In most of Australia the working rule is seven years from the last service you provided, or, if the client was under 18 when the information was collected, until they turn 25. That rule is written into law in New South Wales, Victoria and the ACT, and it is the professional standard everywhere else.
That sentence answers most retention questions. What catches practices out is the rest: when the clock starts, what counts as a clinical record, what you must document when you destroy a file, and who holds the records once a practice closes.
Which laws actually set the retention period?
Two layers apply at once.
The first is Commonwealth. The Privacy Act 1988 covers every private organisation that provides a health service and holds health information, and the small business exemption does not rescue you. As the OAIC puts it, such an organisation is covered "even if they're a small business". A solo psychologist in a spare room is covered on the same terms as a 40-clinician group.
The second layer is state and territory health records legislation, where the actual numbers live. Only three jurisdictions have a private-sector health records statute: New South Wales, Victoria and the ACT. Everywhere else the Privacy Act is the only binding instrument, and professional standards fill the gap.
What do NSW, Victoria and the ACT require?
The three statutes land on the same two benchmarks, which is why the seven-year rule travels so well.
New South Wales. Section 25 of the Health Records and Information Privacy Act 2002 requires a private sector health service provider to retain health information collected while the individual was an adult for seven years from the last occasion on which a health service was provided to them, and information collected while the individual was under 18 until they attain the age of 25. Section 25(2) and 25(3) add a paper trail: on deletion you keep a record of the individual's name, the period the information covered and the date it went, and on transfer you keep the name and address of the organisation it went to. The NSW Information and Privacy Commission publishes a plain-English fact sheet on the same obligation.
Victoria. Health Privacy Principle 4.2 in Schedule 1 of the Health Records Act 2001 says a provider must not delete health information until after the individual attains 25 (where it was collected while they were a child) or more than seven years after the last occasion a health service was provided, "whichever is the later". HPP 4.3 then requires a written note of the individual's name, the period covered and the deletion date, and HPP 4.4 covers transfers. The Health Complaints Commissioner is the regulator to read on this.
ACT. Principle 4.1 in Schedule 1 of the Health Records (Privacy and Access) Act 1997 states the rule as a prohibition. A record keeper must not destroy a health record unless destruction happens after the consumer turns 25 (where they were under 18 when the information was collected) or seven years after the day a service was last provided (where they were an adult). The ACT also requires a register recording, for each record destroyed or transferred, the consumer it related to, the period it covered, the destruction date, and the entity it was transferred to.
What applies in Queensland, WA, South Australia, Tasmania and the NT?
None of those five has a private-practice health records statute, and their own privacy legislation, where it exists, generally binds public sector agencies rather than private practices. That does not leave you unregulated. Two other instruments bind you instead.
The first is Australian Privacy Principle 11. APP 11.1 requires you to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. APP 11.2 then requires you to destroy or de-identify personal information you no longer need, with an explicit carve-out where you are required by an Australian law or a court or tribunal order to retain it. Note the direction of that duty: APP 11.2 pushes towards deletion, not hoarding.
The second is your professional standard, which is what supplies the missing number. The APS Code of Ethics is explicit at B.2.2 and B.2.3: psychologists "keep records for a minimum of seven years since last client contact unless legal or their organisational requirements specify otherwise", and where records were collected while the client was under 18, retain them "at least until the client attains the age of 25 years". Between APP 11.2 and the professional standard, a Brisbane or Perth practice ends up on the same seven-year and age-25 benchmarks as a Sydney one.
When does the seven-year clock start?
Not on the date the note was written. It runs from the last occasion you provided a health service to that client, so one follow-up session four years after a discharge restarts the clock across the whole file.
The under-18 rule works differently again. It is age-based, not service-based. A client seen at 8 and never seen again still has a file you hold for 17 years. A paediatric or youth caseload therefore needs its own disposal schedule, and any practice applying "seven years since discharge" as a single global rule will destroy children's files far too early.
Which records does this cover?
Broader than most clinicians assume. The obligation attaches to health information, not to a document type, so it captures progress notes in any format, assessment reports and raw test data, incoming referrals and outgoing correspondence, consent forms, risk assessments and safety plans, and the parts of your appointment and billing history that carry clinical meaning. If you are unsure what belongs in the file at all, our guide to what clinical notes are covers scope, and psychotherapy notes versus clinical progress notes covers the one distinction that genuinely changes what you keep.
