How long must electronic medical records be retained in Indonesia?

Electronic medical records (RME) must be retained for at least 25 years from the date of the patient's last visit (Permenkes Number 24 of 2022 Article 39(1)). This obligation applies to all healthcare facilities required to organize RME. Independent practices, Puskesmas, clinics, hospitals, pharmacies, health laboratories, centers, and other facilities designated by the Minister (Article 3(2)).

How the 25-Year Retention Period Is Calculated

Article 39(1) starts the 25-year clock from the patient's last visit rather than the date the medical record was first created. If a patient last visited in March 2026, the electronic record must be kept at least until March 2051. If the patient returns before that date, the 25-year count restarts from the new visit.

After 25 years, records do not have to be destroyed immediately. Under Article 39(2), data may be exempted from destruction if it is still needed or utilized. When records are eventually destroyed, the process must follow applicable laws and regulations (Article 39(3)).

Storage, Backup, and Vendor Requirements

Article 20(2) requires storage that guarantees data security, integrity, confidentiality, and availability. Permitted media include servers, certified cloud computing, or other certified digital media (Article 20(3)). Facilities must also maintain periodic backups stored in a location separate from the facility and governed by standard operating procedures (Article 20(4)-(5)).

Facilities with limited resources may cooperate with an electronic system provider for data storage. Under Article 22, the provider's storage facility must be located domestically and receive a recommendation from the Ministry of Health data management unit. The cooperation agreement must include an integrity pact or non-disclosure agreement, and the healthcare facility must retain unlimited access to the stored data. Medical record documents belong to the facility, which remains responsible for loss, damage, falsification. Furthermore, Unauthorized use (Article 25), as well as lifelong confidentiality even after a patient's death (Article 32(1)).

Alignment with Law 17/2023 and PP 28/2024

Law Number 17 of 2023 Article 296(5) and PP Number 28 of 2024 Article 778(4) require medical records to be stored. Furthermore, Kept confidential without stating a year count. PP 28/2024 Article 974(3) sets general retention for Health Data. Furthermore, Health Information at a minimum of 25 years for electronic data and 10 years for non-electronic data. Although Law 17/2023 repealed Law 29/2004 and Law 36/2014 (Article 454(c). Furthermore, (h)), its transitional rule keeps implementing regulations like Permenkes 24/2022 valid where consistent (Article 453).

Legal basis: Permenkes Number 24 of 2022 Articles 3(2), 20(2)-(5), 22, 25, 32(1), and 39(1)-(3). PP Number 28 of 2024 Articles 778(4) and 974(3). Law Number 17 of 2023 Articles 296-299, 453, and 454(c), (h).