Under article 7:454 of the Burgerlijk Wetboek a clinic keeps the patient file for twenty years from its last change, or longer where good care requires. The patient may see it and receive a copy, and may ask for it to be destroyed within the limits of article 7:455.
What the WGBO asks of the file
| Article | Duty |
|---|---|
| 7:448 | Inform the patient clearly about the examination, the treatment, its risks and the alternatives |
| 7:450 | Consent for every verrichting, with parents also consenting for a patient aged 12 to 15 |
| 7:454 | Keep a dossier, add the patient's own statement on request, and keep it twenty years from the last change |
| 7:455 | Destroy the data on the patient's written or electronic request, unless another's interest or the law prevents it |
| 7:456 | Give the patient inzage and a copy, except where another person's privacy requires otherwise |
The systems behind the file
The twenty years run from the last change in the file, so each new entry restarts the period.1 The Besluit elektronische gegevensverwerking door zorgaanbieders requires a provider to use its systems safely in line with NEN 7510 and NEN 7512, and its logging to meet NEN 7513.2 Article 10 lid 3 of the Wkkgz adds that an incident with noticeable consequences is noted in the dossier, with the time and the names of those involved.3
- Write the file as you go. Health data, the verrichtingen and what is needed for good care, signed and timed.
- Record the information and the consent. What the patient was told under 7:448 and what they agreed to under 7:450.
- Set retention from the last change. Twenty years, recalculated each time the file changes, with longer where care requires it.
- Answer requests for inzage and a copy. Log each request and what was sent, and protect any other person's privacy.
- Handle a destruction request in writing. Check 7:455 before you destroy anything, and record the decision.
- Log every read. Under NEN 7513, so you can show who opened the file and when.
- Patient ______ Request received on ______
- Type, inzage, copy or destruction ______
- Identity checked ______ By ______
- Another person's privacy affected, yes or no ______
- Decision ______ Sent or destroyed on ______
- Retention end date after this change ______
Questions
Is the retention period fifteen or twenty years?
Twenty years, counted from the last change to the file, under article 7:454 lid 3 of the Burgerlijk Wetboek.
Can a patient have their file destroyed?
Yes, on a written or electronic request, unless keeping it is of real importance to someone else or the law prevents it.
Which security standards apply to the record system?
NEN 7510 and NEN 7512 for safe use of the systems, and NEN 7513 for logging, under the Besluit elektronische gegevensverwerking door zorgaanbieders.
Sources
- 1Overheid.nl, wetten.overheid.nl, 2026Burgerlijk Wetboek Boek 7, artikel 454, de overeenkomst inzake geneeskundige behandelingRead source
- 2Overheid.nl, wetten.overheid.nl, 2020Besluit elektronische gegevensverwerking door zorgaanbiedersRead source
- 3Overheid.nl, wetten.overheid.nl, 2026Wet kwaliteit, klachten en geschillen zorgRead source
Written by the wai team from Inspectie Gezondheidszorg en Jeugd guidance, checked on 16 October 2026. This is guidance, not legal advice. The IGJ does not endorse wai or any software.