South Africa

HPCSA record keeping: what Booklet 9 asks of a practice

What goes in the record, how to correct it, how long to keep it and who may see it, with clause numbers so you can check the booklet yourself.

Updated 16 October 2026.

Information, not legal advice. This page is a practical overview for practices. It is not a substitute for advice on your own contracts, insurance or registration.

If you are registered with the Health Professions Council of South Africa (HPCSA), the reference for your clinical records is Booklet 9, Guidelines on the keeping of patient health records. The HPCSA says these guidelines "form an integral part of the standards of professional conduct against which a complaint of professional misconduct will be evaluated". This page summarises what the booklet asks for, with its clause numbers, so you can check each point against the text yourself.

The text read for this page is Booklet 9 as revised in September 2022, published by HPCSA Corporate Affairs on 10 November 2022 on the HPCSA blogs page on patient record keeping, with the booklet as a PDF. The booklet says it applies to all persons registered with the HPCSA. Sources were read on 16 October 2026. Booklets are revised, so confirm you have the current version on the HPCSA's own channels before you rely on a detail.

What the record must contain

Clause 3.2 lists what the booklet calls the compulsory elements of a patient health record:

• the patient's personal (identifying) particulars
• the full biopsychosocial history, including allergies and idiosyncrasies
• the time, date and place of the consultation
• the assessment of the patient
• the proposed management
• the medication and dosage prescribed
• details of referrals to specialists and other healthcare professionals
• the patient's response to treatment, including adverse effects
• investigations ordered and their results
• details of times the patient was booked off work or similar activities, and the reasons
• written proof of informed consent, when this is relevant

Clause 3.1.2 adds the interactions that belong in the record. These include face-to-face discussions, progress notes, virtual or telephone consultations with the patient and their relatives, discussions with colleagues about the patient, and all correspondence about their care. A phone call with a worried family member, or a conversation with a colleague about risk, is part of the record too.

Five principles for every entry

Clause 4 sets out the principles a record must meet.

• Contemporaneous (4.1). Made at the time of each interaction, or as soon as possible afterwards. Late entries and addenda must be marked as late, with the reason.
• Integrity (4.2). Accurate, complete and comprehensive. Clear, legible and unambiguous, especially where abbreviations are used. Not tampered with, free of derogatory language, and regularly checked.
• Attributable (4.3). The person making an entry must be identifiable. Where several professionals share a record, each entry must be dated and timed, and signed in full, or signed electronically in an electronic record.
• Accessible (4.4). The record must be available whenever the patient is seen. Critical information, such as allergies and special needs, should be recorded prominently so it is not missed.
• Securely stored (4.5). Citing section 17(1) of the National Health Act, the booklet says the person in charge must put control measures in place to prevent unauthorised access to records and to the system that holds them.

Correcting a record

Corrections are allowed. Hiding them is not. Clause 5 says late and additional entries must be dated and signed in full, and in an electronic record a change must be fully attributable to the person who made it. The reason for an amendment must be written on the record.

For paper notes, the checklist in clause 10.5 describes the method. Put a line through the original entry so it stays legible, sign and date the change, and where possible make a new note that refers to the correction without altering the first entry. In an electronic record, look for the same outcome: the original stays readable, and the record shows who changed what, when and why.

Privacy and security

Clause 6 applies to every record, electronic or paper (6.2). Records must be protected against improper access and disclosure. The booklet calls for restricted, authorised access, and says electronic data should be managed, stored and backed up to internationally accepted standards, naming ISO 27799 (information security management in health) as an example (6.4). Confidentiality must also be protected when records are sent electronically or moved between facilities and professionals (6.5).

The Protection of Personal Information Act 4 of 2013 (POPIA) sits alongside the booklet. Clause 9.5 of Booklet 9 notes that POPIA lets health professionals process special personal information, such as health information, where it is necessary for the proper treatment and care of the patient. Two POPIA sections are worth reading in full:

• Section 19 requires appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, and unlawful access to personal information. It also requires you to identify foreseeable risks, put safeguards in place, check that they work, and update them.
• Section 22 requires you to notify the Information Regulator, and the affected person, as soon as reasonably possible when there are reasonable grounds to believe their personal information has been accessed or acquired by an unauthorised person.

