Maintenance of Medical Records by Hospitals in India: Legal Requirements, Retention and Patient Rights

Key Takeaways

• Hospitals and medical practitioners are required to maintain proper medical records because these records document the diagnosis, treatment, medicines, investigations, procedures, consent and progress of a patient during medical care.
• Under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, a physician is required to preserve medical records relating to indoor patients for three years from the date of commencement of treatment.
• When medical records are requested by a patient, authorised attendant or legal authority, the relevant records are required to be supplied within 72 hours under the 2002 Regulations.
• The three-year period is a minimum professional requirement for specified medical records and should not be treated as a universal rule permitting destruction of every hospital record after three years. Other laws, medico-legal requirements and institutional policies may require longer preservation.
• Hospitals covered by applicable Clinical Establishments laws and standards are also expected to maintain medical records properly and protect their confidentiality, security and integrity.
• Medical records have major evidentiary value in medical negligence and consumer disputes because they help establish what treatment was given, what advice was provided and whether accepted medical procedures were followed.
• Electronic medical records require particular attention to confidentiality, access control, security and data protection because medical information contains highly personal information concerning an individual’s health.

What Are Medical Records?

Medical records are documents containing information relating to the medical condition, diagnosis, examination, investigation, treatment and continuing care of a patient.

A medical record is not limited to a prescription or discharge summary. In a hospital, it may contain a complete chronological account of medical care beginning from admission and continuing until discharge, referral, transfer or death.

Add LawBhoomi as your preferred source on Google.

Add Now →

Hospital records may include:

• registration and identification details of the patient;
• history and clinical examination;
• provisional and final diagnosis;
• prescriptions and medication charts;
• laboratory investigation reports;
• radiological and imaging reports;
• doctor’s progress notes;
• nursing notes;
• operation theatre records;
• consent forms;
• anaesthesia records;
• intensive care records;
• blood transfusion records;
• referral and consultation notes;
• discharge summaries;
• medico-legal records;
• birth and death records; and
• follow-up instructions.

Medical records therefore perform clinical, administrative, regulatory and legal functions at the same time. They provide a continuing account of the patient’s treatment and may become important evidence if the treatment is subsequently questioned.

Why Is Maintenance of Medical Records Important?

Proper medical record maintenance is an essential part of hospital administration and professional medical practice.

Medical records help ensure continuity of treatment. A patient may be examined by several doctors, nurses, specialists and diagnostic departments during a hospital stay. Proper documentation enables every healthcare professional involved in treatment to understand the diagnosis, previous findings, medicines already administered and further treatment required.

Join live law courses and learn directly from legal professionals.

View Live Courses →

Records are also important for:

• Monitoring the patient’s progress: Regular clinical entries show whether the condition is improving, deteriorating or remaining unchanged and help doctors decide the next course of treatment.
• Avoiding duplication of tests or medicines: A complete record provides information about investigations already conducted and medicines already administered.
• Recording consent: Written documentation can establish whether legally required consent was obtained before a procedure. The broader legal principles governing consent are important because a doctor ordinarily cannot treat a patient without consent except in legally recognised circumstances.
• Communicating between healthcare professionals: Hospital treatment frequently involves several departments, making accurate documentation essential for continuity of care.
• Conducting audits: Medical records enable hospitals to review clinical outcomes, treatment practices and institutional standards.
• Responding to complaints: Treatment records provide a contemporaneous account of events when a patient raises a grievance.
• Supporting legal proceedings: Records may become significant evidence in civil, criminal, consumer or disciplinary proceedings.

From a legal perspective, properly maintained records may become one of the most important sources of evidence concerning what actually occurred during treatment.

What Is the Legal Requirement for Maintaining Medical Records?

One of the principal professional requirements is contained in the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002.

Regulation 1.3.1 provides that every physician must maintain medical records relating to indoor patients for a period of three years from the date of commencement of treatment in the prescribed standard format.

The Regulations also encourage computerisation of medical records so that records can be retrieved quickly when required.

This obligation is significant because medical record maintenance is not merely an administrative choice of a hospital. Proper documentation forms part of the professional responsibilities associated with medical practice.

