Storing patient records securely in India: the rules for paper and digital records

Every clinic keeps records, and sooner or later every clinic owner asks the same three questions. How long do we have to keep them? Where should they be kept? And who is allowed to see them?

In India the answers are spread across a medical ethics code, the Clinical Establishments rules, the IT Act, the new data protection law, CERT-In’s directions and NABH’s accreditation standards. This article brings them together for paper files and digital records alike, and sets out how 92health handles the digital side. It is a summary as of October 2026, not legal advice. Rules differ between states, so check anything that matters with your own legal adviser.

The short version

• Keep in-patient records for at least three years, and in practice much longer. Have a written retention period for each kind of record.
• Be able to give a patient a copy of their records within 72 hours of a proper request.
• Store paper files in one secure, dry, restricted place, with a register of who took which file and when.
• Treat digital records as sensitive personal data: encrypted, access-controlled, logged and backed up.
• Have a breach plan. Some incidents must be reported to CERT-In within six hours.
• If you are NABH accredited or working towards it, expect your records policies and practice to be audited.

How long records must be kept

The starting point is the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, the Code of Medical Ethics that the National Medical Commission still publishes. It asks every doctor to keep the records of in-patients for three years from the date treatment began, in a standard format. It also says that when the patient, an authorised attendant or a legal authority asks for the records, they should be issued within 72 hours.

Three years is a floor, not a recommendation. Most hospitals and many clinics keep records far longer, for good reasons:

• A complaint under the Consumer Protection Act, 2019 can be filed within two years of the cause of action, and a commission can admit a later one if it is satisfied there was sufficient cause for the delay.
• Medico-legal cases (injuries, poisoning, assault, accidents) may need records years later, and are commonly kept until any proceedings are over.
• Children’s records matter into adulthood.
• Some states set their own requirements through their clinical establishment rules.

The practical answer is a written retention schedule: out-patient records, in-patient records, medico-legal records, imaging, consent forms and billing each with a period, and a named person responsible for applying it.

Paper records: the medical records room

Most clinics in India still hold years of paper. Paper is not insecure by nature, but it needs a system.

• One place. A medical records room or a locked cabinet, not files in consulting rooms and on reception desks.
• Restricted access. Only named staff can enter or open it.
• A file register. Every file that leaves the room is written out with the date, the person and the reason, and written back in when it returns. Tracer cards in the shelf space make a missing file obvious.
• One file per patient, filed by the patient’s ID or MRN rather than by name, so two people with the same name are never mixed up.
• Protection from the elements. Files kept off the floor, away from water lines, dry, protected from pests, and covered by fire safety suited to paper storage.
• Destruction on schedule. When a record reaches the end of its retention period it is shredded or incinerated, never thrown out with general waste, and the destruction is recorded in a register: what was destroyed, when, how and by whom.

Scanning old files is a good way to make them usable, but plan it. Scan to a consistent standard, check the scans, link each scan to the right patient, and decide in your retention policy when, if ever, an original paper file may be destroyed. Electronic records are admissible as evidence under the Bharatiya Sakshya Adhiniyam, 2023, which replaced the Indian Evidence Act, when produced with the certificate the Act requires.

What NABH expects

NABH’s Accreditation Standards for Hospitals (the 6th edition was published in 2025) have a full chapter on Information Management. It covers:

• the confidentiality, integrity and security of records;
• complete and accurate documentation, with every entry identifiable to the person who made it;
• review of medical records, both paper and electronic, as part of quality assurance;
• written policies on who may access records, and on how long records are kept and how they are destroyed;
• records available to the people treating the patient when they need them.

NABH also runs Digital Health Standards for hospitals, a separate certification of digital maturity whose chapters on digital infrastructure and operations cover cybersecurity and IT resilience, aligned with the Ayushman Bharat Digital Mission (ABDM). In 2024 NABH published draft standards for hospital information and EMR software itself.

You do not have to be accredited to use these standards. They are a practical checklist for any clinic that wants its records in order.

Digital records: the law

Several laws and rules apply once records are digital.

The Clinical Establishments rules. In the states and union territories that have adopted the Clinical Establishments (Registration and Regulation) Act, 2010, Rule 9 of the 2012 Central Government Rules asks clinical establishments to maintain electronic medical or health records for every patient as the government determines.

