HCPC record keeping for practitioner psychologists: what the standards require

Record keeping for practitioner psychologists in the UK means keeping a full, clear and accurate file for every person you assess or treat, completing it promptly, protecting it from loss or inappropriate access, and managing it under data protection law until a retention date you can justify. The duty comes from the Health and Care Professions Council (HCPC) and applies in the NHS, in a private clinic and in your own practice.

Who this applies to

Nine titles require HCPC registration: practitioner psychologist, registered psychologist, and clinical, counselling, educational, forensic, health, occupational, and sport and exercise psychologist. "The job title 'psychologist', is not, by itself, protected by law" (HCPC, January 2023). The BPS publishes useful guidance, but the HCPC standards are the ones a fitness to practise panel applies. Counsellors and psychotherapists will find our BACP-based pages more useful, starting with how long to keep counselling notes in the UK.

What the HCPC standards say, word for word

Standards of conduct, performance and ethics (effective 1 September 2024)

Standard 10, "Keep records of your work", in the HCPC Standards of conduct, performance and ethics:

• 10.1 "You must keep full, clear and accurate records for everyone you care for, treat or provide other services to."
• 10.2 "You must complete all records promptly and as soon as possible after providing care, treatment or other services."
• 10.3 "You must keep records secure by protecting them from loss, damage or inappropriate access."

Standards of proficiency for practitioner psychologists (effective 1 September 2023)

The profession-specific standards ask you to:

• 9.1 "keep full, clear and accurate records in accordance with applicable legislation, protocols and guidelines"
• 9.2 "manage records and all other information in accordance with applicable legislation, protocols and guidelines"
• 9.3 "use digital record keeping tools, where required"

The HCPC lists 9.3 among the digital skills changes of the 2023 revision. Two other standards shape the file: 4.3 asks you to "record the decisions and reasoning appropriately", and 13.5 to "undertake and record a thorough, sensitive and detailed assessment".

The standard and what you do in practice

• 10.1 Full, clear and accurate | In practice: referral, consent, assessment, formulation, plan, a dated note for every contact (cancellations and calls included), test results, letters and an ending summary. Write so a colleague could take over.
• 10.2 Promptly | In practice: set a deadline in your policy, such as the same working day. Date any later addition and mark it as late.
• 10.3 Secure | In practice: encrypted system with individual logins, locked storage for paper and test forms, a tested backup, a named clinical executor.
• 4.3 and 13.5 Reasoning and assessment | In practice: one or two lines on why you chose a test, changed approach or ended therapy, and the data behind each conclusion, not only the report.
• 9.2 Manage under the law | In practice: privacy notice, lawful basis and special category condition, retention schedule, access request procedure. Our UK GDPR checklist covers each point.
• 9.3 Digital tools | In practice: use your employer's electronic record rather than private notebooks; in private practice, choose a tool you can justify on security and data location.

What is specific to psychologists

Test materials and test results

A psychologist's file holds test results, which are personal data, close to test materials, which publishers protect. The BPS Code of Good Practice for Psychological Testing asks you to "Store test materials securely and ensure that no unqualified or unauthorised person has access to them" and to "Ensure test results are stored securely, are not accessible to unauthorised or unqualified persons".

We advise keeping them apart. The client file holds scores, completed record forms and your interpretation. Blank forms, manuals and stimulus books stay in a separate locked store. When a client asks for their file, the record form is their personal data: give scores and responses in a form that does not copy test items. The BPS issued a position paper in 2019 after a rise in requests for raw psychometric data; read it before your first contested request.

Reports for third parties

For a report commissioned by a solicitor, court, insurer, employer or school, write down before you start who commissioned it, who receives it, what the client agreed to and who keeps the working file. That decides who answers an access request and who sets the retention date. Keep the report, working notes and test data together. For structures, see our clinical document templates.

Process notes and CPD

Reflections that identify a client are still personal data (see process notes versus records). The HCPC audit most registrants meet is the CPD audit: "At the start of each renewal we randomly select 2.5 per cent of each profession and ask them to submit their CPD profile." Remove identifying details from any case material in it.

How long to keep a psychologist's records

The HCPC sets no period. Its record keeping FAQ says "This will vary according to the context in which you practise" and points to the national codes for England, Scotland and Northern Ireland. The NHS England Records Management Code of Practice gives:

• Mental health records including psychology records | 20 years, or 10 years after death, "regardless of whether they have capacity or not".
• Children's records | Up to the 25th birthday, or 26th if the young person was 17 when treatment ended.
• Adult health records not covered elsewhere | 8 years.

The code covers organisations "within, or under contract to, the NHS in England", and "private providers can also use this Code for guidance". In the NHS, follow your trust's schedule. In private practice, UK GDPR asks you to keep data no longer than necessary, so your choice must be reasoned. We advise 20 years from the last contact, the only national benchmark that names psychology records, or the 26th birthday if later. Our retention guide discusses the 6 to 7 years often quoted.

Private practice and the NHS: what changes

• Controller | NHS: the trust. | Private practice: usually you, often with an ICO fee to pay. As an associate in a clinic, agree in writing who is controller and where the file goes if you leave.
• Access requests | NHS: the information governance team, who may ask your view. | Private practice: you, within one month.

