Patient Records Retention in Malaysia: How Long Must a GP Clinic Keep Medical Records? | Medinex

"How long do I actually need to keep this patient's file?" is a question most GP clinics answer by instinct rather than by rule — usually "forever, just in case," which creates its own storage and PDPA burden, or "a few years," which can leave you exposed if a claim surfaces later. Here's what the actual guidance says.

The number that matters: 8 years for adults, 26 for minors

Malaysian guidance on medical record retention is built around limitation periods for medical negligence claims, not an arbitrary filing preference. For private healthcare facilities, the recommended retention period is 8 years after the date of the incident, aligned with the 6-year limitation period under the Limitation Act 1953, with a buffer added for cases where a claim is filed close to the deadline.

For minor patients, the clock doesn't start the same way — a minor's limitation period doesn't begin until they turn 18, so private facilities are advised to retain those records until the patient reaches at least 26 years of age, accounting for the standard limitation period plus time for potential extensions and service of legal proceedings.

(Government and university hospitals follow a shorter standard — around 5 years for adults and until age 23 for minors — under the Public Authorities Protection Act 1948. This distinction matters if you're ever comparing notes with a colleague at a government facility and assuming the same rule applies; it doesn't.)

Why this is longer than most clinics assume

The reasoning isn't about clinical usefulness — it's about your clinic's legal protection. A medical record is your evidence if a negligence claim is ever filed, and claims can surface years after the actual visit, especially involving a patient who was a minor at the time. Discarding records after "a reasonable few years" removes your own evidence exactly when you might need it most.

What the Malaysian Medical Council guideline does, and doesn't cover

The MMC's guideline on medical records focuses on how records must be stored and secured, and how they're transferred or disclosed — it doesn't itself specify a retention period. The retention numbers above come from limitation-period reasoning under separate legislation, which is why this is worth getting a definitive answer on from your own legal counsel rather than treating any single source (including this article) as the final word — the consequences of getting it wrong run in both directions: discarding too early leaves you exposed, keeping indefinitely creates its own PDPA data-minimisation question.

What this means for your clinic's actual practice

If you're currently storing everything indefinitely "to be safe," that's not necessarily wrong, but it does mean building a genuine retention and secure-disposal policy rather than just letting storage accumulate — indefinite retention without a policy is itself a PDPA gap, not a safer default. If you're discarding records after 2–3 years to save space, that's the practice worth revisiting first, particularly for any patient who was a minor at the time of treatment.

Either way, this is a policy decision worth confirming with a lawyer familiar with Malaysian medical practice, not something to infer from a blog post. Including this one.

This article summarises publicly available guidance on retention periods and is not legal advice. Confirm your clinic's specific retention policy with legal counsel.