Medical-practice compliance often fails at retrieval rather than intention. A policy may exist, training may have happened and a repair may have been completed—but if the practice cannot find the current record, it cannot demonstrate the system reliably.
What record categories should be considered?
1. Governance and responsibility
- approved policies and procedures;
- role or appointment letters where required;
- meeting records and management reviews; and
- a master legal or compliance register.
2. Risk and workplace controls
- hazard and risk assessments;
- workplace inspection checklists;
- equipment maintenance or service evidence;
- chemical information and control records; and
- corrective-action registers.
3. Training and competence
- staff induction;
- procedure-specific training;
- emergency, first-aid, fire or evacuation preparation;
- attendance registers and competency evidence; and
- refresher and review dates.
4. Incidents and occupational exposure
- incident and near-miss records;
- investigation findings;
- exposure-response documentation;
- external notifications where legally required; and
- proof that corrective actions were closed.
5. Employment administration
- employee details and written employment information;
- working-time or attendance evidence;
- leave and remuneration records;
- statutory registrations and submissions; and
- personnel-file access controls.
6. Emergency and premises evidence
- emergency contacts and procedures;
- first-aid arrangements and checks;
- fire or electrical evidence relevant to the premises;
- evacuation information; and
- contractor and repair records.
7. Information governance
- POPIA roles and policies;
- access, confidentiality and security procedures;
- processor or service-provider arrangements;
- breach-response records; and
- retention and secure-disposal rules.
How should the records be controlled?
Use a master index with the document name, owner, location, version, approval date, next review date and retention rule. Restrict sensitive records appropriately, back up critical digital information and withdraw obsolete versions so staff do not follow conflicting instructions.
How long should records be kept?
There is no single retention period for every medical-practice record. Employment, tax, clinical, incident, compensation, information-governance and contractual records may have different requirements. Record the legal or operational basis for each retention rule and review it when legislation or services change.
A practical test
Choose one incident, one employee and one workplace inspection. Can the practice trace the relevant policy, action, training and closure evidence without relying on one person’s memory? If not, the document-control system needs work.
The Complete Occupational Health and Safety Compliance Handbook by Dr Bianca Crook contains document-control and compliance-manual guidance for South African medical practices.
Official sources
- Occupational Health and Safety Act 85 of 1993
- Basic Conditions of Employment Act 75 of 1997
- Information Regulator: POPIA guidance
General educational information only. Record requirements and retention periods must be verified for the practice’s circumstances. Reviewed 2 September 2026.