Our POPIA and therapy notes guide covers the responsible party, the operator and cross-border hosting in more detail.

How long to keep records

Clause 7 sets the retention rules. In summary:

The booklet also asks for a balance between the cost of long-term retention and the risk to your defence in a complaint or litigation (7.4). For how UK bodies such as BACP and UKCP approach the same question, see how long to keep therapy records.

Who owns the record and who may see it

The record belongs to the practitioner or the entity that created it, and the patient is entitled to access the information in it (8.1, 8.2). Clause 9 sets out the access rules the booklet draws from the law:

• A person aged 12 or older may have a copy, an abstract or direct access to their own records on request (9.2.1, citing the Children's Act).
• For a patient under 16, a parent or legal guardian may apply for access, but access should be given only on the patient's written authorisation (9.2.2, citing the Promotion of Access to Information Act).
• Information must not be given to a third party without the patient's written authorisation, a court order, or where non-disclosure would be a serious threat to public health (9.2.4).
• Clause 9.3 lists the exceptions where records may go to a third party without written authorisation. These include a court order, a practitioner defending a claim or an HPCSA disciplinary matter, a statutory duty to report (for example suspected child abuse under the Children's Act), and a serious threat to public health.

Two items from the checklist in clause 10 matter for day-to-day work. Copies of records should be released only after proper authorisation (10.6), and billing records should be kept separate from patient care records (10.7).

Closing a practice

If you close a private practice, for retirement or any other reason, clause 8.7 says you must inform all patients in writing within three months of closure. Tell them the closing date, that they may ask for their records to go to a practitioner of their choice, and that the remaining records will be kept safe for at least 12 months by an identified practitioner or institution. Clause 8.6 covers the different steps when a practitioner dies and the executor deals with the records. Read these clauses alongside the retention rules in clause 7.

A quick checklist

• Each entry is made at the time, or marked as late with a reason (4.1)
• Each entry shows who made it, and is dated and timed where several people share the record (4.3)
• The compulsory elements in clause 3.2 are in the file, including consent where relevant
• Allergies and special needs are easy to see (4.4)
• Corrections keep the original readable and give a reason (5, 10.5)
• Access is restricted to authorised people, and backups follow a recognised standard (6.4)
• Your retention period meets clause 7 and any statute that applies to your work
• Copies are released only with proper authorisation (10.6), and billing sits apart from clinical notes (10.7)
• You know who will look after the records if the practice closes (8.7)

Where software helps, and where it does not

Software cannot make a note contemporaneous or accurate. That is still the practitioner's job. It can make the principles above easier to keep.

In Reach + Within, every user has their own login, so entries are attributable to a named person. An audit trail nobody can edit or delete records who viewed or changed what, and when. For residential services, completed admission forms in Within lock after a set period, and a later change needs an edit with a reason, so the record shows what changed and why. Billing sits in Reach and the clinical record sits in Within, and practice assistant and accounts logins cannot open clinical notes. Client data is hosted in the EU (Netherlands) and encrypted in transit. See security and hosting for the detail.

Nothing in Reach + Within sets your retention period for you. That is your policy, written where clients can read it. To see how this works for a South African practice, read about POPIA-compliant practice software, practice software for psychologists or practice management software for South African therapists.

Sources

• HPCSA, Guidelines on patient recordkeeping, HPCSA Corporate Affairs, 10 November 2022
• HPCSA, Booklet 9: Guidelines on the keeping of patient health records, revised September 2022 (PDF)
• South African Government, Protection of Personal Information Act 4 of 2013
• POPIA text, section 19 and section 22

Related reading

• POPIA and therapy notes
• How long to keep therapy records
• POPIA-compliant practice software