Access requests and the serious harm test

The ICO says: "You must comply with a SAR without undue delay and at the latest within one month of receipt of the request." A request can be made "verbally or in writing, including by social media", and "In most cases, you cannot charge a fee to comply with a SAR." Complex requests allow two more months. If you ask for proof of identity, the month runs from when you receive it.

For health data, Schedule 3, Part 2, paragraph 5 of the Data Protection Act 2018 lets you withhold information to the extent that complying would likely cause serious harm to the physical or mental health of any person. A controller who is a health professional can apply this test. A controller who is not one needs the opinion of "the health professional currently or most recently responsible for the diagnosis, care or treatment", obtained within the last six months. Section 204(1)(g) counts as health professionals people registered in a profession covered by the Health Professions Order 2001, which includes HCPC-registered psychologists. In private practice, where you are usually the controller, you can therefore apply the test yourself. Write down what you withheld and why. Our page on subject access requests for therapy notes gives the steps.

Record keeping policy: a model to copy

Replace the text in square brackets and review it every year.

Record Keeping and Retention Policy

[Name], HCPC-registered [clinical / counselling / educational / forensic / health / occupational / sport and exercise] psychologist, [registration number], [practice address]. Version [1.0], adopted [date], next review [date].

1. Content of each file

• Referral, contract, consent (including to any note-drafting tool).
• Assessment, formulation, plan, with the reasons for key choices.
• A dated note for every contact, cancellation and significant call.
• Test results, completed record forms, interpretation.
• Reports and letters, with recipients; a disclosure log (date, ground, content, recipient); an ending summary.

2. Timing and corrections

• Notes completed [the same working day]; late additions dated and marked.
• No entry deleted; corrections added with date and reason.

3. Security

• Electronic records in [system], encrypted, two-factor login, data stored in [country].
• Paper and test forms locked at [address]; blank test materials in a separate locked store.
• Breaches logged; the ICO told within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people.

4. Retention and destruction

• 20 years after the last contact, or until the 26th birthday if later, following the NHS England code entry for psychology records.
• Medico-legal reports: [period, on legal advice].
• Yearly review each [January]; cross-cut shredding or secure deletion; a destruction log.

5. Access and disclosure

• Access requests, verbal or written, answered within one month, usually free.
• Information withheld only under the serious harm test, with written reasons.
• Test items are not copied; results are given in a form that protects them.

6. If I cannot practise

• My clinical executor, [name, registration], contacts current clients and keeps the records to the dates above.

A fictional example, filled in

Fictional case. Dr Hannah Reid, an HCPC-registered counselling psychologist in private practice in Leeds, sees Jordan (fictional, 31) for 14 sessions of CBT for panic, with a short cognitive screening at intake for reported concentration problems.

• File: GP referral, contract, consent, intake assessment and formulation, 14 dated notes, two cancellations, screening record form and scores, letter to the GP, ending summary.
• Last contact: 9 October 2026. Retention date: 9 October 2046.
• Access request: Jordan asks by phone on 2 February 2027. Hannah logs the date, checks his identity and replies on 19 February with the file, his scores and her interpretation, describing his answers without copying test items. Nothing is withheld.

Checklist

• Every file has consent, assessment, plan, dated notes, test results, letters and an ending summary.
• I note the reason for key decisions.
• Test results are in the file; blank materials are locked elsewhere.
• For each third-party report, I know who keeps the working file.
• I have a written retention schedule and a yearly review.
• I can answer a verbal access request within one month and know the serious harm test.
• I have named a clinical executor, and my CPD profile names no client.

Common mistakes

• Keeping only the report. Without scores and record forms, you cannot show how you reached your conclusions.
• Filing test materials in the client file. They can end up in an access response.
• Refusing raw data by reflex. Record forms with the client's answers are personal data; find a way to give the information.
• Ignoring a phone request. The ICO accepts verbal requests; the month starts on the day of the call, or when you receive any proof of identity you asked for.

Where Delta fits

Delta is the clinical assistant for mental health professionals that keeps the memory of every client. It transcribes what is said in the session, or takes your dictation afterwards, drafts the session report and updates the client file with a summary of the work and the goals followed, so your notes are ready promptly and the whole history sits in one place. It drafts letters and assessment reports in your own vocabulary and structure, learnt from your existing reports. It does not score tests.

For UK psychologists, the data stays in Europe, in France, on infrastructure certified for health data. Identifying details are pseudonymised before the AI step, no audio file is kept, data never trains a model, and everything is encrypted in transit and at rest. See UK client data stored in the EU for the UK GDPR side.

Sources

• HCPC, Standards of conduct, performance and ethics (effective 1 September 2024), read 5 November 2026.
• HCPC, Standards of proficiency: practitioner psychologists (effective 1 September 2023), read 5 November 2026.
• HCPC, FAQs on record keeping, read 5 November 2026.
• NHS England, Records Management Code of Practice 2021, retention schedule, read 5 November 2026.
• ICO, Right of access: health data (updated 8 December 2025), read 5 November 2026.