Are the NMC Professional Conduct Regulations, 2023 Currently Applicable?

An important distinction is necessary.

Join live law courses and learn directly from legal professionals.

View Live Courses →

The National Medical Commission notified the Registered Medical Practitioner (Professional Conduct) Regulations, 2023 in August 2023. However, an amendment notification dated 23 August 2023 kept those Regulations in abeyance.

Therefore, the 2023 provisions should not simply be presented as having replaced the existing medical ethics framework without mentioning their present status.

For medical record maintenance, the requirements under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 continue to remain important.

How Long Must Hospitals Keep Medical Records?

For indoor patients, Regulation 1.3.1 of the 2002 Regulations specifies a minimum period of three years from the commencement of treatment.

This three-year requirement is important, but it should not be interpreted to mean that every document maintained by a hospital can necessarily be destroyed immediately after three years.

Different categories of records may need longer preservation because of:

• medico-legal proceedings;
• pending consumer complaints;
• criminal investigations;
• civil litigation;
• statutory reporting requirements;
• birth or death registration requirements;
• transplantation, blood bank or specialised medical regulations;
• insurance disputes;
• hospital accreditation requirements; or
• internal retention policies.

Where litigation is pending or reasonably anticipated, destruction of relevant records may also create serious evidentiary difficulties.

Hospitals therefore generally require a structured record-retention policy identifying how long different categories of documents must be preserved instead of applying a single retention period to every hospital record.

When Must Medical Records Be Given to a Patient?

Regulation 1.3.2 of the 2002 Regulations provides an important rule concerning access to medical records.

Learn at your own pace with LawBhoomi's recorded law courses.

View Recorded Courses →

Where a request is made by:

• the patient;
• an authorised attendant; or
• legal authorities involved,

the request should be acknowledged and the relevant documents are required to be issued within 72 hours.

This requirement recognises that information about medical treatment cannot ordinarily be withheld merely because the original records are maintained in the hospital’s custody.

Medical records may be required for several purposes, including further treatment, a second medical opinion, insurance claims and legal proceedings. They may also become important evidence where a patient considers filing a medical negligence case before a Consumer Commission.

What Happens If Medical Records Are Not Supplied Within 72 Hours?

The 2002 Regulations specifically deal with failure to maintain or provide records.

Regulation 7.2 treats failure to maintain indoor-patient records for the required period and refusal to provide them within the prescribed period as professional misconduct capable of attracting disciplinary action.

Depending on the circumstances, failure to provide records may also become relevant in consumer proceedings, medical negligence disputes or proceedings before regulatory authorities.

Medical negligence may give rise to several possible remedies depending on the nature of the alleged wrong. Complaints relating to professional misconduct may proceed through the medical regulatory framework, while claims concerning deficient medical services may in appropriate cases be pursued through consumer law. The available forums for a medical negligence complaint depend on the nature of the relief sought.

Who Owns Hospital Medical Records?

The question of ownership requires some distinction between the physical record and the information contained in that record.

Hospitals generally maintain and retain original medical files as part of their institutional records. Original case sheets, nursing records and other hospital documents may therefore remain in the hospital’s custody.

However, the hospital’s custody of the original record does not eliminate the patient’s right to obtain relevant information and copies where access is legally required.

This distinction is particularly important where a patient requires documents for:

• obtaining further treatment;
• consulting another doctor;
• making an insurance claim;
• seeking a second medical opinion;
• filing a consumer complaint; or
• pursuing legal proceedings.

Hospitals should therefore maintain proper procedures for receiving, verifying and responding to requests for medical records.

What Records Should a Hospital Maintain?

There is no single identical record format for every hospital because the required documentation varies according to the nature of treatment, type of institution and applicable laws.

However, a comprehensive hospital medical file commonly contains several categories of records.

Admission and Identification Records

These records usually contain the patient’s identifying information, date and time of admission, hospital registration number, referring doctor and relevant demographic details.

Correct identification is essential because an incorrectly labelled record may result in treatment errors and serious legal complications.

Medical History and Examination

The treating doctor should record relevant symptoms, medical history, previous illnesses, allergies, clinical findings and provisional diagnosis.

