Short answer
A Thai clinic's OPD card must hold at least eight items under the 2002 Ministerial Regulation: facility name, patient number (HN), visit date, personal details including national ID, history and findings, diagnosis, treatment and the practitioner's signature. Keep records at least five years from the date made. Paper or computer both qualify; computer records must be backed up.
Key points
- Failing to keep records five years carries up to one year in prison, a 20,000 baht fine, or both.
- The five years run from the date a record was made, not from the patient's last visit.
- Under PDPA, a patient's copy request is due within 30 days; a breach goes to the PDPC Office within 72 hours.
- Move old cards in three layers: patient list, what the doctor sees every visit, then scanned history.
- A drug allergy lost in the move is the costliest mistake. Copy allergies across in full first.
What must an OPD card contain under Thai law?
At least eight items, under clause 3 of the Ministerial Regulation on evidence concerning practitioners and patients, B.E. 2545 (2002), issued under the Medical Facilities Act. It applies to every clinic licensed under that Act. The eight items are:
That is the legal floor. A card a doctor can actually treat from usually carries more: drug allergies, chronic conditions and current medication.
- The name of the medical facility
- The patient's identification number, which most clinics call the HN
- The date of the visit
- Name, surname, age, sex and other personal details such as ethnicity, nationality, marital status, address and national ID number
- Presenting history, physical examination findings and laboratory results
- The diagnosis
- The treatment
- The signature of the practitioner who gave the treatment
What other records does a clinic have to keep?
Three more sets, under the same regulation. An outpatient register logging every visit, with at least the patient's name, age, number and visit date. A register for each department or service, which adds who provided the service and when. And evidence for each practitioner working there: a copy of their professional licence, a staff register and attendance records.
Clinics must also file an annual report with the licensing authority by 31 March of the following year. When every visit is registered in one system, those figures come straight out of it instead of from counting cards by hand.
How long must clinic medical records be kept?
At least five years from the date each record was made, in a condition that can still be inspected, under section 35(3) of the Medical Facilities Act B.E. 2541 (1998) and clause 6 of the 2002 regulation. The duty falls on both the licensee and the clinic's operator. Section 65 sets the penalty at up to one year in prison, a fine of up to 20,000 baht, or both.
The five years run from the date the record was made, not from the patient's last visit. A note written six years ago has passed the legal minimum, but if that patient still comes in, the doctor still needs to read it.
Clause 6 allows records on paper, in registers or on a computer. The 2015 Ministerial Regulation on the equipment a medical facility must have adds, in clause 3(1), that computer records need a backup system to prevent data loss, and paper records need secure, orderly storage that is easy to search.
- minimum retention, from the date each record was made
- 5 years
- maximum prison term for breaching it
- 1 year
- maximum fine, or both
- 20,000 baht
Sources
- Medical Facilities Act B.E. 2541, sections 35(3) and 65 (Royal Gazette vol. 115, part 15 Kor, in Thai)
- Ministerial Regulation on evidence concerning practitioners and patients, B.E. 2545, clause 6 (in Thai)
- Ministerial Regulation on the tools, equipment, medicines and supplies a medical facility must have, B.E. 2558, clause 3(1) (Royal Gazette vol. 132, part 26 Kor, in Thai)
Paper cards, Excel or medical records software: what actually differs?
Time spent writing and searching, and whether you can prove who looked at which patient's record. Legally, all three work if the records are complete and kept for five years.
Paper still suits a new clinic with few patients. Excel makes records searchable and legible, but the whole file can be copied and forwarded. Software covers every row below, in exchange for a monthly fee.
| Paper cards | Excel or Google Sheets | Medical records software | |
|---|---|---|---|
| Cost | Cards, folders and cabinets | Effectively none | A monthly or yearly fee |
| Finding an old history | Pull the folder; slower as the list grows | Searchable, unless split into yearly files | Search by name or HN, found at once |
| Legibility | Depends on the handwriting | Typed and legible | Typed, legible, one set of diagnosis codes across the clinic |
| Who opened or changed it | Unknown | Version history shows part of it | An audit log |
| Backup | Hard to copy; a fire or flood is final | Only if someone remembers | Handled by the provider |
| PDPA | Cabinets lock, but nothing records who read a folder | The whole file can be forwarded in a chat | Per-person access and an access history |
What does PDPA require of a clinic holding patient records?
A lawful basis, security measures, and two deadlines. Health data is sensitive data under section 26 of the Personal Data Protection Act B.E. 2562 (2019). Collecting it needs the patient's explicit consent unless an exception applies, and section 26(5)(a) provides one for medical diagnosis and treatment that is necessary under law. Uses outside the exceptions, such as putting before-and-after photos in an advert, need explicit consent first.
Section 37(1) requires the clinic, as data controller, to have security measures that prevent unauthorised access, use, alteration or disclosure. The simplest way to show those measures exist is to give each person access to only what their job needs, and to keep a record of who opened or changed what, and when.
Two deadlines are worth knowing. A patient who asks for a copy of their data must get it within 30 days under section 30. A breach must be reported to the PDPC Office within 72 hours of the clinic becoming aware of it under section 37(4), unless it poses no risk to the patient's rights.
With cloud software, the provider acts as a data processor, and section 40 requires the clinic to have an agreement with its processor. Ask about it before you sign up.
How do you move old patient cards into a system?
Don't retype every card. Move them in three layers: first the patient list, then the facts a doctor needs at every visit, then the treatment history, which can stay as scans.
