Every physiotherapy appointment generates a clinical record. The HCPC Standards of proficiency and the CSP guidance both apply. Your records must be full, clear and accurate. You must keep them for the periods in the NHS Records Management Code of Practice. For an adult that is 8 years after the last contact. For a child it runs to the 25th birthday, or the 26th if the young person was 17 when treatment ended. Health data is special category data under the Data Protection Act 2018 and UK GDPR. Poor record keeping is one of the most common reasons physiotherapists are referred to the HCPC. This article sets out the concrete requirements and what software needs to do to support them without forcing extra work.
Connect with us about physiotherapy software · · Replies within 24 hours
The HCPC Standards of proficiency for physiotherapists and the Standards of conduct, performance and ethics require full, clear and accurate records. Poor record keeping is one of the most common reasons for referral to the HCPC. The CSP guidance PD061 repeats this duty. Physiotherapy staff must keep an accurate record of every interaction with a patient. The duty is both professional and legal. Records are legal documents and may be the only robust defence against a claim.
Records can be paper or electronic (or a mixture). The system your employer or practice specifies is the one you must use. The purpose is to allow a third party to make a judgment based on the content. The main rules are short. Write the entry at the time. Keep it readable on paper or on screen. Identify the patient. Record the assessment, the treatment and the consent. Add anything else that bears on the patient's health and care.
Health data is special category data under the Data Protection Act 2018 and UK GDPR. Clinics holding patient health records must pay the ICO data protection fee and have appropriate policies for security, access, and retention.
The NHS Records Management Code of Practice 2021 (England) sets the minimum retention periods that are widely used as best practice:
Electronic systems must preserve the audit trail for the retention period of the record. When records are destroyed or deleted at the end of the retention period, it must be done securely and documented.
Connect with us about physiotherapy software · · Replies within 24 hours
A system that supports HCPC and CSP record-keeping needs to make the right thing the easy thing:
Most off-the-shelf systems support basic notes and some audit. Four things separate these systems. The depth of the audit trail. Whether templates are flexible or fields are enforced. How they handle retention and deletion. How easily they produce a complete record you can defend at an HCPC audit or in a legal request.
Look closely at the children's rule. The date you must keep a record until depends on the patient's age when treatment ended.
A seventeen-year-old and a sixteen-year-old therefore produce different retention dates from the same course of treatment. No person can hold that in mind for every record, across decades.
This is why retention fails in practice. The rule is not hard, and it is impossible to apply by memory at scale.
We build clinic systems on engage.re. Each record carries its own retention class, calculated when the record is made. The system therefore knows the exact date for that patient, and it holds the record until then.
Deletion at the end is an event in a signed chain, so you can show what you destroyed and when. Each record is also encrypted separately under a key you hold, so destroying the key destroys access to that record, including in a backup.
We explain provable deletion in can you prove you deleted someone's data. We explain why an audit trail must resist change in who answers when an AI agent gets it wrong.
A bespoke system can have the exact templates, body charts, outcome measures, consent flows and reporting your clinic uses built in from the start. Compliance (audit trail, retention logic, access controls) is in the data architecture, not a checklist maintained separately. You own the code. A regulator or a commissioner can change a rule, and you change the system. You wait for no vendor roadmap, and you pay no extra for each user.
If you want to see what a system built around these requirements actually looks like, ESRE's live physiotherapy demo opens without a login. Sign in as a physio to write a note, with an exercise plan and a consent record. Sign in as owner to see the audit and reporting views. See the physiotherapy software hub for the demo and more.
Connect with us about physiotherapy software · · Replies within 24 hours