Significant changes in the patient’s condition should also be documented during treatment.

Accurate records are especially important where a dispute later arises regarding diagnosis. A wrong diagnosis does not automatically constitute negligence; the relevant question is generally whether reasonable medical skill and care were exercised. The legal position relating to wrong diagnosis and medical negligence therefore depends heavily on the surrounding facts and available clinical records.

Investigation Records

Laboratory tests, pathology reports, X-rays, scans and other investigations form an important part of the medical record.

Where treatment decisions depend on a particular investigation, accurate preservation of that report may later help establish why a particular course of treatment was adopted.

Medication Records

Medicines prescribed and administered should be properly documented.

Records may include the drug name, dose, frequency, route of administration and relevant changes made during treatment.

Medication records can be especially important where questions arise regarding an incorrect medicine, dosage error, adverse reaction or delay in administering treatment.

Consent Forms

Where informed consent is legally or medically required, properly recorded consent becomes an important part of the patient’s medical documentation.

Consent forms may be particularly relevant for surgery, anaesthesia, blood transfusion and certain invasive procedures.

However, a signed form does not necessarily resolve every legal question relating to consent. Informed consent involves communication regarding the proposed procedure and relevant information necessary for a valid decision. Medical records should therefore document the consent process appropriately.

Operative and Anaesthesia Records

Surgical cases generally require detailed documentation of the procedure performed, findings during surgery, complications, persons involved and post-operative instructions.

Anaesthesia records ordinarily document the anaesthetic technique, drugs administered, monitoring and significant events occurring during the procedure.

These records may become particularly important where an unexpected complication occurs during surgery or immediately after the procedure.

Nursing Records

Nursing documentation may record vital signs, medicines administered, fluid intake, patient observations, doctor instructions and changes in clinical condition.

These records can be particularly important in establishing the sequence of events during hospitalisation.

Discharge Summary

The discharge summary brings together the important aspects of hospital treatment.

It generally records the diagnosis, investigations, treatment provided, procedures performed, condition at discharge, prescribed medicines and follow-up instructions.

A clear discharge summary facilitates continuity of treatment after the patient leaves the hospital.

What Are the Requirements Under the Clinical Establishments Framework?

The Clinical Establishments (Registration and Regulation) Act, 2010 provides a regulatory framework for registration and minimum standards of clinical establishments.

The legislation does not operate uniformly across every State in exactly the same manner. Implementation depends upon the States and Union Territories to which the central legislation applies or which have adopted it, while some States operate under their own clinical establishment or nursing-home legislation.

The Clinical Establishments framework contemplates maintenance of appropriate records, reports, health information and statistics by healthcare institutions.

Hospital standards under the framework also emphasise that:

• medical records may be maintained physically or digitally;
• confidentiality, security and integrity of records should be ensured;
• inpatient records should comply with applicable national or local law, professional guidelines and court directions; and
• hospitals should maintain health information and statistics required for national programmes, notifiable diseases and emergencies.

Accordingly, hospital record obligations may arise not only from medical professional ethics but also from applicable establishment-specific regulation.

Can Hospitals Maintain Medical Records Electronically?

Yes. Medical records may be maintained electronically, and professional regulations encourage computerisation for quick retrieval.

Electronic records can improve continuity of care because information may be accessed rapidly across different hospital departments.

However, electronic records create additional responsibilities concerning:

• access control;
• authentication;
• confidentiality;
• secure storage;
• data backup;
• protection against unauthorised alteration;
• cybersecurity;
• audit trails; and
• controlled disclosure.

A hospital should be able to determine who created or modified important entries and when changes were made.

Digital record systems should also reduce the possibility of unauthorised alteration while ensuring that legitimate corrections remain identifiable.

How Does Data Protection Law Affect Medical Records?

Medical records frequently contain extensive digital personal data, including information relating to diagnosis, treatment and health conditions.

The Digital Personal Data Protection Act, 2023 establishes a framework governing processing of digital personal data in India. Hospitals processing digital patient information may therefore fall within the data-protection framework to the extent the Act and relevant provisions are in force.

