Healthcare

Nursing homes: destroying resident records

29 July 2026 · 10 min read · DeSnipperaar

A nursing home manages the most sensitive data there is: the care record of every resident, care plans, medication overviews and medical notes. Part falls under the long retention period of the WGBO, part under the tax retention obligation and part should be kept as briefly as possible. This guide shows, by part, what you keep, when a record may go after a resident's death or departure and how to destroy it confidentially with a certificate.

The quick answer: the medical data in the care record falls under the WGBO and is in principle kept for twenty years, counted from the last change. The administration falls under the tax seven years. Care plans and loose notes without lasting medical value you clear out earlier. What may go disappears confidentially and with a certificate.

Two frameworks: WGBO and GDPR

At a nursing home two things run together. The WGBO requires you to keep medical data for a long time, in principle twenty years from the last change to the record. Alongside this the GDPR applies, which requires not keeping personal data longer than necessary. The WGBO sets the floor for what you must keep, the GDPR the ceiling for what you may not keep too long.

So treat the record per part. A medication overview or a medical note has a different status than a care plan without lasting medical value or a draft. If you make that distinction, you keep exactly what you must and clear out the rest on time. The main line of all periods is in the GDPR retention periods cheatsheet.

Retention periods by part

The period differs per type of data. The overview below gives the main line. Count the WGBO period from the last change, the tax period from the end of the financial year.

Part	Starting point	Period
Medical care record	WGBO	20 years
Medication and treatment data	Part of care record	20 years (WGBO)
Administration and invoicing	Tax retention obligation	7 years
Care plan without medical value	Purpose-bound	as briefly as possible
Employee personnel file	Separate framework	own periods
Correspondence and drafts	No retention obligation	clear out at once

Use this as a guideline, not a substitute for the WGBO and your own protocol. When in doubt, consult your practitioner or privacy adviser. The exceptions to the twenty years are in the WGBO 20-year retention period.

Medication and medical data under the WGBO

The heart of a resident record is medical. Medication overviews, treatment agreements, notes from the doctor or nurse and the resident's health history are special-category personal data. For this part the WGBO period of in principle twenty years applies, counted from the last change to the record. As long as that period runs, you keep the medical record complete and secure.

A longer retention can be needed where good care requires it, for example with a condition that remains relevant to aftercare. A shorter retention is possible where the resident asks for it and no overriding interest stands against it. Record such considerations, so you can later explain why a record was kept longer or shorter.

Records after a resident's death or departure

Death or a move to another institution ends the care, but not the retention period. The medical part of the record is in principle kept for twenty years, even when the resident is no longer there. So do not clear out a record as soon as a room falls empty. Next of kin can under conditions still request access, and a record can matter in a complaint or a medical question.

So keep a clear separation between active and closed records. Set closed records apart with the date on which the period expires, so you can destroy them at the right moment. This approach is comparable to that at home care and destroying client records, where the same WGBO logic applies.

Keeping the care record and personnel file apart

In a nursing home two kinds of records lie close together: the resident's care record and the employee's personnel file. They have their own grounds and their own periods and do not belong on one pile. The care record follows the WGBO, the personnel file follows the rules around employment and tax. Keep them physically and digitally separate, so you can destroy one without touching the other. The difference between the personnel file and the patient file is a recurring point of attention for a care institution.

How to handle it in 6 steps

1. Split the records into medical care record, administration, care plan and personnel file.
2. Keep the medical part for the WGBO period of twenty years.
3. Set closed records apart with the date on which the period expires.
4. Clear out care plans and drafts as soon as they have no lasting value.
5. Collect what may go in sealed containers, not in the paper bin.
6. Have it destroyed confidentially with a certificate and record it in your register.

Destroy confidentially with a certificate

Care records are destroyed confidentially, because they contain medical and identity data. The paper and any data carriers travel sealed and stay that way until destruction, so the chain is closed. Digital records and data carriers belong with it emphatically: an old server, a backup or a computer from the electronic care record contains the same sensitive data as the paper and deserves the same care.

Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate is your proof towards the GDPR that you destroyed demonstrably. Record the destruction in your record of processing. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.

Common mistakes

• Clearing out records on death or departure. The WGBO period simply runs on.
• Mixing the care record and personnel file. They have their own grounds and periods.
• Forgetting digital records. An old server or backup holds the same medical data.
• Throwing away unshredded. A care record on the street is a reportable data breach.
• Keeping no proof. Without a certificate you cannot demonstrate the destruction.

Frequently asked questions

How long must a nursing home keep a resident's care record?

The medical data in the care record falls under the WGBO and is in principle kept for twenty years, counted from the last change. The administration falls under the seven-year tax period. Loose notes without lasting medical value you clear out earlier.

May I destroy the record as soon as a resident dies or leaves?

No. Death or departure ends the care, but not the WGBO period. The medical part is in principle kept for twenty years. Next of kin can sometimes still request access, so keep the record complete until the period has expired.

Do the care record and the personnel file belong together?

No. A resident's care record and an employee's personnel file have their own grounds and periods. Keep them separate, so you can destroy one without touching the other.

How do I destroy care records in line with the GDPR?

Confidentially and with a certificate of destruction. Paper and data carriers travel sealed and the destruction is recorded in the record of processing.

Conclusion

A nursing home works with medical and identity data of every resident, between the WGBO and the GDPR. Keep the medical care record for the twenty years of the WGBO, keep the administration seven years and clear out care plans without lasting value earlier. A record does not disappear on death or departure, but runs out its period. Keep the care record and personnel file separate and do not forget the digital data carriers. What may go you have destroyed confidentially with a certificate as proof. That way you meet both frameworks and protect your residents' data.

Read also: maternity care: destroying client records, midwifery practices: destroying records and the WGBO, dental labs: destroying patient data and the GDPR retention periods cheatsheet.

---

Have resident records collected? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.