Session recordings are health information and sit under the same clock. So do AI scribe transcripts and drafts: if a transcript informed the note, it formed part of the record you relied on, and deleting it selectively while retaining the polished note is hard to defend. Ahpra's guidance for practitioners using AI is the reference point, and the practical answer is to set a transcript policy once and apply it consistently.
Can you delete anything early?
Rarely, and not on a hunch. In NSW, Victoria and the ACT the statutes are a floor, so early destruction is a breach however confident you are that nobody wants the file. Elsewhere APP 11.2 does create a duty to destroy or de-identify once the information is no longer needed, but "no longer needed" has to survive scrutiny against your professional standard and any live or foreseeable complaint, claim or subpoena. If a notification, insurance matter or court process is on foot, retention is mandatory and the question closes.
The more common failure is the opposite one: retaining everything forever because deletion feels risky. Indefinite retention is not a neutral choice. Every extra year of files is another year of breach exposure under APP 11.1, and in the APP 11.2 jurisdictions it is its own compliance problem.
What do you have to do when you destroy a record?
Three things, in order.
Document it. All three statutes require this in some form: a written note in Victoria under HPP 4.3, a deletion and transfer record in NSW under section 25(2) and 25(3), and a destruction and transfer register in the ACT. Even where no statute demands it, that log is what lets you answer "what happened to my file?" years later without guessing.
Destroy it properly. Secure destruction means the information cannot be reconstructed: cross-cut shredding or a certified destruction service for paper, and for digital records, deletion that actually removes the data rather than moving it to a folder you stop looking at.
Remember the copies. Backups, exports, a laptop sync folder, an old email with an attached report, and the practice management system you migrated away from all hold the same record. A disposal policy that covers only the live system is not a disposal policy. PractaLuma is AI-native practice management software for Australian mental-health practices, and keeping client records and document storage in one system, with a real deletion path, is what makes a seven-year schedule executable rather than aspirational. What is included is set out on our pricing page.
What happens to records when you close, sell or leave?
Records do not stop existing when a practice does. The retention clock keeps running against whoever holds them.
Victoria is the most prescriptive: under HPP 10 a provider closing or transferring a practice must notify current and former clients by public notice, with a notice in the practice and letters to current clients. NSW section 25(3) and the ACT register both require the transfer itself to be recorded. If you are merging or being acquired, treat record custody as a term of the deal and get it in writing before the systems are switched off.
What if a client asks for their records?
The retention period is also an access period. Under APP 12 you must give an individual access to the personal information you hold about them unless an exception applies. The OAIC's guidance is that an organisation should respond within a reasonable period, and as a general guide that should not exceed 30 calendar days. You cannot charge for making the request, though you may charge a non-excessive fee for providing access.
That timeframe is a records-management test more than a legal one. If retrieving a five-year-old file means searching three systems and a filing cabinet, 30 days gets tight. A consistent clinical note template is what makes an old file legible when the request lands.
Five mistakes worth avoiding
- Running the clock from the note date rather than the last service date.
- Applying the adult seven-year rule to files opened when the client was a child.
- Destroying the live record while backups, exports and a legacy system still hold copies.
- Destroying anything while a complaint, claim, insurance matter or subpoena is live.
- Keeping everything forever and calling it caution, which quietly grows your breach exposure.
Frequently asked questions
Does the seven years run from the first session or the last? From the last occasion you provided a health service to that client. A single later session restarts it for the whole file.
What if a client was 16 when I first saw them and 19 at the last session? Each rule applies to the information it covers: material collected before they turned 18 is held until they turn 25, and later material for seven years from the last service. The age-25 date usually falls later, so that is the one to diarise.
Do these rules apply to telehealth clients in another state? State legislation follows where the service is provided and where the record keeper operates, so a practice working across borders is safest applying the strictest applicable standard, which is the seven-year and age-25 combination.
Are AI scribe transcripts part of the clinical record? If a transcript informed the note you relied on, treat it as part of the record and apply the same retention and disposal rules.
Is scanning and shredding the paper file allowed? Generally yes, where the electronic copy stays readily accessible and usable for later reference. The ACT legislation says this expressly. Check your own jurisdiction's wording first.
This article is general information for Australian practitioners, not legal advice. Retention obligations differ by state, profession and circumstance, so check the legislation that applies to you, or take advice, before setting a disposal schedule.