When a Therapist Dies, Who Looks After the Client Records?

Clinical Executors, the seven-year "rule", and the practical questions we don’t always think to ask.

Imagine agreeing to be a colleague’s Clinical Executor. Then, unexpectedly, you’re needed. You know there’s a Clinical Will somewhere. You’re not quite sure where. Their client records are in an online practice management system, protected by two-factor authentication. The subscription may soon stop being paid. And someone mentions that you’re now responsible for keeping seven years’ worth of confidential notes.

Would you know where to begin?

These are exactly the kinds of concerns emerging in conversations about Clinical Wills. And they’re worth exploring, particularly for therapists working independently, online or across international borders.

Is there really a seven-year rule?
People often talk about seven years as though it were a universal legal requirement. It isn’t.

Neither the UK GDPR nor the EU GDPR imposes a general seven-year retention period for therapeutic records. Both operate on the principle that personal information should not be retained for longer than necessary for its legitimate purposes. However, that doesn’t mean records can be destroyed whenever a therapist chooses.

National legislation, professional guidance, insurance conditions, contractual obligations and individual client circumstances may all influence appropriate retention periods.

It's worth understanding why insurers might ask us to keep records for a particular period. Complaints and legal claims can arise years after therapy has ended, and our notes may provide important evidence of what happened, the decisions we made and the care we provided. That evidence can be relevant to clients as well as practitioners, especially when a therapist has died and can no longer explain their decisions.

The ICO even gives an example of a healthcare provider refusing a request to erase records because they're needed in connection with potential legal claims. But I wonder how many of us have actually asked our insurers to explain their requirements, rather than simply accepting a familiar number of years?

If you're unsure, I'd suggest contacting your insurer and asking:

• What is the minimum retention period required under my policy, and does it apply to all client records?
• Does that requirement change if I retire, stop practising or die?
• What arrangements would you expect to be in place for the secure retention and eventual destruction of records following my death?

I'd ask for the answers in writing. They can then inform your retention policy and the instructions you leave behind.
Of course, an insurer's requirements don't automatically override data protection law. We still need to consider whether retaining information is necessary, proportionate and lawful. But at least we'd be making those decisions with a clearer understanding of what's expected of us.

For therapists working internationally, this becomes particularly important. The rules and professional expectations relevant to someone practising in France, for example, may differ from those applying to a practitioner in England or Australia. Working online does not automatically remove those differences.

The useful question isn’t simply “Do I have to keep everything for seven years?” It’s “Which requirements apply to my practice, and how have I made arrangements to meet them?”

Must my Clinical Executor keep all my notes?
This is where an important misunderstanding can arise. A Clinical Executor may be asked to help manage the immediate consequences of a therapist’s incapacity or death: identifying current clients, arranging appropriate communications and supporting continuity of care.

That isn’t necessarily the same as agreeing to personally store and manage confidential records for years. Longer-term custody, retention reviews and eventual secure disposal can potentially be arranged separately, subject to the applicable legal and professional requirements.

The distinction matters. A colleague may be willing to support your clients during an emergency without being willing or able to take on indefinite administrative responsibility. And where an executor lives in another country, additional questions arise about lawful access, international transfers of personal information and the responsibilities of whoever holds the records. These matters are much easier to discuss before an emergency than afterwards.

​So what might a workable arrangement look like?
I think it helps to separate the immediate task of looking after clients from the longer-term responsibility for their records. They are related, but they don't necessarily have to fall to the same person.

Depending on the requirements applying to your practice, you might explore arrangements such as:

• An agreed records custodian: Someone who is willing and appropriately authorised to take responsibility for secure storage, retention reviews and eventual disposal, without necessarily becoming involved in contacting clients.
• A professional records management service: A suitable provider may be able to store records securely and arrange their destruction when the applicable retention period ends. We'd need to establish whether they can handle sensitive therapeutic records, what contractual and data protection safeguards are required, and what the service costs.
• An existing practice management system: Some systems may offer options for retaining or exporting records after a practitioner stops working. It's worth asking your provider what happens following death, whether another authorised person can manage the account, and whether continued access depends on paying a subscription.

None of these arrangements should be assumed to transfer legal responsibility automatically. We'd need to establish who is authorised to act, what agreements are necessary, and who remains responsible for meeting data protection obligations.
And who pays? If records need to be retained for several years, we ought to consider storage costs now rather than leave someone else facing an unexpected bill.

I'd start by speaking to my nominated Clinical Executor about what they're actually prepared to undertake, then investigate the options for anything that falls outside their role. The result may be much more manageable than asking one colleague to take responsibility for everything.

What if nobody can find the Clinical Will?
A beautifully prepared Clinical Will is of limited value if nobody knows it exists.
Who would recognise that your continuity arrangements need activating? How would they find the instructions? What happens if the person you’ve appointed is unavailable?
Your family might need to know whom to contact, but that doesn’t mean they should have access to confidential client information.

