A patient record is simultaneously a clinical tool, a communication system, a legal document and evidence of the standard of care. Poor records do not merely weaken a defence after an adverse event; they create risk while care is still being delivered.
Approximate article length: 1,543 words
The purpose of the health record
A patient health record is the longitudinal collection of personal and health information recorded by or at the direction of a healthcare practitioner, regardless of whether it is kept on paper, in an electronic system, as an image, recording or other medium. Its primary purpose is safe and continuous care. It reminds the treating team what was found, what was decided, what information was given and what follow-up is required.
The record also allows another practitioner to understand the patient’s condition without reconstructing the entire history from memory. It supports referrals, handovers, repeat prescribing, audit, quality improvement, billing and lawful reporting. If a complaint or claim arises, the record becomes the most reliable contemporaneous evidence of the practitioner’s reasoning and conduct.
Record keeping is therefore not a clerical task to be completed after the ‘real work’. It is part of the clinical act. A correct decision that is not communicated or recorded may not protect the patient. A detailed record cannot rescue care that was clinically poor, but an incomplete record can turn defensible care into an evidential problem.
What a defensible record should contain
The content will vary by profession and encounter, but the record should ordinarily identify the patient and practitioner; record the date and time; capture the relevant history and examination; state material findings, assessment or diagnosis; identify investigations; record the treatment or advice provided; note prescriptions and devices; explain referrals and follow-up; and document material communication with the patient or representative.
Where informed consent is required, the note should show more than the word ‘consented’. It should identify the proposed intervention, material risks and benefits, reasonable alternatives, questions raised, the patient’s decision and any relevant capacity or language issue. A signed form supports the process but does not replace a meaningful discussion.
Where a patient refuses recommended care, the practitioner should record the recommendation, information provided, likely consequences, alternatives, the patient’s stated reasons where volunteered, assessment of capacity and safety-net advice. Labelling the patient ‘non-compliant’ adds little and may be disrespectful.
Telephone calls, portal messages, significant emails, results discussions and advice from colleagues can materially affect care and should be captured. So should attempts to contact a patient about an important result. The record must allow a reviewer to understand not only what happened, but what was expected to happen next.
Contemporaneous, attributable and complete
Entries should be made at the time of the interaction or as soon as reasonably possible afterwards. Memory degrades quickly and later reconstruction is vulnerable to unconscious bias. If a late entry is necessary, it should be clearly identified with the current date and time, explain that it is retrospective and, where relevant, state why it was made.
Every entry must be attributable to the person who made it. Electronic systems should use unique credentials and audit trails. Shared logins destroy accountability and create security risk. In a multidisciplinary record, each contributor should be identifiable and entries should be dated and timed.8
Records should be accurate, complete, clear, legible and unambiguous. Abbreviations should be standard and understood within the relevant setting. Derogatory language, speculation presented as fact and copied material that was not verified should be avoided. Templates are useful only if they improve consistency; indiscriminate copy-and-paste can create contradictions and false findings.
Corrections must preserve integrity. An original entry should not be erased or overwritten in a way that conceals the change. Paper corrections should remain legible and be signed and dated. Electronic amendments should retain an audit history. A practitioner should never alter a record to improve a position after receiving a complaint or legal demand.
Retention periods require a layered approach
HPCSA Booklet 9 provides general retention guidance. It states that records should ideally be stored indefinitely where practical, particularly in electronic form, and otherwise generally for at least six years from the date on which the record became dormant. It provides longer periods for certain categories, including records of patients who were minors when treated, mentally incapacitated patients and occupational-health records.
The commonly cited minimums should not be applied blindly. The booklet indicates that records of a person treated while under 18 should be retained at least until the person’s 21st birthday. Records of mentally incapacitated patients may need to be kept for the patient’s lifetime. Occupational-health legislation may require relevant records to be retained for 20 years after treatment or exposure, depending on the record and regulatory context.
Other legislation, contractual obligations, institutional policies, research requirements or the nature of the condition may justify longer retention. Records relevant to an existing complaint, investigation, audit or reasonably anticipated litigation should not be destroyed merely because a standard period has expired. Practices should obtain advice when competing retention and destruction duties arise.
