How Long Do I Need to Keep Physiotherapy Patient Records?

The figure most physiotherapists have heard is eight years. That is correct for adult patient records, but it is only part of the picture.

The retention table

Record type	Retention period	Counted from
Adult patient records	8 years	Date of last contact
Records where patient was under 16 at time of treatment	Until patient's 25th birthday, or 8 years from last contact (whichever is later)	—
Records where patient was under 17 at time of death	Until patient would have turned 26	Date of birth
Deceased adult patients	8 years	Date of death
Financial records (invoices, receipts)	6 years	End of the relevant financial year

These figures come from the NHS Records Management Code of Practice (2021). Private physiotherapists are not legally bound by the Code, but it is the reference standard that HCPC investigators, courts, and insurers reach for when assessing whether records were handled appropriately. The Chartered Society of Physiotherapy (CSP) and the HCPC both direct private members to follow it as best practice.

Special situations

Litigation holds. If a patient makes a legal claim, or signals that they intend to, stop all routine destruction of their records immediately. Retain everything related to that patient until the matter is fully resolved, regardless of the standard retention period.

Mental health records. If your practice includes psychological elements, apply the more cautious mental health retention periods: 20 years from last contact, or 8 years after the patient's death, whichever is longer.

Paper records. The same retention periods apply. Secure destruction at the end of the retention period is required — cross-cut shredding or a certified destruction service. A general waste bin is not adequate for health records.

What to do when the retention period ends

You have two options: delete or anonymise.

Deletion means removing the record from all systems, including backups. For digital records, confirm with your software provider what "delete" actually means — whether it removes the record permanently or just archives it.

Anonymisation means stripping all fields that could identify the patient: name, date of birth, NHS number, address, and contact details. What remains (dates, treatment codes, clinical codes) can be kept for statistical or audit purposes without the GDPR obligations that apply to personal data.

Do not retain identifiable records beyond their retention period without a documented reason. UK GDPR requires you to keep personal data only as long as necessary.

Can a patient demand deletion before the period ends?

Yes — they can request erasure under UK GDPR. But the right is not absolute. Your legal obligation to retain records for clinical, legal, and regulatory purposes overrides a deletion request in most cases.

When you decline an erasure request, document your reasoning and inform the patient in writing within one month. The patient can complain to the ICO if they disagree. The ICO is likely to support your decision if you can show you followed the Code and your professional body's guidance.

Practical steps

Record a retention date for each patient at discharge — eight years from the discharge date for most adults.
Check your software handles permanent deletion, not just archiving.
For paper records, write the destruction date on the file jacket at discharge.
Review retention dates annually and act on overdue records.
If a patient requests erasure, respond in writing within one month whether you comply or not.

Frequently asked questions

Do I need to keep records for patients I only saw once?

Yes. The eight-year period runs from the date of last contact, even if that was the only appointment.

What about clinical photographs and scan images?

Clinical images are part of the patient record and follow the same retention periods. Include them in any subject access response.

My software archives records automatically. Is that enough?

Only if archiving leads to permanent deletion at the retention date, not just moving the record to a hidden folder. Confirm the exact behaviour with your software provider.