Equally, the absence of an accessible Clinical Will doesn’t necessarily mean that nobody has any legal responsibility for the records. Those responsibilities may depend on the country concerned, how the practice operates and who has lawful control of the information.

The goal is to make the arrangements discoverable without making confidential records unnecessarily accessible.

Should clients have more say in what happens to their records?
I think this is a question worth taking seriously. We're dealing with some of the most personal information people share, and I can understand why a client might feel uncomfortable knowing their notes could be held by someone they've never met, particularly after their therapist's death. 

Why shouldn't we be discussing this with clients from the beginning, rather than making all the decisions ourselves?
There are complications, of course. Giving clients copies of their notes doesn't necessarily remove our own responsibilities, and a client's preference for destruction following our death may not override other obligations. Records can sometimes be needed to investigate a complaint or support a legal claim, including one brought by the client.

But that doesn't mean client preferences are irrelevant, or that we should simply retain everything because it's easier.
I'd suggest reviewing what we actually tell clients during contracting. Do they know what records we keep, why we keep them, how long we intend to retain them and what arrangements we've made in the event of our death or incapacity?
Could we invite clients to discuss their preferences, explain where our discretion is limited, and make sure those conversations are reflected in our policies and instructions?

We might also want to question how much information we need to record in the first place. Keeping records that are appropriate and sufficient for their purpose, rather than unnecessarily detailed, can reduce the amount of sensitive information requiring protection later.

For me, this is about finding a balance between respecting clients' wishes and meeting responsibilities that may continue beyond the therapeutic relationship. I don't think those aims are necessarily in opposition, but we do need to be more transparent about how we approach them.

Could someone actually access the information they need?
This is something I think we often overlook when preparing a Clinical Will. We might carefully document where our client records are held, but have we established whether someone else could actually access them if we became unavailable?
Two-factor authentication, encrypted devices and online practice management systems are designed to protect confidential information, quite rightly. But they can also create difficulties when the only person with access is no longer able to authorise it.

I'd suggest starting with your practice management provider. Ask whether they have a process for granting emergency access following a practitioner's death or incapacity, what evidence of authority they would require, and what happens to records if the subscription ends.

Then consider your other essential systems. Does your password manager offer an emergency access feature? Could your nominated person locate the instructions without accessing your personal devices? Are there arrangements for maintaining essential subscriptions while records are being secured?

I wouldn't recommend simply handing over passwords or disabling security protections. The aim is to establish an agreed, secure route for appropriately authorised access, with clear limits on what information someone may need and why.
And crucially, document what you've established. Knowing that a system has an emergency access procedure isn't much help if nobody knows how to initiate it when the time comes.

Where do we go from here?
I think one of the difficulties with clinical continuity planning is that every question seems to lead to another. What begins as writing a Clinical Will can quickly become an investigation into data protection, insurance conditions, digital access, record retention and responsibilities we may never have anticipated.

And much of that work falls to individual practitioners, who are already managing the demands of running their practices.
We don't necessarily need to resolve everything at once, though. If you're unsure where to begin, I'd suggest these five steps:

1. Check your current arrangements. Do you have a Clinical Will, and does your nominated person know where to find it?
2. Ask your insurer about record retention. Establish what your policy requires, including what happens if you die or stop practising, and request written clarification.
3. Review your client information and contracting. Are you transparent about the records you keep, how long you retain them and what might happen to them if you're no longer practising?
4. Discuss responsibilities with your nominated Clinical Executor. What are they willing and able to do? What would require a separate arrangement, particularly for longer-term record custody?
5. Write down what you've established. Update your Clinical Will and supporting instructions, identify anything still unresolved and decide when you'll review it.

You may find that you already have good arrangements in place. Equally, you might discover that a seemingly straightforward instruction depends on something you haven't yet organised.

I also think we're entitled to question why navigating these overlapping responsibilities is so difficult. We can take our professional obligations seriously while challenging the amount of interpretation and administrative work expected of individual therapists.

For me, the aim isn't simply to produce another document or demonstrate compliance. It's to leave arrangements that respect our clients' confidentiality, reflect their interests and give the people helping us a realistic chance of doing what we've asked of them.

And perhaps the most useful place to begin is by asking not just who will agree to be my Clinical Executor, but what exactly am I asking them to take responsibility for, and have I made that responsibility manageable?

Further reading

• UK Information Commissioner’s Office: Storage Limitation
• European Commission: Principles of the GDPR
• BACP Ethical Framework

This article offers general professional information, not jurisdiction-specific legal advice. Therapists should establish the requirements applicable to their own practice, clients, records and insurance arrangements.

Laura Harley is a BACP Accredited Counsellor, author and creator of the Clinical Continuity Toolkit. Drawing on her therapeutic experience and background in IT and data security, she develops practical resources for independent and international practitioners.

Her Clinical Continuity Toolkit provides 13 editable resources to help practitioners establish and review their own continuity arrangements.