The Digital Personal Data Protection Rules, 2025 were notified with phased commencement. This phased implementation is important because not every provision of the Rules became operational simultaneously.

The increasing use of electronic hospital systems makes data protection particularly important. Hospitals may hold extensive information relating to health conditions, diagnostic reports, contact details, identification documents, insurance information and treatment history.

Appropriate systems should therefore be maintained to prevent:

• unauthorised access;
• accidental disclosure;
• improper sharing;
• alteration or deletion;
• loss of records;
• cyberattacks; and
• disclosure to persons who have no lawful basis for accessing the information.

Medical record management in the digital environment consequently involves both preservation of records and protection of the information contained in them.

Are Medical Records Confidential?

Medical information is ordinarily confidential because it concerns the private health condition of an individual.

Hospitals and medical practitioners should therefore ensure that records are not disclosed indiscriminately to unrelated persons.

Access should ordinarily be restricted to persons involved in treatment, authorised representatives or persons legally entitled to obtain the information.

The professional duty of confidentiality is an important part of the doctor-patient relationship. The circumstances in which a doctor may disclose a patient’s medical information without consent are limited and depend on the applicable legal or professional exception.

Confidentiality is therefore not absolute. Disclosure may be required or permitted in situations involving:

• court orders;
• statutory reporting duties;
• medico-legal investigations;
• notifiable diseases;
• legally recognised risks to another person or the community;
• lawful requests by public authorities; or
• other situations specifically recognised by law.

The governing principle is therefore one of confidentiality subject to lawful disclosure, rather than complete secrecy in every circumstance.

Can Entries in Medical Records Be Altered Later?

Medical records should accurately reflect events as they occurred.

An original medical entry should not ordinarily be secretly erased, overwritten or modified merely because an error has subsequently been noticed or a dispute has arisen.

Where a legitimate correction is necessary, good medical-record practice requires the correction to remain traceable. The original entry, correction, person making the correction and date or time should be identifiable where appropriate.

Unauthorised alteration of hospital records may seriously affect their credibility and may become significant evidence in litigation or regulatory proceedings.

Electronic systems should similarly maintain appropriate audit trails so that material amendments are traceable.

Why Are Medical Records Important in Medical Negligence Cases?

Medical negligence disputes often concern events that occurred months or years before a case reaches a court or Consumer Commission.

Medical records therefore become crucial because they provide contemporaneous evidence of the treatment actually given.

Medical negligence is closely connected with the general principles of negligence under the law of torts. A claimant generally has to establish the relevant duty of care, breach of the required standard, causation and resulting damage.

The records may help determine:

• when a patient was examined;
• what symptoms were reported;
• what diagnosis was considered;
• what investigations were ordered;
• what medicines were prescribed;
• whether consent was obtained;
• when surgery was performed;
• what complications developed; and
• what steps were taken in response.

Incomplete or missing documentation does not automatically establish negligence in every case. However, where the hospital is expected to possess information concerning treatment but cannot produce relevant records, the absence of documentation may become an important evidentiary circumstance.

Similarly, an unsuccessful treatment or adverse result does not by itself establish medical negligence. The issue ordinarily remains whether the doctor or hospital exercised the level of reasonable professional care required in the circumstances.

This makes record maintenance not merely an administrative exercise but a significant element of medico-legal risk management.

Can Poor Medical Records Amount to Deficiency in Service?

Poor record maintenance may become relevant under consumer law where medical services fall within the applicable consumer protection framework.

The Consumer Protection Act, 2019 provides remedies relating to deficiency in services. In appropriate healthcare cases, deficiencies connected with treatment, hospital administration or failure to provide required records may therefore become relevant before a Consumer Commission.

Medical records can be particularly significant in consumer disputes because they help establish what services were provided, when treatment was given and whether the standard of care alleged by either side is supported by contemporaneous documentation.

However, every defect in documentation will not automatically result in compensation. The legal effect depends upon the nature of the omission, applicable obligation, harm caused and issues involved in the particular dispute.

What Are the Consequences of Poor Medical Record Maintenance?

Failure to maintain adequate hospital records can lead to several consequences depending on the circumstances.

