Paper records storage: what the regulatory fine means

What the DPC’s decision reveals about paper records storage

The Data Protection Commission’s (DPC) fine establishes a clear precedent: clinical practices cannot abandon historical patient files in unmanaged, disused, or insecure physical locations. For private consultants in Ireland, this decision means that storing old charts in off-site facilities or disused rooms without strict access controls and active retention policies is a direct regulatory liability.

On 2 September 2026, the DPC announced a fine, a reprimand, and corrective orders. This enforcement action followed an inquiry into paper records kept in external storage, where unauthorized intruders gained access to patient records at disused hospital sites. The DPC found breaches of several core provisions of the GDPR:

• Articles 5(1)(f) and 32(1): Failure to ensure the appropriate security of the records.
• Article 5(1)(e): Infringing the principle of storage limitation by keeping records longer than necessary.
• Article 33(1): Failing to notify the supervisory authority of the personal data breach within 72 hours.
• Article 34(1): Failing to notify the affected individuals without undue delay.

For private urologists operating across multiple private hospitals—such as the Beacon, Mater Private, Blackrock, or Hermitage—this ruling is a warning. It is common for consultants to accumulate physical files from years of outpatient clinics, diagnostic lists, and procedures. If these old charts are moved to secondary storage rooms, basements, or external self-storage units without active oversight, the practice is exposed to the exact security and storage limitation failures that led to the HSE's fine. Managing paper records storage requires active, documented governance; simply locking files in a disused room does not satisfy your statutory security obligations.

How does Paragraph 39 of the Medical Council Guide govern retention?

Paragraph 39 of the Medical Council Guide (9th edition), which took effect on 1 January 2024, does not mandate a specific number of years for keeping medical records. Instead, it places the responsibility on the registered medical practitioner to make a professional judgement based on clinical relevance and legal necessity.

Under Paragraph 39.2, you must keep medical records for as long as required by law or for as long as they remain clinically relevant. When deciding how long to retain old charts, consultants must weigh several competing factors:

• Continuity of patient care.
• Transfer of care to other specialists or general practitioners.
• Potential medico-legal use (such as defending a future clinical negligence claim).
• General data protection principles, including the principle of storage limitation.

Footnote 60 of the Guide references the HSE's own retention schedule but explicitly states that it is not applicable to all clinical settings. This means that while a private consultant can look to public sector timelines for guidance, they must establish their own records retention policies that satisfy their medical defense union and their obligations as an independent data controller. Holding files indefinitely "just in case" is no longer a defensible strategy under Irish data protection law, yet destroying records prematurely introduces severe medico-legal risk.

Understanding the HSE National Records Retention Policy v4 timelines

For private consultants seeking a reliable benchmark, the HSE National Records Retention Policy, version 4, which took effect on 1 December 2025 (with a scheduled review on 1 December 2028), provides the most detailed clinical timeline framework in Ireland. Although this policy formally applies only to records created or received by the HSE and its funded Section 38 and 39 agencies, it represents the standard of care that Irish courts and regulators reference.

For the vast majority of clinical records—including referral letters, consent forms, clinical correspondence, radiology images and reports, obstetric records, and pediatric files—the HSE sets the retention period at the lifetime of the patient plus 8 years after death.

To help clarify how these timelines apply to different clinical categories, the table below outlines the core retention periods defined under the 2025 policy:

Record Category	HSE Retention Period (v4, 2025)	Clinical Context for Private Rooms
General Clinical Records (Referrals, consent forms, outpatient letters, radiology)	Lifetime of patient + 8 years after death	Standard follow-up for prostate cancer surveillance, BPH management, or stone disease.
Mental Health Act Records	20 years after last contact, or 8 years after death (whichever is sooner)	Relevant for psychiatric and neurological specialties.
Personal & Family Genetic Records	30 years from the last attendance	Relevant for hereditary urological cancers or familial endocrine syndromes.
Blood Transfusion Records	30 years	Relevant for major surgical interventions and theatre logs.

For a urology practice, managing these timelines physically is incredibly difficult. A patient who underwent a transperineal prostate biopsy or a flexible cystoscopy fifteen years ago may still require their historical baseline data, but keeping those physical files in active clinic rooms creates administrative clutter and increases security risks.

Managing patient deletion requests and consulting your indemnifier

Under the GDPR, patients have the right to request the erasure of their personal data. However, in a clinical setting, this right is not absolute and must be balanced against the consultant's professional and legal obligations.

According to Paragraph 39.2 of the Medical Council Guide, before deleting any records that a patient has requested to have erased, a doctor must carefully consider whether there is a professional or medico-legal reason to retain them. The Guide advises that if you are in any doubt, you should consult your indemnifier (such as Medisec or MPS), your employer, or a legal adviser before taking action.

When a patient submits a deletion request, your administrative team should follow a structured evaluation process rather than executing the deletion immediately:

1. Verify identity: Ensure the request genuinely originates from the patient or an authorized representative.
2. Assess clinical relevance: Determine if the patient has active, ongoing clinical pathways (such as active surveillance for low-risk prostate cancer or recurring urinary tract infections).
3. Evaluate medico-legal risk: Consult your defense union to confirm the minimum statutory limitation periods for clinical negligence claims in Ireland, which often extend beyond standard timelines if the patient was a minor or lacked capacity at the time of treatment.
4. Document the decision: If you refuse the request based on a legal obligation to retain the files for defensive purposes, document your reasoning clearly and communicate this to the patient.

Transitioning from physical archives to secure digital records

Transitioning away from physical paper records storage to a structured electronic health record is the most effective way for private practices to mitigate the risks highlighted by the DPC's HSE decision. By digitising your historical files, you eliminate the physical security vulnerabilities of off-site rooms while ensuring that records are kept in a structured format that supports searchability and controlled retention.

When selecting a digital partner, the security and hosting architecture of the software must be a primary consideration. For example, the electronic medical record designed for private specialists provided by Brigid is hosted securely in AWS Dublin (eu-west-1), ensuring that clinical data remains within the European Union. Transitioning to a digital record allows practices to move away from the physical vulnerability of paper storage while maintaining full control over data access and retention schedules.

Before embarking on a digitisation project, it is essential to establish clear clinical protocols. For instance, understanding patient consent rules for recording consultations helps ensure that any digital dictation or ambient clinical notes captured during a clinic visit are handled in accordance with professional guidelines. Furthermore, if your team uses digital tools for clinical letters, verifying how and where that data is processed is critical; you can read more about how to evaluate these tools in our guide on how to verify data storage for medical dictation apps.

With the companion patient app, MyBrigid, patients can complete digital intake forms and view their letters on their own devices. This patient-first approach reduces the administrative burden on the practice secretary while preventing the creation of unnecessary physical paperwork in the clinic from the outset.

Practical Next Steps for Your Practice Today:

• Audit existing physical files: Identify any old charts stored in off-site or secondary locations that have exceeded their clinical relevance and legal retention periods.
• Consult your defense union: Establish a clear written policy on retention timelines specifically tailored to your specialty's medico-legal risks.
• Draft a migration plan: Begin identifying which active patient cohorts can be transitioned to a secure, cloud-based electronic record to reduce your physical paper footprint.

Ask Brigid is onboarding a small number of founding consultant practices. Request early access and we will reply with current availability and the next step.