This is one of the most common questions I get from clinic owners — and it trips people up because two rules pull in opposite directions. MOH says keep records long enough. The PDPA says don't keep them too long. Here's how to hold both at once, in plain English.
Rule one: the MOH minimum (how long to keep)
Singapore's healthcare rules set a floor — the shortest time you're allowed to keep a medical record before you may consider destroying it:
- 1Adults — at least 6 years from the date of the last entry in the record. If you saw a patient over several years, the 6-year clock runs from the most recent visit, not the first.
- 2Children — until the patient turns 21, then a further 6 years. A record created when a child is 3 could need keeping until they're 27. Paediatric records are the ones clinics most often destroy too early.
These are minimums, not deadlines to delete on the dot. There are also situations where you'd sensibly keep a record longer — an unresolved complaint, ongoing treatment, or a matter that could lead to a claim. When in doubt on a specific record type, check the current MOH guidance or ask a professional.
Rule two: the PDPA limit (don't over-keep)
Here's the part many clinics miss. The PDPA has a retention-limitation rule: you must stop keeping personal data once the purpose you collected it for is done and there's no legal or business reason to hold it any longer. In other words, "keep everything forever, just in case" is not the safe option — it's actually a breach. Old data you no longer need is pure risk: it's more to protect, more that can leak, and more you'd have to account for if something went wrong.
How to reconcile the two: a written retention schedule
The clean way to satisfy both rules is a retention schedule — a simple written table that says, for each type of record, how long you keep it and what triggers disposal. It turns a vague worry into a routine anyone on your team can follow. A basic one covers:
- ✓Adult clinical records — keep 6 years from last entry, then review and dispose.
- ✓Paediatric records — keep until 21 + 6 years, then review and dispose.
- ✓Appointment lists, marketing contacts, CCTV, job applications — much shorter; these are not medical records and shouldn't be kept for years.
- ✓A disposal log — a line recording what was destroyed and when, so you can show the schedule is actually being followed.
The point isn't a fancy document — it's that the decision is made once, written down, and repeatable, instead of everything piling up in a back-room cabinet indefinitely.
Disposing of records securely
When a record's time is up, "throwing it away" isn't enough — the data has to be put beyond recovery:
- ✓Paper — shred it, or use a locked confidential-waste bin. Don't put patient files in the normal rubbish or recycling.
- ✓Digital — securely delete or wipe the files, and properly clear old computers, hard drives and phones before you sell or discard them. Emptying the trash isn't the same as wiping.
- ✓Backups & copies — remember data hides in backups, exported spreadsheets, and staff devices. Include those in the clear-out.
What if the clinic closes or is sold?
Records don't just disappear when a practice does. If you close, you still have to keep records for the required periods and store them securely (and MOH has notification steps around ceasing practice). If you sell or transfer the clinic, there needs to be a proper handover of records with the right protections and patient expectations respected. Either way, it's something to plan for before the change — not scramble through after.
Why this sits with your DPO
Retention is exactly the kind of thing that quietly goes wrong until it doesn't. That's why it belongs to a named owner — your Data Protection Officer, who every Singapore clinic must appoint anyway. The DPO writes the retention schedule, makes sure disposal actually happens, and can show the reasoning if a patient or the PDPC ever asks. If nobody owns it, "keep everything" becomes the default — and that's the risky one.
Common questions
MOH generally requires a clinic to keep an adult patient's medical records for a minimum of 6 years from the last entry. After that period, if there's no longer a reason to keep the record, the PDPA says you should dispose of it securely.
For paediatric records the clock runs longer: keep them until the patient turns 21, and then for a further 6 years. So a record made when a child is very young may need to be kept for well over 20 years.
No. The PDPA's retention-limitation rule says you must not keep personal data longer than you need it. Once the MOH minimum has passed and there's no legal or business reason to hold the record, keeping it is itself a breach — so dispose of it securely.
Dispose so the data can't be recovered: shred or use a secure bin for paper, and securely delete or wipe digital files and old devices rather than just moving them to trash. Keep a simple log of what was destroyed and when.
Sources
- Ministry of Health (MOH) — medical record-keeping requirements & the Healthcare Services Act (HCSA)
- Personal Data Protection Commission (PDPC) — pdpc.gov.sg (Retention Limitation Obligation; Healthcare Sector Advisory Guidelines)
I build websites and help Singapore businesses run them well. HeyAda is my Singapore web studio — design, SEO, and the practical side of running a business online, including the patient data your clinic collects. I write these guides in plain English, and I can be your clinic's outsourced DPO. Getting your clinic PDPA-ready? Say hi.
Want a retention schedule built for your clinic?
We help Singapore clinics get PDPA-ready and stand in as your outsourced DPO — records mapped, a retention schedule written, disposal sorted, staff trained. Done for you. Let's talk.