What do GAHAR's IMT standards ask of the medical record?

GAHAR's Information Management and Technology chapter asks for a unique identifier for every patient, a standard record, only authorised people making entries with the author, date and time of each one identifiable, and a review of about 5% of records at least quarterly. It also asks for confidentiality, retention under national law, tested downtime response and scheduled, secured backups.

The record itself

IMT.07 asks that every patient evaluated or treated has a medical record started with a unique identifier, with standard contents, format and location of entries, available when a professional needs it and tracked wherever it goes.¹ IMT.08 asks that only authorised individuals make entries, that every entry is legible and that its author, date and time can be identified, and that corrections follow law, regulation and policy.¹ IMT.09 asks for a review policy covering every service and discipline, at least quarterly, on a random sample of about 5% of records, with results reported to leaders.¹

Confidentiality, retention and resilience

IMT.04 asks for a policy deciding who may access which data and when, signed confidentiality agreements in every staff file, procedures for privacy and cybersecurity, and steps to follow after a breach.¹ IMT.06 asks for a retention time for each type of document according to national law, with confidentiality kept during retention and a record of destruction, and the handbook sets no period of its own.¹ IMT.10 asks that health IT is assessed and tested before it goes live and evaluated after, IMT.11 that downtime response is tested at least annually, and IMT.12 that backups are scheduled, secured in transfer and storage, and restore-tested.¹ IMT.05, IMT.06, IMT.11 and IMT.12 are unchanged from the 2021 edition.²

1. Write the information plan. Needs of leaders and external authorities, critical records, clinical coding and training, as IMT.01 lists them.
2. Standardise the record. One unique identifier per patient, one structure, one place for each entry.
3. Control who writes and who reads. A list of authorised people, enforced in the system, with signed confidentiality agreements.
4. Set retention by document type. Follow national law for each type, and log every destruction.
5. Review 5% every quarter. Sample every service and discipline, report to leaders and act.
6. Test downtime and backup. Run the downtime drill at least once a year and test a restore.

1. Quarter ______ Reviewer and discipline ______
2. Records in period ______ Sample about 5% ______
3. Services and disciplines covered ______
4. Unique identifier present ______ Two identifiers on every sheet ______
5. Author, date and time on every entry ______ Legible ______
6. Consents, verbal orders, critical results complete ______
7. Findings reported to leaders on ______ Actions ______

Copy template

Questions

How many records does GAHAR expect a clinic to review?

IMT.09 asks for random sampling of approximately 5% of records, at least quarterly, across all services and disciplines.

How long must records be kept under GAHAR's standards?

IMT.06 asks for retention according to applicable national laws and regulations, with a time set for each type of document. The handbook sets no period itself.

Can an AI-drafted note meet IMT.08?

IMT.08 asks that only authorised individuals make entries and that the author, date and time are identifiable. A note the clinician reviews, edits and signs under their own name meets that, with every change kept.

Does GAHAR require backups?

IMT.12 asks for a defined backup process with type, frequency and location, scheduled backups, tested restores and secured backup data.

Sources

1. 1General Authority for Healthcare Accreditation and Regulation (GAHAR), 2025GAHAR Handbook for Primary Healthcare Accreditation Standards, 2025, second editionRead source
2. 2General Authority for Healthcare Accreditation and Regulation (GAHAR), 2025GAHAR PHC Accreditation Standards 2025, list of amendments from the 2021 editionRead source

Written by the wai team from General Authority for Healthcare Accreditation and Regulation guidance, checked on 16 October 2026. This is guidance, not legal advice. GAHAR does not endorse wai or any software.