practice, apply whichever period ends later. A 17-year-old seen once this year reaches 21 in four years, but the six-year period for a dormant record would run longer than that. Keep the record for the longer period.

Record the client’s date of birth clearly on the file. It is the only way to work out the retention date years later.

What counts as the record

The HPCSA record keeping guidelines treat the health record as more than session notes. It includes anything made or received in the course of the client’s care:

• Session notes and risk assessments
• The signed consent form and intake form
• Assessment results and reports
• Referral letters, sent and received
• Correspondence about the client
• Accounts and invoices

Notes should be made at the time of the session or as soon as possible afterwards, be dated, and identify who wrote them. If you correct a note, the original entry should remain readable, with the correction dated. An electronic system with a version history does this for you.

Storage: paper and electronic

Booklet 9 requires records to be stored in a safe place, and electronic records to be safeguarded by passwords. POPIA adds a general duty to take reasonable technical and organisational measures to protect personal information.

• Paper: a locked cabinet in a locked room, with access limited to you.
• Electronic: password-protected, backed up, and stored where you control who has access.
• Backups: kept separately from the original, and encrypted.
• Devices: a laptop with client notes needs a password and disk encryption.

Whatever you use, you should be able to produce a complete record for one client on request, and you should be able to do it years after they last attended.

Are therapy notes confidential?

Yes. Therapy notes are confidential, and the duty of confidentiality continues after the work ends. But confidentiality has limits, and clients have rights over their own records.

• A client is generally entitled to access their own record, subject to limited exceptions where disclosure would cause serious harm.
• A court can order disclosure of records.
• Certain reporting duties override confidentiality, such as suspected abuse of a child.
• A medical scheme receives a diagnosis code when a claim is submitted.

These limits should be explained in your consent form before the first session, so the client hears them from you first.

When you close your practice or stop practising

The retention periods don’t end when your practice does. If you retire, emigrate or close, the records still have to be kept safely for the full period, and clients need to know how to reach them. Arrange in advance who will hold them. Many practitioners name a colleague in their professional will.

When a retention period has passed, destroy the record securely: shred paper, and permanently delete electronic files including backups. Keep a simple register of what was destroyed and when.

It helps to track these dates alongside your other obligations. Wholistic keeps registration renewals and CPD in a compliance tracker, and shows the HPCSA retention warning before a client record is deleted.