Medical record retention (and NEN 7510/NEN 7513 logs)

The retention period for a medical record is 20 years, counted from the last change to the record. This is set out in article 7:454(3) of the Wet op de geneeskundige behandelingsovereenkomst (WGBO, Medical Treatment Agreement Act) and the Burgerlijk Wetboek (BW, Dutch Civil Code). You must keep it longer if the care of a good healthcare provider requires it. You keep the logs of who viewed the record for at least 5 years, under NEN 7513.

NEN 7510 itself does not specify a number of years. The standard does require that stored data remains available, correct and protected, including after a system change. The Dutch government and the Autoriteit Persoonsgegevens (AP, Dutch Data Protection Authority) follow the same main rule. Below you will find the exceptions and an overview that you can adopt in your own retention policy.

How long must you keep a medical record?

The main rule is 20 years after the last change. That rule applies since 1 January 2020. Before that, the period was 15 years, counted from the moment each document was created. The amendment extended the period and created one starting point for the whole record.

The WGBO applies to everyone who has a treatment agreement with a patient. That means not only doctors, but also dentists, physiotherapists, psychologists and midwives. You also keep the records of deceased patients for 20 years.

Worked example. A patient visits the practice from 2010 to 2024. The last entry is dated 12 March 2024. You then keep the whole record, including the documents from 2010, until at least 12 March 2044.

Exceptions to the 20-year retention period

The KNMG guideline on handling medical data (Royal Dutch Medical Association, KNMG) lists four situations in which you may depart from the 20 years. The table summarises them.

Exception	What it means	Example
Good care	Keep the record longer if this is needed for good care	Chronic illness, implant, cured cancer
Interest of another person	Keep the record longer if it matters to someone else	Hereditary condition that affects family
Other legal period	Another law requires a longer or shorter period	Academic hospitals: certain documents for 115 years after birth (Archiefwet, Dutch Archives Act); Wmo files for 15 years (Wmo, Social Support Act)
Patient’s request	The patient asks for longer retention or for destruction	Patient wants the record erased after treatment

You may keep anonymised data for statistics or research for longer. It can no longer be traced back to a person.

Retention period for minors

The law does not make a distinction for children. In youth health care, the KNMG considers it usual for the period to start at age 18, so that records are kept until age 39. If the record contains suspicions of child abuse, you keep that information for at least until age 39.

Destruction at the patient’s request

A patient may ask in writing or electronically for (parts of) their record to be destroyed. This is set out in article 7:455 BW. According to the Dutch government, destruction must take place within one month if the healthcare provider agrees.

You may only refuse if keeping the record is of considerable importance to someone else, or if a law prevents destruction. Record the request and your decision. Also check whether your system can really delete data, including copies in backups, within the agreed period.

Retention period for NEN 7513 logs

Logs are a separate topic. They show who opened which record and when. Under the Besluit elektronische gegevensverwerking door zorgaanbieders (Decree on Electronic Data Processing by Healthcare Providers), you keep them for at least 5 years from the moment the log entry is written (Staatscourant 2019, no. 38007 ).

A record that is kept longer does not automatically mean the logs must be kept just as long. If you choose a longer log period, it must be limited and justified. Read more in NEN 7513 logging.

Overview: retention periods in the care practice

Use this table as the basis for your retention policy. Adjust the last column to your own systems.

Data	Minimum period	Starting point	Source	Where it is held
Medical record	20 years	Last change	Art. 7:454 BW	EPD or HIS
Minor’s record (JGZ practice)	Until age 39	18th birthday	KNMG guideline	EPD
Access logs (NEN 7513)	5 years	Writing of the log entry	Decree on Electronic Data Processing	Supplier’s log environment
X-rays and scans	As the record (20 years)	Last change to the record	Art. 7:454 BW	Imaging software, PACS
Emails with patient information	Relevant content in the record, then own period	Filing in the record	Own policy	Secure email service
Data breach register	Own period, justified	Registration	GDPR art. 33(5)	Incident register

X-rays, intraoral scans and measurement data are often held in a separate system. They belong to the record and therefore follow the same period. Do not forget them when you move to a new EPD.

Retention and NEN 7510: what does this mean for your security?

Twenty years is longer than the lifespan of most systems. NEN 7510 requires you to keep stored data available and intact. This affects three topics.

System change. When you move to a new EPD, you take old records with you, or you keep the old system accessible. Record in the contract with the supplier how data is transferred when you leave.

Backups. A backup is not an archive. Do not keep backups indefinitely, but make sure the archive itself is reliable.

Destruction. After the period has passed, you must actually delete the data. The GDPR prohibits keeping data longer than necessary. Schedule an annual check on records whose retention period has expired.

What happens to records when a practice stops?

If you stop, go bankrupt or die, the retention obligation remains. Usually a successor takes over the records and the retention obligation. If that does not happen, another healthcare provider or institution must be designated.

A curator or heir is not a healthcare provider and may not manage the records. According to the AP, that person may transfer them to a designated healthcare provider, under article 30b of the UAVG (Dutch GDPR Implementation Act). Arrange this in advance, for example in an agreement with a colleague.

Frequently asked questions about retention

How long do you keep the record of a deceased patient?

Also 20 years after the last change. The KNMG guideline states this explicitly. Next of kin may be able to access the record under certain conditions.

May you destroy paper records once they have been scanned?

Yes. The WGBO sets no requirements on the form of the record. The KNMT guideline on the patient record says that paper documents may be destroyed after digital storage, provided the scan remains accessible, secure and readable.

Does NEN 7510 also apply to the archive?

Yes. An archive of old records contains the same sensitive data. Access management, logging and backups apply to it just as much, including when the archive sits in an old system.