What must a clinic's prontuário contain under CFM and ANVISA rules?

Each entry carries the date, the time, the doctor's signature and CRM number, in chronological order, and entries made electronically are signed electronically, under the Código de Ética Médica and Resolução CFM 1.638/2002. The clinic keeps the record confidential and intact, makes it available to the patient, and may eliminate it only after at least 20 years from the last entry, under Lei 13.787/2018.

What every record must hold

Resolução CFM 1.638/2002 defines the prontuário as one document, legal, confidential and scientific, and lists what it must contain in any medium, from the patient's full identification to the history, examination, tests and results, diagnostic hypotheses, final diagnosis and treatment, with the daily progress dated and timed and every professional identified, signed electronically where the record is electronic.¹ It makes a Comissão de Revisão de Prontuários mandatory in establishments that provide medical care, coordinated by a doctor.¹ The Código de Ética Médica requires a legible record for each patient, filled in chronologically with the date, time, signature and CRM number at every assessment, and kept by the doctor or the institution.²

ANVISA's RDC 63/2011 places the duty to record on the professionals who give the care and the duty to keep the record on the health service, which must protect its confidentiality and integrity. The data belong to the patient and must be permanently available to them, their legal representative and the sanitary authority when needed.³

Paper, digital and the 20 year rule

Resolução CFM 1.821/2007 allows a fully electronic record, with no paper, only where the system meets every requirement of security level NGS2 in the SBIS and CFM certification manual, and says level NGS1 alone does not allow paper to be eliminated. NGS2 requires a digital signature with an ICP-Brasil certificate.⁴ Lei 13.787/2018 lets a paper record be digitised with an ICP-Brasil certificate and destroyed after review by a permanent records committee, and allows paper and digitised records to be eliminated after at least 20 years from the last entry, or returned to the patient.⁵ The law applies that minimum to every record, including those created electronically.⁵

1. Set the minimum contents. Use Resolução CFM 1.638/2002's list as the template for every new record.
2. Sign every entry. Date, time, signature and CRM number, at each assessment, in order.
3. Form the review committee. A Comissão de Revisão de Prontuários, coordinated by a doctor, reviewing records on a set cycle.
4. Decide paper or paperless. Confirm the record system meets NGS2 with ICP-Brasil signatures before eliminating paper.
5. Set retention. At least 20 years from the last entry, with the final destination of each record registered.
6. Answer access requests. Give the patient their copy and an explanation, and log the request.

1. Month ______ Reviewed by ______
2. Records sampled ______
3. Entries missing date, time or signature ______
4. Entries missing CRM number ______
5. Copies requested by patients ______ Sent within ______
6. Actions, owner and date ______

Copy template

Questions

How long must a Brazilian clinic keep a prontuário?

At least 20 years from the last entry before it may be eliminated, under Lei 13.787/2018, for paper, digitised and electronic records alike. It may also be returned to the patient.

Can a clinic run with no paper record at all?

Resolução CFM 1.821/2007 allows it where the system meets NGS2, which requires ICP-Brasil digital signatures. NGS1 alone does not allow paper to be eliminated.

Does the patient have the right to a copy?

Yes. The Código de Ética Médica bars a doctor from refusing the patient access or a copy, and RDC 63/2011 says the data belong to the patient.

Who reviews the records?

A Comissão de Revisão de Prontuários, mandatory where medical care is given and coordinated by a doctor.

Sources

1. 1Conselho Federal de Medicina, 2002Resolução CFM nº 1.638/2002, define prontuário médico e a Comissão de Revisão de ProntuáriosRead source
2. 2Conselho Federal de Medicina, 2018Resolução CFM nº 2.217/2018, Código de Ética MédicaRead source
3. 3ANVISA, AnvisaLegis, 2011Resolução RDC nº 63, de 25 de novembro de 2011, Requisitos de Boas Práticas de Funcionamento para os Serviços de SaúdeRead source
4. 4Conselho Federal de Medicina, 2007Resolução CFM nº 1.821/2007, digitalização e sistemas informatizados para o prontuário (NGS2)Read source
5. 5Presidência da República, Planalto, 2018Lei nº 13.787, de 27 de dezembro de 2018, digitalização e guarda do prontuário de pacienteRead source

Written by the wai team from ANVISA and the vigilância sanitária, the Conselho Federal de Medicina and the CRMs, and the Organização Nacional de Acreditação guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither ANVISA, the CFM nor ONA endorses wai or any software.