Which policies and documents does NHRA expect a facility to keep?

Keep an incident reporting policy, process and form, consent forms that meet NHRA's April 2026 policy, a records retention and destruction schedule, a data confidentiality policy and a register of your medical, technical and nursing staff. Each one must describe what your staff actually do, because NHRA's surveyors verify the paper through interviews and observation.

The documents NHRA names

Each comes from NHRA's own documents, the incident policy¹, the serious adverse event guidance², the consent policy³, the records policy⁴, the medical records checklist⁵ and the 2015 decree.⁶

Consent forms, in detail

NHRA's National Informed Consent Policy of 8 April 2026 makes the attending physician responsible for written informed consent before any invasive procedure, with reception or admissions staff taking the General Consent to Treat. Written consent may be handwritten or signed electronically by the patient at the facility, and it stays valid for 30 days unless it is withdrawn, the planned intervention changes or the patient's condition changes.³ For cosmetic procedures and research the patient must be 21 or older.³

1. Start from NHRA's own documents. Use the incident, consent and records policies as the frame, so your terms match NHRA's.
2. Write what you actually do. Each policy describes the process staff follow today, with a named owner.
3. Attach the forms. The incident form, the consent forms and the archive access log, each with a version and a date.
4. Train and record it. Every member of staff signs that they know the incident process.
5. Set a review date. Put a review date on each policy and keep the version history.

1. Policy ______ Version ______ Approved by ______
2. NHRA document it answers ______
3. Owner ______ Staff trained on ______
4. Forms attached ______
5. Next review ______

Copy template

Records, kept and destroyed

Records stay in the facility for at least three years after the last visit and may then be archived for seven years, ten in total for an adult, while a minor's record is kept until the child reaches 21, plus three years. Records in a complaint, investigation or dispute are kept until it is resolved, and every access to an archived record is logged with the date, the person and the reason.⁴

Questions

Does NHRA give templates for policies?

NHRA publishes its own policies, a guideline on developing policies, procedures, protocols and guidelines, and the forms it asks for, such as the sentinel event reporting form.

How long must we keep medical records?

At least three years in the facility after the last visit, then seven more in an archive, ten in total for an adult.

Are electronic consent signatures accepted?

Yes, under the April 2026 policy, when the patient signs while physically at the facility.

Sources

1. 1National Health Regulatory Authority, 2021Incident Reporting Policy, MCIS-P-003-03, effective August 2021Read source
2. 2National Health Regulatory Authority, 2017The NHRA Guidance on Serious Adverse Event Management and Reporting, version 2.0, May 2017Read source
3. 3National Health Regulatory Authority, 2026National Informed Consent Policy, issued 8 April 2026Read source
4. 4National Health Regulatory Authority, 2021Retention and Destruction of Medical Records Policy, version 1, March 2021Read source
5. 5National Health Regulatory Authority, 2024Inspection checklist, Annex 3, Medical RecordsRead source
6. 6National Health Regulatory Authority, 2015Legislative Decree No. (21) of 2015 on Private Health Facilities, English textRead source
7. 7National Health Regulatory Authority, 2026Health Facilities Regulation Section, licensing procedure, inspection checklists, policies and feesRead source

Written by the wai team from National Health Regulatory Authority guidance, checked on 16 October 2026. This is guidance, not legal advice. NHRA does not endorse wai or any software.