Ask ten doctors and most will say seven years. That number is real, but it comes from a Ministry of Health schedule written for government facilities. Here is what actually applies to a private clinic, where the seven years comes from, and a retention policy you can defend.
Updated 12 October 2026. General information, not legal advice.
No Malaysian law we could find sets a fixed retention period for private clinic records. The Private Healthcare Facilities and Services Act 1998 lets the Minister prescribe what records are kept, and the Malaysian Medical Council expects records to be kept safely, but neither gives a number of years.
The figures people quote come from the Ministry of Health's Jadual Pelupusan Rekod Perubatan 2016, which binds MOH facilities only. Private clinics use it as the benchmark because it lines up with how long a patient can sue. A sensible policy: adults, 7 years from the last visit. Children, until they turn 25. Obstetric records, 21 years. Anything under complaint or litigation, until it is resolved, then 7 more years.
Three sources govern medical records for a private clinic. None of them sets a retention period, but each shapes what you have to do.
The Council's guideline says records must be stored in safe and secure rooms when not in use, and that X-rays and similar items have to be kept "for medico-legal reasons". It accepts computerised records. It does not give a number of years, and it says nothing about destroying records.
Health data is sensitive personal data. Section 10 says you must not keep personal data longer than you need it, and must take reasonable steps to destroy or permanently delete it once it is no longer required. This is the one rule that pushes the other way: it is a reason not to keep records forever.
The Ministry of Health's disposal schedule, agreed with the National Archives, tells MOH hospitals and klinik kesihatan how long to keep each type of record before it can be destroyed. These are the main lines:
| Record type | MOH retention period |
|---|---|
| Outpatient | 7 years |
| Inpatient | 7 years |
| Paediatric | Until the patient turns 18, then 7 years (so, to age 25) |
| Obstetric | 21 years |
| Medico-legal | 7 years, counted after the case is closed |
| X-ray, ultrasound, CT | 7 years |
| Psychiatric | Tied to the patient's death; check the schedule |
| Autopsy and forensic | Permanent |
Disposal only starts once the episode is closed: the patient discharged, treatment finished and any court case decided. A private clinic is not legally bound by this schedule. It is still the most defensible benchmark available, because a regulator, an insurer or a court will recognise it.
The real reason to keep records is your defence. Under section 6 of the Limitation Act 1953, a claim in contract or tort must be brought within 6 years of the cause of action. Most medical negligence claims fall here.
Children are different. A minor is "under a disability", and section 24 gives them 6 years from when the disability ends, which is their 18th birthday. A child you see today could bring a claim until about age 24. Keeping paediatric records to age 25 covers that window with a small margin.
The 2018 amendment added a latent damage rule (section 6A), but it applies to negligence claims that do not involve personal injury, so it rarely changes the picture for clinical records.
If you destroy a record and a claim arrives within the limitation period, you have lost your best evidence. Seven years for adults and age 25 for children are not arbitrary. They track the window in which you can be sued.
Write it down, apply it the same way to every patient, and keep a log of what you destroy. A simple version:
If in doubt, keep longer. Section 10 of the PDPA asks you not to hold data longer than necessary, and a live legal risk is a necessary purpose.
The rules do not change because a record is digital. An electronic note is still your medical record, it is still sensitive personal data, and you still own the retention decision. What changes is that copies multiply: the clinic system, backups, exports, and any tool that touches a consultation.
Before you adopt any clinic software or AI scribe, ask the vendor three questions in writing:
Since June 2025, a data breach must be reported to the Personal Data Protection Commissioner within 72 hours, and penalties for breaching the data protection principles now reach RM1 million. Holding records you no longer need is a risk, not a safety net.
We built Catat, our AI medical scribe, so the finished note lives in your record and the clinic stays in control of retention. Whatever tool you use, the record belongs to you and the policy is yours to set.
Records outlive the clinic. Under section 53 of Act 586, give the Director General at least 30 days' written notice before you close or transfer, and follow the DG's directions on the records. The MOH closure process asks you to show how patient records will be kept safe.
Sources: Private Healthcare Facilities and Services Act 1998 (Act 586), ss. 53, 107, 117. MMC Guideline 002/2006, Medical Records and Medical Reports. KKM, Jadual Pelupusan Rekod Perubatan 2016. Thomas Philip, on the Limitation Act 1953. CodeBlue, Patients' Rights to Their Medical Records (2025). DLA Piper, PDPA breach notification guidelines (2025). This page is general information, not legal advice. For a specific situation, speak to a lawyer or your medical defence organisation.
No Malaysian law we could find sets a fixed period for private clinics. The accepted benchmark is the Ministry of Health's 2016 disposal schedule: 7 years for adult records, until age 25 for children, and 21 years for obstetric records. These track the Limitation Act, which gives most patients 6 years to bring a claim.
Not as a legal requirement. The 7-year figure comes from the MOH Jadual Pelupusan Rekod Perubatan 2016, which applies to MOH facilities. Private clinics follow it as good practice because it covers the 6-year limitation period for most claims.
Until the patient turns 25, or 7 years from the last visit if that is later. A minor can bring a claim up to 6 years after turning 18, and the MOH schedule keeps paediatric records until 18 and then for 7 more years.
The clinic or healthcare facility owns the original record under regulation 44(1) of the Private Healthcare Facilities and Services Regulations 2006. The patient has a qualified right to a copy, usually on payment of a reasonable copying charge.
Not without a reason. Section 10 of the Personal Data Protection Act 2010 says personal data should not be kept longer than necessary and should be destroyed once it is no longer needed. Keep records for as long as there is a real clinical or legal purpose, then dispose of them securely and log it.
Catat turns a consultation in Manglish, BM or English into a structured note, MC and patient letter, ready for you to review and sign.
See how Catat works →