Layer one is the patient list. If it already lives in Excel, match the columns to the software's template (name, surname, date of birth, phone, old HN) and import it in one go. If it is still on paper, have one person type it into Excel during quiet hours first; that is faster than keying straight into the system while patients wait.
Layer two is what the doctor must see every time: drug allergies, chronic conditions and current medication. Copy these across in full for every patient who still visits. A drug allergy lost in the move is the most expensive mistake this job can produce.
Layer three is past treatment notes. Don't retype them. Scan them to PDF, name each file by HN, keep them in one place, and attach the file to that patient's next visit. Patients who never come back cost no typing at all.
Don't destroy the paper after scanning; keep it until five years from the date it was made. And from the day the software goes live, record new visits there only. Keep writing paper cards alongside it and the clinic ends up with two histories that disagree.
- Patient listMatch the Excel columns to the template and import once.
- What the doctor seesCopy allergies, chronic conditions and current medication for active patients.
- Past historyScan to PDF, name by HN, attach at the next visit.
- Keep the originalsHold the paper until five years from the date it was made.
- Stop writing paperFrom go-live, record new visits in the system only.
How does SyncEdge Clinic store medical records?
Every visit is its own record, with clinical notes, vital signs and an ICD-10 diagnosis searchable by code or by name, with Thai names for the diagnoses clinics see most. Drug allergies sit on the patient, so nobody re-enters them at each visit.
Each clinic type gets its own fields. TCM clinics record tongue, pulse and acupuncture points on a body chart, and aesthetic clinics attach before-and-after photos to each procedure. A tooth chart for dental clinics is being designed with our first dental clinics. Any visit can carry JPG, PNG or PDF attachments of up to 10 MB each, which is also where scanned old cards go.
Every create, edit and delete is logged with who did it, when and from which IP address, and so is every view of a national ID number. The log can't be edited or deleted from inside the system, and each patient's file shows its own history. The clinic can record consent per purpose with a signature, and when a patient asks for a copy of their data, the system assembles it into a file.
Existing data comes in through the Migration Center, which imports Excel or CSV files using Thai templates downloaded from the system. It takes patient lists with old HNs and drug allergies, remaining course balances, opening stock and suppliers, and checks every row before anything is written, listing the rows to fix. Past visit-by-visit treatment history can't be imported as records yet, so attach scans as described above.
Data is hosted in Thailand and the database is backed up every night. Every plan includes ICD-10 records and the Migration Center, from ฿990 a month with VAT included.
Is free medical records software good enough?
It can be, if the provider answers three questions before real patient data goes in. Which country is the data stored in, and who can access it? If you leave one day, what file format can you export to? And if the provider shuts down, where do the records you must keep for five years end up? Under PDPA and the Medical Facilities Act, that responsibility sits with the clinic, not the provider.
SyncEdge Clinic has no free plan. It has a two-month trial of the full plan you choose, with no credit card, which is long enough to import your real patient list and run a week of actual visits before deciding.
Before moving records into software
- Patient cards carry all eight legal items, especially the national ID number and the practitioner's signature
- You know which cards are under five years old from the date they were made and must still be kept
- The patient list is already in Excel, or someone owns typing it in
- Allergies and chronic conditions for every patient still visiting are copied across in full
- There is an agreed date to stop writing paper cards
- You have asked the provider where data is stored, how often it is backed up and what it exports to
- You have asked whether they will sign a data processing agreement under PDPA section 40
- You have decided how much patient data each staff member can see
Frequently asked questions
What is an OPD card?
An OPD card is the outpatient card that records a patient's details and each visit to a clinic that doesn't involve an overnight stay. Thailand's 2002 Ministerial Regulation requires at least eight items on it: the facility name, the patient's number, the visit date, personal details including the national ID number, history and examination findings, the diagnosis, the treatment and the treating practitioner's signature.
How long must a clinic keep patient records in Thailand?
At least five years from the date the record was made, in a condition that can be inspected, under section 35(3) of the Medical Facilities Act B.E. 2541 and clause 6 of the 2002 Ministerial Regulation. Breaching it carries up to one year in prison, a fine of up to 20,000 baht, or both.
Can medical records be kept on a computer instead of paper?
Yes. Clause 6 of the 2002 Ministerial Regulation allows records kept by computer or any other method that can display them. Clause 3(1) of the 2015 regulation adds that computer records need a backup system to prevent data loss, so a single Excel file on one machine that has never been backed up does not meet it.
Can we throw away paper cards once they are scanned?
Keep the paper until five years from the date it was made, even after scanning. Scans let doctors read old histories quickly, but destroying originals early is a risk the clinic doesn't need to take. Once a card passes five years, destroy it in a way that can't be read back, such as a shredder.
What is the difference between an EMR and a HIS?
An EMR is the electronic medical record itself: a patient's history, diagnoses and treatment. A HIS is a whole hospital's operating system, joining records to billing, pharmacy, the lab and inpatient wards. Most clinics don't need a full HIS; clinic software that keeps records, billing and stock in one system is enough.
Is there free medical records software?
Both genuinely free products and free trials exist. Before entering real patient data, ask which country stores it, who can access it and what format it exports to, because PDPA responsibility stays with the clinic. SyncEdge Clinic has no free plan; it offers a two-month trial with no credit card, and plans start at ฿990 a month including VAT.
Can patient data be imported from Excel?
Yes. Line up the columns with the template first: name, surname, date of birth, phone and old HN. SyncEdge Clinic imports Excel or CSV files through the Migration Center on every plan at no charge, checks every row before importing and keeps the old HN searchable. Past visit-by-visit history can't be imported as records yet, so scan it and attach the files instead.