Professional Disciplinary Action

Failure by a medical practitioner to preserve indoor-patient records or provide them within the prescribed period may amount to professional misconduct under the medical ethics regulations.

Professional disciplinary proceedings are different from claims for compensation. The purpose of disciplinary proceedings is primarily to examine professional conduct and compliance with ethical requirements.

Consumer Liability

Failure to provide records, unexplained gaps in documentation or poor record-keeping may become relevant when a patient alleges deficiency in medical services.

Whether the patient can invoke consumer jurisdiction depends upon the requirements of consumer law. The question of who qualifies as a consumer under the Consumer Protection Act, 2019 may therefore become relevant in medical disputes.

Difficulty in Defending Medical Negligence Claims

A hospital may have provided proper treatment but may find it difficult to demonstrate what was done if contemporaneous records are absent.

Statements made several years later generally cannot replace complete clinical documentation made during treatment.

In many disputes, properly maintained records are therefore important not only for patients but also for doctors and hospitals defending allegations of negligence.

Regulatory Consequences

Where applicable clinical-establishment legislation or minimum standards require maintenance of records, non-compliance may affect regulatory proceedings concerning the establishment.

The precise consequences will depend upon the applicable Central or State framework.

Privacy and Data-Security Risks

Improper storage or unauthorised disclosure of records may compromise patient confidentiality and create liability under applicable privacy, contractual, professional or data-protection rules.

This concern has become more significant with the increasing use of electronic hospital information systems, cloud storage and digital sharing of diagnostic information.

What Should a Hospital Medical Record System Ensure?

An effective hospital record-management system should ensure that records are:

• Accurate: Entries should correctly record the patient’s condition, treatment and clinical events. Incorrect documentation can affect both future treatment and the evidentiary reliability of the record.
• Complete: Important clinical information should not be omitted. Diagnosis, investigations, medicines, procedures, consent and significant developments should be properly documented wherever applicable.
• Contemporaneous: Records should ordinarily be made when treatment or observation occurs rather than reconstructed much later. Contemporaneous records usually provide a more reliable account of clinical events.
• Identifiable: Entries should identify the healthcare professional responsible wherever applicable. This helps establish accountability and makes the record easier to understand.
• Secure: Physical and electronic records should be protected from unauthorised access, loss, accidental destruction and damage.
• Retrievable: Hospitals should be able to locate records promptly, particularly when requested by patients, authorised representatives, courts or regulatory authorities.
• Confidential: Access should be restricted to authorised persons and disclosure should take place only in accordance with professional and legal requirements.
• Preserved appropriately: Records should be retained for the legally required period and longer wherever another legal, regulatory or medico-legal requirement applies.
• Traceable: Material corrections or amendments should be made in a manner that does not conceal the original record and allows legitimate changes to be identified.

Conclusion

Maintenance of medical records by hospitals is an important legal, professional and administrative responsibility in India. Medical records provide continuity of treatment, protect patient interests, assist hospital administration and become critical evidence whenever the quality of medical care is questioned.

Under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, physicians must preserve indoor-patient records for at least three years from the commencement of treatment and provide requested records to patients, authorised attendants or legal authorities within 72 hours. Failure to comply with these professional requirements may have disciplinary consequences.

Hospitals may additionally be governed by the Clinical Establishments framework, State-specific healthcare laws and specialised statutory requirements. The exact legal obligations may therefore differ depending upon the nature of the establishment, location, category of record and medical service involved.

The three-year requirement should be understood as an important minimum professional obligation rather than a universal destruction rule for every category of hospital document. Medico-legal records, records connected with pending disputes and documents governed by specialised laws may require longer preservation.

Medical records are also closely connected with medical negligence, informed consent, patient confidentiality, consumer protection and data-protection law. Proper documentation can assist patients in understanding the treatment provided while also enabling doctors and hospitals to demonstrate the medical care that was actually delivered.

With healthcare increasingly moving towards electronic systems, medical record management now involves not only proper documentation but also secure digital storage, controlled access, privacy protection and reliable retrieval. A properly maintained medical record ultimately supports continuity of care, accountability and the fair resolution of disputes arising from medical treatment.