The EHR Standards for India. The Ministry of Health’s Electronic Health Record Standards, 2016 set out how health records should be captured, stored and exchanged. They point to international standards for security, including ISO 27799 for information security in health, ISO 22600 for access control and ISO 27789 for audit trails.

The IT Act. Under the Information Technology Act, 2000 and its 2011 rules on sensitive personal data, medical records are sensitive personal data. The rules require reasonable security practices and name ISO/IEC 27001 as one standard that meets them.

The Digital Personal Data Protection Act, 2023. Its rules were notified in November 2025 and come into force in stages, with the security and breach duties taking effect in May 2027. They require reasonable security safeguards such as encryption, access control, logging and backups, and when there is a breach they require the clinic to tell the people affected and the Data Protection Board, with a detailed report to the Board within 72 hours. Failing to take reasonable security safeguards can attract a penalty of up to Rs 250 crore.

CERT-In’s directions. Since June 2022, specified cyber incidents must be reported to CERT-In within six hours of being noticed, and logs of IT systems must be kept for 180 days within India.

ABDM. Records linked to a patient’s ABHA are shared only with the patient’s consent, under the National Health Authority’s health data management policy. Software that connects to ABDM must pass ABDM’s own certification before it can go live.

Is the cloud allowed?

Yes. No Indian law forbids keeping patient records in the cloud, and for most clinics a well-run cloud service is safer than a server in a back room or a folder on the front desk computer. What the law cares about is whether the records are protected, not where the computer is.

When you choose software, ask the vendor:

1. Are records encrypted in transit and at rest?
2. Can I control access by role, so reception sees what reception needs and no more?
3. Is every access logged, and can I see the log?
4. When a staff member leaves, does their access end at once?
5. Can a record be edited or deleted without a trace, or are corrections recorded?
6. How are files shared: by permanent public links, or by links that expire?
7. Where is the data stored? Does it stay in India?
8. What is the backup arrangement, and what happens to my data if I leave?
9. What is the vendor’s breach plan, and how quickly will you be told?

How 92health stores records

92health is an EMR used by clinics, hospitals, pharmacies, labs and optical shops in India. This is how it handles the points above.

Where data lives. 92health runs on Google Cloud, and patient data stays in India. Scans, reports, photos and visit summaries are held in Google Cloud Storage, in private storage kept separate from the public storage used for things like clinic logos and website photos. Google Cloud encrypts stored data by default, and every connection to 92health is over HTTPS.

How files are opened. A file is never reachable at a permanent public address. It is opened through a link that expires after five minutes, or streamed only to a signed-in member of staff.

Who can see what. Access is set by role and by kind of record: clinical notes, prescriptions, patient documents, billing and so on, each at no access, read or write. Reception does not see what a doctor sees unless the clinic decides it should. When a member of staff is removed or switched off, their access ends at once, whatever their role says.

What is logged. Access to patient data by an organisation is logged. Changes to staff access, such as a role change or a deactivation, are kept as history, and refused sign-ins are recorded.

Sign-in. Passwords are stored only as bcrypt hashes, expire after 90 days and cannot repeat recent ones. Two-factor sign-in by SMS is available, and a session lasts a day.

Identity numbers. An Aadhaar number is checked, stored only as a one-way hash, and masked in responses and logs.

Nothing is quietly rewritten. An issued prescription cannot be edited; amending it is a separate, recorded act. A visit summary is kept as it was handed to the patient. A diagnosis recorded in error is retired with a reason, not deleted. A visit transcribed from an old paper card is marked as entered later, with who entered it and when.

Consent. A patient’s own 92health record is shared with a clinic only with their consent, and records can be linked to the patient’s ABHA, also with consent.

Small things that matter. Appointments synced to a doctor’s Google Calendar carry the patient’s ID and the visit type, never the patient’s name.

A checklist for your clinic

1. Write a retention schedule for each kind of record, and name who applies it.
2. Keep paper in one secure room with a file register, and destroy expired records by a recorded method.
3. Make sure you can issue a patient a copy of their records within 72 hours.
4. Give every member of staff their own login, never a shared one, with access matched to their role.
5. Remove access the day someone leaves.
6. Keep a log of who opened what, and look at it.
7. Have a breach plan: who decides, who reports to CERT-In within six hours, and who tells patients.
8. Ask your software vendor the questions above, and keep their answers.

If you would like to see how 92health handles your clinic’s records, book a demo.