A written retention schedule should identify the record category, trigger date, minimum period, legal source, responsible person and secure destruction method. ‘Keep everything forever’ can create unnecessary privacy, security and storage risk; premature destruction can prejudice care and legal rights. The correct answer is a reasoned, documented schedule.
Custody, access and patient rights
The practitioner or health establishment that holds the record generally has custodial responsibilities, while the information concerns the patient and is subject to rights of access and correction under applicable law. Ownership language should not be used to block a lawful request for information.
A request for access should be verified, logged and processed under the National Health Act, POPIA, PAIA and applicable professional guidance. Identity and authority must be checked. Where a representative requests information, the practice should confirm the mandate or legal status. Information about third parties may require protection, and access may be subject to lawful limitations.
Patients may dispute factual information. A practice should have a process for correction or annotation that preserves the original record and audit trail. Clinical opinions should not be rewritten merely because the patient disagrees, but the patient’s concerns and any correction of objective error should be recorded fairly.
Transfers should be secure and documented. The sending practice should confirm the recipient, send only the agreed records, retain evidence of transmission and update its custody log. Originals should not be released casually where doing so would leave the practice without the record it is required to keep.
Security and business continuity
Section 17 of the National Health Act requires control measures to prevent unauthorised access to health records and the systems or facilities in which they are stored. POPIA adds security obligations across the information life cycle. Paper files require controlled storage, tracking and secure disposal. Electronic records require access control, authentication, encryption where appropriate, patching, backups, malware protection, logging and incident response.
Backups are valuable only if they can be restored. Practices should test restoration, separate backup credentials from ordinary user accounts and protect backups from ransomware. Business-continuity planning should address power failures, internet outages, system migration, vendor failure and the departure of key staff.
Mobile devices create particular risks. Patient information should not remain indefinitely in personal photo galleries, downloads folders or messaging applications. Remote access should be controlled, devices should be encrypted and lost-device procedures should be known.
When artificial intelligence assists with transcription, coding, summarisation or drafting, the practitioner must verify the output before it enters the record. AI-generated notes may omit important facts, invent statements or reproduce the wrong patient’s information. The final signed record remains the practitioner’s responsibility.
Closure, relocation, incapacity or death
A practice cannot abandon records when it closes, relocates or changes ownership. Patients should be informed of the closure and given a reasonable opportunity to request transfer to a practitioner of their choice. Custody arrangements must preserve confidentiality, access and the applicable retention periods.
HPCSA guidance contemplates written notice and an identified practitioner or institution that can safeguard and manage records after closure. Any period specified for the immediate post-closure arrangement does not cancel the longer retention obligations applicable to the records themselves. Contracts should state who holds the records, who may respond to access requests, how costs will be managed and what happens if the custodian later closes.
Practitioners should also plan for incapacity or death. A professional will, practice-continuity agreement and nominated record custodian can prevent records from becoming inaccessible to patients and families at the worst possible time.
The record as a risk-management tool
A useful record answers six questions: What did the practitioner know? What did the practitioner find? What options were considered? What was discussed with the patient? What decision was made? What follow-up was arranged? If the record cannot answer those questions, the practice should improve its templates and training.
Regular audits should examine timeliness, identification, consent, medication documentation, results follow-up, referrals, corrections, access controls and retention. Feedback should target recurring system failures rather than blaming individuals for every omission.
The strongest record is not the longest. It is accurate, relevant and clear enough to support care and independent review. Defensive over-documentation, copied boilerplate and irrelevant detail can hide the facts that matter. Good records demonstrate disciplined clinical thinking, respectful communication and reliable follow-through.
Disclaimer: While every reasonable effort has been made to ensure the accuracy, completeness and currency of the information contained in this document, Genoa Underwriting Managers (Pty) Ltd makes no representations or warranties, whether express or implied, regarding the correctness, reliability or suitability of such information. The contents of this document are provided for general informational purposes only and do not constitute legal, medical, financial, insurance or professional advice. Readers should seek appropriate professional advice specific to their circumstances before acting on any information contained herein. To the fullest extent permitted by law, Genoa Underwriting Managers (Pty) Ltd, its employees, representatives and affiliates shall not be liable for any loss, damage, liability or expense arising directly or indirectly from reliance on or use of the information contained in this document.
