Clinical Record Retention and Closing a Private Practice in Canada

A practice does not stop having record-keeping responsibilities when the last appointment ends. Clinical files still need to remain accessible, confidential, and protected throughout the applicable retention period—even if you retire, move provinces, change software, or transfer your client list.

This guide gives solo psychologists, social workers, psychotherapists, and other private-practice professionals a practical framework for retaining, transferring, and destroying records. Canadian requirements vary by province, profession, regulator, and client age. Use this as an operations checklist, not as legal advice, and confirm the rule that applies to your licence.

The core principle: closing is not deleting

Clinical records contain highly sensitive personal information. You need a process that lets clients request access, protects files from unauthorized disclosure, and explains who is responsible for the record after your practice closes.

Privacy regulators generally distinguish between a legal or professional retention duty and the later destruction of information that is no longer needed. The right answer is not “keep everything forever” or “delete everything on closing day.” It is a documented lifecycle: collect only what you need, retain it for a justified period, then securely destroy or anonymize it.

How long should you retain a record?

There is no single Canada-wide number. Start with your college or professional association’s record-keeping and cessation-of-practice standards. Then check whether special rules apply to minors, legal holds, complaints, access requests, insurance claims, tax records, or court proceedings.

Before setting a destruction date, verify:

your regulator’s documentation and retention standard;
its process for retiring, relocating, or closing a practice;
different treatment for adult and minor clients;
whether a complaint, lawsuit, access request, or investigation pauses destruction;
tax, insurer, contract, and employer obligations.

Write the result into a retention schedule. Record the last service date, the applicable category, the planned destruction date, the person responsible, and the destruction method. A small, maintained schedule is more useful than an unsearchable archive with no owner.

A closing-practice checklist

1. Inventory every copy

List active and closed clients, notes, intake forms, consent forms, invoices, attachments, email, paper files, local devices, and backups. Include exports sitting in Downloads folders or shared drives. A database inventory that ignores a laptop is not a complete inventory.

2. Notify clients appropriately

Prepare a clear notice explaining the closing date, who will hold the records, how clients can request access or a copy, and where to direct future questions. If another professional will take over, obtain the required authorization and explain what will be transferred. A transfer is not a blanket permission to disclose every piece of information.

3. Appoint a record custodian

Identify the person or organization responsible after closure. A written custody or transfer agreement should address access requests, security, incidents, retention, destruction, fees, and what happens if the custodian later closes. Make sure clients know how to reach the custodian.

4. Secure the archive

Use individual accounts, multi-factor authentication, encryption where available, tested backups, and access logs. Remove access for former staff, students, and vendors. Paper records should be kept in a locked, access-controlled location protected from fire, water, and unauthorized viewing.

5. Plan the software exit

Before cancelling a practice-management subscription, confirm that you can export notes, attachments, dates, and audit-relevant metadata in a readable format. Restore a sample backup and verify it. Ask the vendor in writing when production data, backups, and support copies will be deleted, and retain evidence of the export and verification.

Privacy compliance is a lifecycle, not a checkbox

Canadian privacy obligations can apply alongside professional standards. In Quebec, Law 25 emphasizes privacy governance and rules for retention and destruction. In other provinces, substantially similar provincial health-privacy statutes or private-sector privacy laws may apply. If information is stored or accessed outside your jurisdiction, assess the applicable cross-border requirements before moving it.

For a solo practice, good governance can be concrete: name the person responsible, list where records live, limit access, document why data is retained, set a review date, and define secure destruction. A software provider can offer controls, but it does not make the professional’s decisions or responsibilities disappear.

How FYL.care can help

FYL.care brings client records, notes, appointments, and documents into one practice-management workspace. Consistent records, role-based access, and a deliberate export process make it easier to archive or transfer a file without hunting through spreadsheets, email threads, and local folders.

FYL.care is free for professionals building a more organized private practice. Create your FYL.care workspace and start documenting your retention process today.

FAQ

Can I delete every record on the day I close?

No. Closing the practice does not erase retention, confidentiality, access, or professional obligations. Check your regulator’s standard, confirm that no hold applies, and document destruction only after the required period ends.

Do I have to give every file to another clinician?

Not automatically. A transfer must follow professional rules, the applicable authorization or consent process, and data-minimization principles. Clients should know who holds the record and how to exercise their access rights.

What about backups containing records I already destroyed?

Include backups in your written policy. Set a rotation period, restrict access, and make sure backups do not become an uncontrolled permanent archive. Ask your regulator or insurer to review unusual cases.

Is free practice-management software acceptable for clinical records?

Price alone does not determine suitability. Evaluate access controls, encryption, backups, hosting location, vendor terms, export, deletion, and incident procedures. You should be able to explain and control the full record lifecycle.

Clinical Record Retention and Closing a Private Practice in Canada: A 2026 Guide