Can I take paper notes for my private general practice?

What the rules actually say

There is no rule that a private GP must keep electronic records. In England, CQC Regulation 17 requires providers to maintain securely an accurate, complete and contemporaneous record for each patient, including the care and treatment provided and the decisions taken. The CQC’s guidance says records can be paper or electronic, provided they comply with the Data Protection Act 2018, and that they must be complete, legible, indelible, accurate and up to date.

Data protection law applies to paper too. UK GDPR covers personal data held in a structured filing system, and patient notes filed by name are exactly that. The ICO’s guidance on security makes clear the security principle covers every aspect of processing, not only cyber security, and highlights lost, stolen or badly disposed of paper records as a common cause of incidents.

What a paper record must meet

• Security. Locked storage, controlled keys, and a clear rule on who can access files. Notes must never be left in cars or at home unsecured.
• Legibility and indelibility. Written in ink, dated, timed where relevant and signed.
• Completeness. Letters, results, consent forms and prescriptions filed in the same record, promptly.
• Availability. The record must be available to whoever sees the patient next, including a locum.
• Retention and disposal. A written retention period and confidential destruction at the end. See how private GPs store consultation notes.

The practical drawbacks

Task	Paper	Electronic record
Prescribing safely	Manual checks against the BNF	Many systems check interactions, allergies and doses automatically
Sending a summary to the NHS GP	Typed separately, then posted or scanned and emailed	Generated from the record and, in some systems, sent electronically
Remote consultations	Notes are in the clinic, not with you	Available wherever you log in securely
Recalls and audits	Searching files by hand	Searchable, often coded, lists
Backup	One copy unless you duplicate it	Supplier backups, which you should check
Access requests	Photocopying the whole file within one month	Export from the system

The ICO says you must respond to a subject access request within one month, extendable by up to two months for complex requests. That is manageable with a few paper files and a real burden with hundreds.

Paper also makes CQC assessment harder. Inspectors will want to see evidence that records are complete and that results and letters are acted on. Showing that from paper files takes longer.

When paper can still work

Paper is reasonable for a few situations:

• a very small number of patients while you test demand, with a clear date to move to an electronic record
• as a downtime fallback when your electronic system is unavailable, transcribed or scanned into the record afterwards
• signed forms that you scan and attach

If you work under practising privileges at a clinic or hospital, you will normally use its record system, so the choice is not yours. See practising privileges.

Avoid permanent hybrid records

Handwriting in the room and typing up later doubles the work and creates two versions of the truth. If you do it, treat the typed version as the record, write it up the same day, and decide what happens to the handwritten notes.

Moving from paper to electronic

NHS England’s Records Management Code of Practice is written for the NHS, but it says private providers can use it for guidance. Its advice on scanning is a sensible standard:

1. Scan both sides of every page, including blank pages, so the copy is complete.
2. Check the quality of the scanned images against the originals.
3. Save scans in a format that cannot be edited, with an audit trail showing nothing was changed afterwards.
4. Only destroy paper originals once quality assurance is complete, and do it confidentially.

Choosing an electronic record

If you move to an electronic record, look for coded notes, a UK drug database for prescribing checks, a way to send letters to NHS GPs, UK hosting and a clear data export. See how to choose a record system. Whatever you choose, register with the ICO if you need to. See ICO registration for private GPs.

Scotland, Wales and Northern Ireland

UK GDPR and the Data Protection Act 2018 apply across the UK. Record-keeping standards for independent clinics in Scotland, Wales and Northern Ireland are set by Healthcare Improvement Scotland, Healthcare Inspectorate Wales and the RQIA, so check their requirements.