How long must a medical record be kept in Spain?
How long must a medical record be kept? Law 41/2002 (Spain's basic law on patient autonomy) requires healthcare centres to keep clinical documentation for the time appropriate to each case and, as a minimum, five years counted from the date of discharge from each care process. It is a basic national law, and your autonomous community (region) may have approved its own rules.
What the law actually says
Article 17 of Law 41/2002, the basic law regulating patient autonomy, puts it like this (translated from the Spanish): “Healthcare centres are obliged to keep clinical documentation in conditions that guarantee its proper maintenance and security, though not necessarily in the original medium, for the proper care of the patient during the time appropriate to each case and, as a minimum, five years counted from the date of discharge from each care process”.
Three parts of that sentence change how you organise yourself:
- “As a minimum, five years”. It is a floor, not a fixed period: the law speaks of the time appropriate to each case for the proper care of the patient, and sets that minimum.
- “Clinical documentation”. The law defines it as the medium of any type or kind that contains a set of data and information of a care-related nature. It is not limited to progress notes.
- “Not necessarily in the original medium”. It can be kept in another medium, for example digitised, always in conditions that guarantee its proper maintenance and security.
When the period starts counting
The minimum is not counted from when the patient first came to the clinic, but “from the date of discharge from each care process”. The important word is “each”: the same patient can have several processes over the years, each with its own discharge date.
In a clinic that works in sessions or with treatments that run for months, discharge is not always an obvious moment. One patient finishes a course of physiotherapy and comes back a year later for something else; another goes through nutrition check-ups with no clear closing date. Which date your clinic takes as the discharge for each process should be fixed in writing with your adviser, and applied the same way to every patient.
One practical consequence: to know whether a record has reached the minimum, the date that counts is the discharge date of each process, not that of the first visit or of the last appointment.
When records are kept for longer
The same article provides for clinical documentation to be kept in other situations too:
- For judicial purposes, in accordance with current legislation.
- For epidemiological or research reasons, or for the organisation and operation of the National Health System. In those cases, the data will be processed in a way that avoids, as far as possible, identifying the people concerned.
- Data relating to the patient's birth. These are not destroyed: once the patient's death is known, they are transferred to the permanent archives of the relevant public authority.
If a claim is under way or foreseeable, the period stops being only a healthcare matter. How long to keep each record because of possible liability depends on the rules that apply to each case: it is a question for your adviser, not for your software.
The role of the autonomous communities
Law 41/2002 has the status of a basic law, and the State and the autonomous communities will adopt, within their respective powers, the measures needed to make it effective. The law also tasks the autonomous communities with approving the provisions needed for healthcare centres to adopt the technical and organisational measures suited to archiving and protecting medical records and preventing their destruction or accidental loss.
That is why the national minimum of five years need not be the last word in your case: your autonomous community may have regulated its own periods or conditions. We do not give regional periods here, because they depend on each community's official gazette. Ask your adviser to confirm which rule applies to your clinic and note it down in your retention policy.
Who is responsible for custody
The law divides responsibility according to how people work:
| Situation | What the law says |
|---|---|
| A healthcare professional working individually | Is responsible for managing and safeguarding the care documentation they generate. |
| A centre with inpatients, or one that treats a sufficient number of patients according to the health services' criteria | The record is managed through the admissions and clinical documentation unit, and its custody is the responsibility of the centre's management. |
| All healthcare professionals | Have a duty to cooperate in creating and maintaining orderly, sequential clinical documentation of the care process. |
In addition, patients are entitled to have healthcare centres establish an active and diligent custody mechanism for medical records, allowing the collection, integration, retrieval and communication of information subject to the principle of confidentiality. We explain who may consult that information in who can see the medical record.
What happens when the period expires
Once the minimum has passed, the law goes on speaking of the time appropriate to each case. And the GDPR adds a principle that pushes the other way: personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of the processing. Between the two ideas a decision has to be made, by type of case, and written down.
If a patient asks you to delete their record early, bear in mind that the GDPR says the right to erasure does not apply where processing is necessary for compliance with a legal obligation that requires processing of the data. Whether their case fits there depends on the circumstances: consult your adviser before replying.
And when the time comes to erase, the LOPDGDD (Spain's data protection and digital rights law) says the controller must block the data when it rectifies or erases them. Blocking means identifying and setting them aside to prevent their processing, except to make them available to judges and courts, the Public Prosecutor's Office or the competent public authorities to demand any liability arising from the processing, and only for the limitation period of that liability.
A useful retention policy fits in five lines:
- What is kept: record, signed documents, photos and reports, on paper and digital.
- From what date the period for each process is counted.
- Which period applies, with your community's rule confirmed by your adviser.
- Who holds custody and where everything is, including what stayed in a previous program; how not to lose it when you switch is covered in switching clinic management software.
- What is done when the period expires, who decides and how it is recorded.
What Mi Clínica does and what the clinic decides
What is kept and for how long is decided by the clinic with its adviser; the software does not certify compliance with any rule. What Mi Clínica does is make sure that what is signed and what is important cannot be altered by accident:
- Frozen documents. Once a document leaves draft it is frozen: it can no longer be deleted or changed. Only a draft can be deleted; anything else is cancelled or replaced by a new version.
- The signed PDF, with its evidence. It stores the channel, who assisted the signing, IP, browser and fingerprints (hashes), and it cannot be deleted.
- Body chart by versions. Each visit is saved as a version, and the chart for a consultation is never changed or deleted afterwards.
- Photos and files in the patient record, up to 25 MB per file.
- A trail of views. Who views the medical record is logged, with user, date and time.
It is also worth knowing what it does not do. Mi Clínica imports patients and appointments, but not the records from another program, which are kept separately. What each record contains is covered in electronic medical record, and how documents are signed and stored in documents and signing (in Spanish).
Sources consulted
Checked on 9 October 2026. We link to the original source so that you can consult the current text.
- Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.
- Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
- Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
Frequently asked questions
Can medical records be destroyed once five years have passed?
Five years is a minimum: the law asks for clinical documentation to be kept for the time appropriate to each case, and also provides for keeping it for judicial purposes and other reasons. Your autonomous community may have its own rules. Before destroying anything, decide it with your adviser and record what is destroyed and why.
From what date are the five years counted?
From the date of discharge from each care process, under Article 17 of Law 41/2002. If your clinic works by sessions or long treatments, agree in writing with your adviser which date is taken as the discharge for each process.
Can a patient ask me to delete their medical record?
They can exercise their right to erasure, but the GDPR says that right does not apply where processing is necessary for compliance with a legal obligation applying to the controller. Whether their case fits there depends on the circumstances: consult your adviser before replying.
Who holds custody of the records in a single-professional practice?
Law 41/2002 says that healthcare professionals who work individually are responsible for managing and safeguarding the care documentation they generate.
Can a consent that has already been signed be modified in Mi Clínica?
No. Once a document leaves draft it is frozen: it can no longer be deleted or changed. A signed document is not cancelled: if something was wrong, a new version is made.