How long should we keep patient records?

Short answer: At least the legal minimums, with a written reason for anything longer

Keep them for at least the periods health laws set: indoor records for three years from the start of treatment under the 2002 medical ethics regulations, PCPNDT records for two years, MTP registers for five years, Schedule H1 registers for three years, and ethics committee trial records for five years after a trial. Many hospitals keep records longer for continuity of care and legal claims. Write the period and reason for each record type, then erase or archive.

What the law says

Section 8(7) allows retention where a law requires it; Rule 8(3) sets a one-year floor.

Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.

Steps

List record types: OPD, IPD, lab, imaging, billing, PCPNDT, MTP, pharmacy.
Note the legal minimum.
Decide any longer period and why.
Archive with restricted access.
Record each deletion.

Evidence to keep

Retention schedule
Archive access list
Deletion log

Common mistakes

No schedule at all
Deleting before the minimum
Keeping open access to old records

From each seat

DPO / Privacy lead: Use this in erasure replies.
CIO / IT head: Archive tiers for old records.
Legal & compliance: Approve the longer periods and reasons.
Administration department: Records rooms follow the schedule.

What a good answer from management sounds like

“One retention schedule covers every record type with its legal basis, and archives are restricted.” Effort and time: Medium.