Healthcare

Allied health: destroying treatment records (WGBO)

24 July 2026 · 9 min read · DeSnipperaar

A dietitian, speech therapist or podiatrist keeps a treatment record for every client: an intake, treatment plan, progress notes, a referral and sometimes correspondence with the GP. That is sensitive health data covered by the WGBO, with a retention period of twenty years. A small practice often has no large archive, but it does have a cabinet of old folders and a computer full of records. This guide shows what you keep, when it may go and how to destroy it confidentially.

The quick answer: you keep the treatment record for twenty years from the last change, the invoicing falls under the tax seven years. Referrals and correspondence with the GP belong to the record and follow the same period. What may go afterwards disappears confidentially and with a certificate, whether it is paper or a data carrier.

Two frameworks: WGBO and GDPR

At an allied health practice two rules run together. The WGBO requires you to keep the treatment record for twenty years, so that a client or a fellow practitioner can later check what happened. That period is a floor, keeping it for less is not allowed. Alongside this the GDPR applies, which requires not keeping personal data longer than necessary. The GDPR forms the ceiling for everything that does not fall under a statutory retention obligation.

The result is that you treat the data per type. You keep the treatment record until the WGBO period has passed. Loose appointment notes, an expired waiting-list form or a draft that never ended up in the record have no retention obligation of their own and you clear them out sooner. The background to the twenty-year period is in the WGBO 20-year retention period for patient files.

Retention periods by part

The period differs per type of data. The overview below gives the main line. Count the WGBO period from the last change to the record and the tax period from the end of the financial year.

Part	Starting point	Period
Treatment record and treatment plan	WGBO	20 years
Referral and correspondence with GP	Part of the record	20 years
Invoicing and administration	Tax retention obligation	7 years
Appointments and no-show notes	Purpose-bound	as briefly as possible
Digital records and data carriers	Follow the record	until the carrier is destroyed
Correspondence and drafts	No retention obligation	clear out at once

Use this as a guideline, not a substitute for your professional standards. When in doubt about a specific record, consult your professional association or privacy adviser. A full overview per document type is in the GDPR retention periods cheatsheet.

The small practice without a large archive

Many allied health practices are small. A solo practice at home or a partnership with a few treatment rooms has no archive room with boxes to the ceiling. Yet over the years a surprising amount of sensitive data builds up: folders of closed records, printed referrals, old diaries and a computer that nothing is ever really removed from. Precisely because it seems little, it often stays put.

That is the risk. A record from a dietitian or speech therapist contains health data, and that is special-category personal data with extra protection. A folder that ends up in an ordinary paper bin after a move, or an old laptop you give away, can become a reportable data breach. The size of the practice changes nothing about the sensitivity of the content. So treat closed records as confidential material, even if it is only half a cabinet.

Referrals and correspondence with the GP

An allied health record rarely stands alone. It contains a referral from the GP, a report back after treatment, sometimes a letter from a medical specialist. That correspondence belongs to the treatment record and falls under the same twenty-year retention period. So you may not throw it away separately and sooner, but you should also not leave it lying loose in a separate folder that nobody manages.

So keep the correspondence with the record it belongs to. Whatever you hold twice, for instance a printout alongside the digital original, you do clear out once you no longer need it. When the record may go after twenty years, the accompanying correspondence goes into the same confidential destruction. That way you keep the record complete for as long as you must and fully gone as soon as you may.

Digital records and data carriers

Most practices work with an electronic record. A digital record falls under exactly the same period as a paper record, so twenty years applies there too. The difference is in the clearing out. Deleting a file from your record system is not the same as destroying it: on an old practice computer, an external drive or a forgotten backup the same data can still be recovered for years.

So take a written-off computer, laptop or backup carrier with record data along in the destruction instead of giving it away or storing it. A wiped drive is not empty, only made invisible. Physical destruction of the data carrier is the only way to be sure the data is illegible. You have both the paper and the data carriers collected and destroyed at the same time, so that no remnant is left behind.

How to handle it in 6 steps

1. Split the data into treatment record, administration and loose notes.
2. Keep the record for twenty years after the last change.
3. Keep referrals and correspondence with the record they belong to.
4. Take data carriers along and do not rely on wiping alone.
5. Collect what may go in a sealed container, not in the paper bin.
6. Have it destroyed confidentially with a certificate and record it in your register.

Destroy confidentially with a certificate

Treatment records are destroyed confidentially, because they contain health data. The paper and any data carriers travel sealed and stay that way until destruction, so the chain from your practice to the shredder is closed. An old practice computer or backup with record data belongs with it too.

Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate is your proof towards the GDPR that you acted carefully. Record the destruction in your record of processing as well. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.

Common mistakes

• Throwing away records too early. The WGBO period of twenty years is a floor.
• Treating referrals separately. They belong to the record and follow the same period.
• Relying on wiping alone. A wiped drive is not the same as a destroyed drive.
• Throwing away unshredded. A treatment record on the street is a reportable data breach.
• Keeping no proof. Without a certificate you cannot demonstrate the destruction.

Frequently asked questions

How long must an allied health practice keep the treatment record?

The treatment record falls under the WGBO and has a retention period of twenty years, counted from the last change to the record. The invoicing also falls under the seven-year tax retention obligation. Only after the period has passed may you destroy the record.

Do referrals and correspondence with the GP also fall under the 20 years?

Yes. A referral, a letter to or from the GP and other correspondence that belongs to the treatment are part of the treatment record. They follow the same twenty-year retention period and then go into the same confidential destruction.

How do I handle digital records and old data carriers?

A digital record falls under the same period as a paper record. An old practice computer, laptop or backup with record data should be physically destroyed, not merely wiped. Take the data carrier along in the destruction and record that in your register.

How do I destroy treatment records in line with the GDPR?

Confidentially and with a certificate of destruction. Paper and data carriers travel sealed and stay that way until destruction. You record the destruction in your record of processing as proof towards the GDPR.

Conclusion

An allied health practice works with health data of every client, between the WGBO and the GDPR. Keep the treatment record for twenty years, count from the last change and keep referrals and correspondence with the record they belong to. A small archive and an old practice computer deserve the same care as a large cabinet full of folders. What may go afterwards you have destroyed confidentially with a certificate as proof. That way you meet both frameworks and protect your clients' data.

Read also: occupational health services: destroying medical files, home care: destroying client records, mental health institutions: destroying client records and physiotherapy: destroying client records after the WGBO period.

---

Have treatment records collected? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.