How Long Must Vet Practices Keep Medical Records?

The short version, by jurisdiction: in the United States, most states require records to be kept 3–5 years after the last exam or treatment (Connecticut and Vermont go to 7 — your state board's rule is the one that counts). In the UK, the RCVS sets no fixed period for clinical records, but UK medicines rules require medicines records for food-producing animals to be kept at least 5 years, and indemnity insurers often expect similar. In Germany, the TÄHAV requires veterinary documentation to be kept at least five years. In Denmark, there is — surprisingly — no direct general journal-retention statute for vets, but medicines records are mandatory and professional standards effectively require a proper journal anyway. Everywhere in the EU, GDPR adds a ceiling as well as a floor for client data. This article is orientation, not legal advice: confirm the current rule with your own board or regulator before setting policy.

Why there's no single answer

"How long must I keep records?" has three different answers layered on top of each other, and confusion between them causes most of the bad advice online:

1. The regulatory minimum — what your practice act, board rule, or national regulation explicitly requires. This varies by jurisdiction and sometimes by animal type (food-producing animals almost always carry longer, stricter medicines-record duties).
2. The liability horizon — how long a client could bring a complaint or malpractice claim. The AVMA's guidance on state retention laws makes this point directly: beyond the legal minimum, "veterinarians should also consider the statute of limitations for malpractice lawsuits in deciding how long to keep patient records."
3. The data-protection ceiling — in Europe, GDPR's storage-limitation principle: personal data may be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed." Keeping everything forever is not a compliant default either.

A sound practice policy names all three numbers and keeps records for the longest of the first two — then actually deletes on schedule, satisfying the third.

United States: state boards rule

There is no federal retention rule for veterinary records; each state's veterinary practice act (enforced by the state board) sets its own. Per the AVMA's summary of state laws: "Typically, states require veterinarians to keep records for three to five years after the most recent patient examination or treatment," with outliers — "Connecticut and Vermont both require veterinarians to retain records for seven years from the date of the most recent treatment — or, in Connecticut, three years following the death of the patient."

Practical implications: multi-state practice groups should standardize on the longest applicable period rather than maintain per-state deletion schedules, and every US practice should know two numbers — the board's minimum and the state's malpractice limitation period — and retain to the greater.

United Kingdom: no fixed number, real obligations anyway

The RCVS Code's supporting guidance takes a principles approach: "Clinical records should be retained for as long as is necessary, taking into consideration legal and regulatory responsibilities." It explicitly points practices to two anchors. First, medicines law: under the Veterinary Medicines Regulations, "medicines records must be kept for food producing animals for at least 5 years." Second, insurance: professionals "may also wish to consider the terms of professional indemnity insurance policy conditions, which may specify minimum retention periods."

In practice, most UK practices land on a written policy in the 6–7 year range for clinical records — comfortably past the medicines floor and typical civil limitation periods — but that convention is a risk-management choice, not an RCVS mandate. The guidance also covers the exit: records "should be destroyed in a manner which safeguards against accidental loss or disclosure of content."

Germany: five years, in writing

Germany is the cleanest case in this list. §13 of the TÄHAV (the regulation governing veterinary in-house pharmacies and documentation) requires the specified veterinary records — medicines acquisition and dispensing, treatment documentation for food-producing animals, and related evidence — to be kept "mindestens fünf Jahre... und der zuständigen Behörde auf Verlangen vorzulegen": at least five years, and presented to the competent authority on request. Records may be electronic, provided they remain readable and unalterable for the full period. Note the flip side, unusual among these jurisdictions: once the five years pass and the data is no longer needed, deletion is expected — the GDPR ceiling written into sector law.

Denmark: the surprising gap (and why it doesn't matter in practice)

Here's the finding that surprises even Danish vets, documented in the Danish Veterinary Journal: "no law establishes journal duty for a veterinarian as a starting point" — there is no general statutory patient-journal requirement like the one human healthcare providers have. What does exist is concrete and enforced: under the Veterinary Act (dyrlægeloven §11, stk. 3), "a veterinarian must keep records of applied, dispensed and prescribed prescription medicines," with additional specific record requirements for production animals.

Why the gap doesn't help you skip journaling: the same act's §8 duty of "care and conscientiousness" is interpreted through your records — the Veterinary Health Council has specified what a journal should contain precisely so vets can demonstrate compliance — and the Danish Veterinary Association's ethical code calls a quality-assurance-ready journal good professional practice. A Danish vet defending a complaint without a journal has, in effect, no defense. Treat the journal as mandatory; treat the medicines records as legally mandatory.

The GDPR layer (EU and UK practices)

Client names, addresses, payment details and communication history are personal data; the patient's clinical data is attached to them. GDPR's Article 5(1)(e) storage-limitation principle means your retention policy needs an end date and a reason, not just a start date. The workable pattern: retain the full record for your regulatory-plus-liability period, then delete or anonymize on schedule, and write both the period and its justification into your privacy policy. (Software note, since we build record-keeping software: check that whatever system holds your records — PIMS, scribe, backups — can actually delete on schedule, encrypted backups included. A policy your tooling can't execute isn't a policy.)

Writing your practice's policy in four steps

1. Find your two numbers. The regulatory minimum from your board/regulator (including any stricter food-producing-animal rules), and the civil limitation period for professional claims in your jurisdiction. Retain to the longer; your indemnity insurer may effectively set a third — ask.
2. Write it down, with dates that compute. "X years from last treatment of the patient" is executable; "a reasonable period" is not. Include what happens on practice sale or closure — records must survive the transition.
3. Cover every copy. The PIMS, imaging archives, lab portals, scribe recordings, email threads, and backups. Your retention (and deletion) schedule applies to all of them, not just the primary record.
4. Destroy properly, on schedule. Secure deletion for digital, shredding for paper — per the RCVS guidance, in a way that "safeguards against accidental loss or disclosure." Log what was destroyed and when; the log outlives the records.

One closing reminder, because compliance articles attract screenshots years later: rules change and jurisdictions differ in the details. The sources below were current when accessed in July 2026 — verify with your own regulator before relying on any number here.