NHS organisations must keep each record for the minimum period set out in the Records Management Code of Practice 2023, and that period starts when the record stops being operational, not when it was created. Adult health records run to 8 years, maternity records to 25, cancer records to 30. Getting this wrong in either direction carries risk: dispose early and you have breached the Code, keep everything forever and you have breached data protection.
The Code is not new and most NHS organisations know it exists. What catches people out is the gap between knowing the schedule and being able to demonstrate, on the day someone asks, that it has actually been applied.
What is the Records Management Code of Practice?
The Records Management Code of Practice is NHS England guidance on how health and care organisations should create, keep, and dispose of records. It applies to anyone working within, or under contract to, NHS organisations in England, and it covers both the clinical records that follow a patient and the corporate records that keep the organisation running.
The 2023 edition is the current version. It has been amended since publication, including a reduction in the retention period for dental clinical care records from 15 years to 11, which is a useful reminder that the schedule is not static and a retention policy written once and filed away will drift out of date.
How long must NHS records be kept?
The detail sits in Appendix II of the Code. A selection of the periods most often asked about:
| Record type | Minimum retention |
|---|---|
| Adult health records | 8 years (where not covered elsewhere) |
| Adult social care records | 8 years, including care plans |
| Children's records | Up to the 25th or 26th birthday |
| Maternity and obstetrics | 25 years |
| Mental health records | 20 years, or 10 years after death |
| Long-term illness | 20 years, or 10 years after death |
| Cancer and oncology | 30 years, or 8 years after death |
| Dental, clinical care | 11 years |
| Dental, finance related | 2 years |
| GP records, living patient | Continual retention |
| GP records, deceased patient | 10 years |
| Prison health records | 10 years |
This is a summary, not the schedule. Appendix II is longer, it carries conditions and exceptions that matter in individual cases, and it is the version you should be working from. Corporate records sit in a separate NHS England corporate records retention and disposal schedule covering governance, finance, estates, HR and procurement.
The two details that cause most retention errors
These are minimums, not targets
The Code is explicit that the periods listed must always be treated as the minimum. A period can be extended where there is justification, and retention beyond 20 years generally needs approval from the Secretary of State, with some exemptions. The practical consequence is that early disposal is a breach in a way that considered extension is not.
The clock starts when the record stops being operational
Retention periods begin when a record ceases to be operational, not on the date it was created. This is the single most common source of error we see, because the two dates can be years apart. A file created in 2012 that was still in active use until 2024 has not been eligible for disposal since 2020; it became eligible in 2024. Working from creation dates disposes of records too early. Working from nothing at all keeps everything forever.
Why paper makes this nearly impossible to evidence
None of the above is difficult to understand. It is difficult to prove, and proving it is the job.
In a physical store, the retention date lives in someone's head or on a spreadsheet maintained alongside the boxes rather than attached to them. Nobody can say with confidence who has looked at a file, whether anything was removed from it, or whether the box destroyed last year contained only records that had reached the end of their period. When an information governance lead is asked to demonstrate compliance, the honest answer is usually that the organisation believes it is compliant rather than that it can show it.
The same problem appears in a different form on shared drives, where retention depends on somebody remembering to go and delete things, which is to say it does not happen.
What good NHS records management looks like
Three capabilities, each of which has to be demonstrable rather than asserted:
- You know what you hold. Every record captured, classified and indexed by content, so a request for a specific record is answered by a search rather than a hunt. Our document digitisation and scanning service is normally how a paper archive gets to this point.
- Retention applies itself. Each record carries a retention rule tied to the date it ceased to be operational, so eligibility for disposal is calculated rather than remembered, and disposal is defensible when it happens.
- Everything is audited. Access, amendment and disposal all recorded in a trail that cannot be altered afterwards, which converts "we are compliant" into evidence.
That is what a document management system is for in an NHS context. Not tidier filing, but the ability to answer an information governance question with a record rather than a reassurance.
Where to start
Start with what you already hold, because you cannot apply a retention schedule to records you have not catalogued. Most organisations find it works best in phases: the records most often requested first, then the bulk archive, then day-forward capture so the problem stops growing while you solve it.
DocFlow is built and supported in the UK by Mastercopy, and has been serving organisations in regulated environments since 1989. If your retention schedule currently lives in a policy document rather than in your systems, that is the gap worth closing first.
