Dental Patient Records: How Long to Keep Them and How to Dispose of Them

Every dental clinic builds up years of patient records: charts, radiographs, treatment plans, consent forms, lab prescriptions, billing and correspondence. Sooner or later someone asks how long all of it has to be kept, and whether the old boxes in storage can finally go.

The answer depends on where your clinic is and who is treating the patient. There is no single national rule.

Who sets the retention period

Two kinds of rules apply to dental records in Canada.

Privacy law governs how personal information is collected, used, disclosed, protected and eventually destroyed. Depending on the province, that is PIPEDA or a provincial law, such as the Personal Information Protection Acts in Alberta and British Columbia, Quebec's private-sector privacy law or a provincial health information act. These laws generally require you to keep personal information only as long as you need it, protect it while you have it and destroy it securely when you no longer need it. They do not set a specific number of years for dental charts.

The retention period itself comes from your provincial regulator. Each dental regulatory authority, and the regulators for dental hygienists, assistants and denturists, sets record-keeping standards for its members, including how long records must be kept after a patient's last visit. Periods are commonly longer for patients who were minors when they were treated. In some provinces the rules are also set in legislation.

Because the standards differ by province and by profession, and change from time to time, check the current record-keeping standard from your regulator rather than relying on a number you heard at a course or read online. If your clinic has hygienists or denturists practising under their own regulators, check their standards too.

What counts as the record

Retention applies to the whole record, not only the chart notes. That usually includes:

• Clinical notes and charting
• Radiographs and other diagnostic images
• Treatment plans and signed consent forms
• Medical history updates
• Lab prescriptions
• Financial records and correspondence connected to care

Electronic records count the same way as paper. So do backups. A record deleted from your practice management software but still sitting in an old backup has not been disposed of.

Keeping records secure while you have them

Privacy law requires reasonable safeguards for as long as records are kept. For most clinics that means:

• Paper records in locked storage that only authorised staff can reach
• Individual logins for your software, with access limited to what each role needs
• Encrypted backups stored off-site, with a restore process you have tested
• A log of who took records out of the clinic, when and why

Disposing of records properly

When the retention period has passed and no other obligation applies, destroy records so they cannot be reconstructed.

• Shred paper records, or use a bonded shredding service that provides a certificate of destruction.
• Wipe or physically destroy hard drives, servers and old computers before they leave the clinic. Deleting files is not enough.
• Include backups and archived copies in the process.
• Keep a disposal log: which records, the date, the method and who authorised it.

Never put patient records in the regular garbage or recycling, even in bags.

When a clinic closes or changes hands

Retention obligations continue when a dentist retires, a clinic closes or a practice is sold. Before any of those happen, decide who will be the custodian of the records, how patients can request copies and how the records will be protected for the rest of the retention period. Your regulator usually has guidance on this, and it should be settled in any purchase agreement.

A simple starting point

• Find your regulator's current record-keeping standard and note the retention periods that apply to your clinic.
• Write a one-page retention and disposal policy.
• Name the person responsible for it.
• Review what is in storage once a year and dispose of what is past its date, with a log.

Handled this way, record retention stops being a question nobody wants to answer and becomes a routine the clinic can show it follows.