How do private GPs store their consultation notes?

What most private GPs do

Almost all private GPs now keep their notes in an electronic record, and most use a cloud-hosted system they reach through a browser. That lets you consult from different sites or remotely, send letters and prescriptions from the record, and avoid running your own servers. Systems private GPs use include Semble, Hero Health, EMIS, Cliniko, Meddbase, WriteUpp, Pabau and Jump EHR, and each answers the storage questions below differently. A few still use paper, which is allowed but harder to run well. See can I take paper notes?

If you work under practising privileges or as a sessional GP for another provider, you will normally write in their system and they are responsible for storage. This article is for GPs running their own service.

What the law and the CQC expect

• CQC Regulation 17 requires you to maintain securely an accurate, complete and contemporaneous record for each patient, including the care provided and the decisions taken. Records must be kept secure, and created, stored and disposed of in line with legislation and national guidance.
• UK GDPR and the Data Protection Act 2018 apply to health data as special category data. You need appropriate security, a lawful basis, a privacy notice and, in most cases, registration with the ICO. See ICO registration.
• GMC guidance expects clear, accurate and legible records made at the time or as soon as possible afterwards.

You are the controller, the supplier is your processor

When you use a record system supplier, your practice decides why and how patient data is used, so it is the data controller. The supplier processes the data on your behalf. The ICO says that whenever a controller uses a processor, a written contract must be in place, covering matters such as security, sub-processors, help with patients’ rights requests and audits. Most suppliers provide a data processing agreement. Read it, and keep a copy.

Questions to ask about storage

Question	Why it matters
Where is the data hosted?	Transfers outside the UK bring extra UK GDPR requirements. Many practices prefer UK hosting.
What security certifications does the supplier hold?	Cyber Essentials Plus and an NHS Data Security and Protection Toolkit (DSPT) submission are useful signs, though not the whole picture.
How are backups made and tested?	You must be able to restore access to data in a timely way after an incident.
Is there an audit trail?	It shows who viewed or changed each record, which helps with complaints and CQC evidence.
Can you export everything?	You need the full record, including letters and attachments, in a usable format if you change system or close.
What happens at the end of the contract?	The supplier should return or delete data as you instruct.

The DSPT is compulsory for organisations with access to NHS patient data and systems. A purely private GP may not need to complete it, but a supplier that has done so has been through a recognised assessment.

Structure and coding

How you record matters as much as where. Coded entries, for example using SNOMED CT, make records searchable for recalls, audits and registers, and make letters to NHS GPs easier to code at the other end. Free text alone is harder to search and easier to miss. See how to choose a record system.

Day-to-day security

• Use individual logins with multi-factor authentication. Never share accounts.
• Lock screens and log out on shared devices.
• Keep devices updated and encrypted, and use a secure network. See setting up your IT.
• Do not store clinical notes in personal email, messaging apps or unencrypted documents.
• Have a plan for downtime, such as a paper template that you add to the record afterwards.

How long to keep records

There is no retention period written specifically for private GPs. NHS England’s Records Management Code of Practice applies to NHS records but says private providers can use it for guidance. It says the NHS GP record should be kept for the life of the patient plus at least ten years after death. Many private GPs adopt a defined policy based on the code, and your medical defence organisation can advise on the periods it recommends. Write your policy down and apply it consistently, including confidential destruction at the end.

Patients’ access requests

Patients have the right to a copy of their record. The ICO says you must respond without undue delay and within one month, extendable by up to two months for complex requests. You cannot normally charge a fee. An electronic record that can export a patient’s full history makes this quick.

If you close or sell the practice

Decide early who will hold the records if you stop practising, how patients can get copies, and how long the records will be kept. Build this into your supplier contract and your business plan.

Outside England

UK GDPR applies across the UK. Scotland and Wales have their own records management codes, and independent clinics there are regulated by Healthcare Improvement Scotland and Healthcare Inspectorate Wales, and in Northern Ireland by the RQIA.