September 6, 2026 How Long Must You Keep a Patient Chart? Records Retention, Backups, and PHIPA in Ontario
Ask a busy practice how long it keeps patient records and the honest answer is usually “forever, more or less.” Charts stay in the practice-management system, old radiographs pile up on the imaging server, and nothing is ever really deleted because deleting things feels risky. It is an understandable instinct, and it is also the wrong policy. In Ontario, records retention is not a matter of preference – it is set by the Royal College of Dental Surgeons of Ontario (RCDSO), reinforced by the Personal Health Information Protection Act (PHIPA), and quietly turned into an IT problem the moment your records went digital. This is the operator’s view of that problem: how long you must keep records, why the end of a record’s life is a compliance event of its own, and how your backups both rescue and complicate the whole thing.
The ten-year rule, and the trap inside it
The baseline most Ontario practices work from is the RCDSO recordkeeping standard: a patient’s dental record must be retained for at least ten years after the date of the last entry. For a patient who was a minor, the clock is more generous – retention runs for ten years after the day the patient reached, or would have reached, the age of majority. Radiographs are part of the clinical record, so a bitewing series taken today is subject to the same decade-plus horizon as the written chart. Financial records live under a separate schedule entirely: the Canada Revenue Agency generally expects business records to be kept for six years. So a single patient visit can spawn two overlapping retention clocks running on different timelines.
The trap is that these are minimums, expressed in years, being applied to data that lives on hardware measured in months. A ten-year retention obligation quietly assumes that the drive, the server, the backup, the imaging software, and the file format will all still exist and still be readable a decade from now. None of that is guaranteed by default. Retention is a promise your IT has to be built to keep, not a checkbox in your PMS.
PHIPA makes retention an IT obligation, not a filing habit
PHIPA is where retention stops being a College standard and becomes a legal duty about how you hold the data. As a health information custodian, a dental practice must take reasonable steps to protect personal health information against theft, loss, and unauthorized use – for the entire time it is retained, and through the moment it is destroyed. That framing matters. Every year you keep a record, you are also on the hook to keep it secure. The obligation does not pause because a chart is inactive; an archived record from 2019 carries the same protection duty as the patient you are treating this afternoon.
This is why retention and security cannot be run as separate projects. An old radiograph archive sitting on an unpatched, unmonitored server in the back room is not “just storage” – under PHIPA it is live personal health information you are legally responsible for. The same discipline that governs your active systems has to reach the archive, or the archive becomes your weakest point.
Backups: the thing that saves retention, and the thing that breaks disposal
Retention has a recoverability requirement hiding inside it. Keeping a record for ten years is meaningless if a drive failure or a ransomware event wipes it in year four. This is where a genuine backup strategy earns its place: a primary copy on the practice server, a local backup for fast recovery, and an offsite or immutable copy that a network attacker cannot reach or encrypt. The immutable copy is the part practices most often skip and most often need – it is what lets you honestly say a decade of records will still exist after a bad day. And a backup you have never restored is a hope, not a plan; we have made the case before that your backups are only as good as your last test restore, and retention is exactly the obligation that assumption is protecting.
But backups cut the other way too. When a record’s retention period ends and you securely destroy it from the live system, copies of it usually still exist inside your backup sets and archives. Truly disposing of personal health information means accounting for those copies – either through backup rotation that ages them out on a defined schedule, or through a documented policy that treats backup-resident data as protected until it expires. A disposal process that only touches the production system, and quietly leaves ten years of the same record in cold storage, is not a disposal process.
Disposal is a compliance event, not a right-click
The end of a record’s life gets almost no planning attention, and it should get a lot. Under PHIPA, personal health information must be disposed of securely, in a way that makes reconstruction impossible. For paper, that means cross-cut shredding or a bonded destruction service, not the recycling bin. For digital records, “delete” is not disposal – a deleted file is typically still recoverable until it is overwritten. Secure digital destruction means cryptographic erasure, a verified secure wipe, or physical destruction of the media, ideally paired with a certificate of destruction you can produce if you are ever asked to prove it.
That paper trail is the point. If a former patient, the College, or the Information and Privacy Commissioner asks what happened to a record, “we think it was deleted” is not an answer. A dated destruction log, tied to a retention schedule, is. Disposal done properly is auditable by design.
Why keeping everything is now a liability, not a safety net
The old instinct – keep everything forever, just in case – made sense when the risk of holding data was near zero. It is not zero anymore. Every record you retain past its required life is additional blast radius on the day you are breached: more patients to notify, more data in the dump, more exposure in the class action. When we broke down what a data breach actually costs a dental practice, the size of the exposed dataset was a direct multiplier on the bill. Data you have already destroyed – lawfully, on schedule – cannot be stolen. Retention discipline is, in that sense, a security control.
There is a format problem lurking behind all of this too. A ten-year horizon means the imaging you capture today has to remain both stored and readable long after the sensor, the workstation, and possibly the software vendor have changed. Proprietary formats, orphaned imaging applications, and un-migrated archives can leave you technically compliant on retention but practically unable to open the file – which is its own failure. Planning storage for the long haul is part of the same conversation as building imaging storage infrastructure that can grow with the practice.
What a defensible retention program looks like
Pulling it together, a dental practice that can stand behind its records handling has a few things in place. A written retention schedule that reflects the RCDSO minimums, the age-of-majority rule for minors, and the separate CRA horizon for financial records. Storage and backups – including an immutable offsite copy – engineered to keep records both recoverable and secure for the full period. A disposal process that is scheduled, secure, and logged, and that accounts for backup-resident copies rather than pretending they do not exist. And a format-migration plan so that a decade-old radiograph is not just retained but openable.
None of this is glamorous, and none of it shows up in a treatment plan. But it is the difference between a practice that can answer a records question in minutes and one that discovers, mid-audit or mid-breach, that its policy was “keep everything and hope.” If you are not sure whether your retention, backup, and disposal setup would hold up to a PHIPA review, that is exactly the kind of assessment worth doing before someone asks. Contact Compudent Systems and we will map your current records lifecycle against what Ontario actually requires – and fix the gaps before they become the story.
Sources & further reading:
- RCDSO Standards of Practice and Guidelines (Dental Recordkeeping)
- Personal Health Information Protection Act, 2004 (Ontario e-Laws)
- Information and Privacy Commissioner of Ontario – Resources
- Canada Revenue Agency – Keeping records
Related Reading
- The ADA Now Says Scan Less — So Your Records Have to Say Why: What the 2026 Imaging Guidelines Mean for Your Practice Software
- Can Your Dental Practice Use ChatGPT Without Breaking HIPAA and PHIPA? A 2026 Compliance Guide
- From Roentgen’s Lab to Your Practice Server: How Dental X-ray Imaging Became an IT Discipline