Clinical Executors, the seven-year "rule", and the practical questions we don’t always think to ask.

Imagine agreeing to be a colleague’s Clinical Executor. Then, unexpectedly, you’re needed. You know there’s a Clinical Will somewhere. You’re not quite sure where. Their client records are in an online practice management system, protected by two-factor authentication. The subscription may soon stop being paid. And someone mentions that you’re now responsible for keeping seven years’ worth of confidential notes.

Would you know where to begin?

These are exactly the kinds of concerns emerging in conversations about Clinical Wills. And they’re worth exploring, particularly for therapists working independently, online or across international borders.

Is there really a seven-year rule?
People often talk about seven years as though it were a universal legal requirement. It isn’t.

Neither the UK GDPR nor the EU GDPR imposes a general seven-year retention period for therapeutic records. Both operate on the principle that personal information should not be retained for longer than necessary for its legitimate purposes. However, that doesn’t mean records can be destroyed whenever a therapist chooses.

National legislation, professional guidance, insurance conditions, contractual obligations and individual client circumstances may all influence appropriate retention periods.

It's worth understanding why insurers might ask us to keep records for a particular period. Complaints and legal claims can arise years after therapy has ended, and our notes may provide important evidence of what happened, the decisions we made and the care we provided. That evidence can be relevant to clients as well as practitioners, especially when a therapist has died and can no longer explain their decisions.

The ICO even gives an example of a healthcare provider refusing a request to erase records because they're needed in connection with potential legal claims. But I wonder how many of us have actually asked our insurers to explain their requirements, rather than simply accepting a familiar number of years?

If you're unsure, I'd suggest contacting your insurer and asking:

• What is the minimum retention period required under my policy, and does it apply to all client records?
• Does that requirement change if I retire, stop practising or die?
• What arrangements would you expect to be in place for the secure retention and eventual destruction of records following my death?

I'd ask for the answers in writing. They can then inform your retention policy and the instructions you leave behind.
Of course, an insurer's requirements don't automatically override data protection law. We still need to consider whether retaining information is necessary, proportionate and lawful. But at least we'd be making those decisions with a clearer understanding of what's expected of us.

For therapists working internationally, this becomes particularly important. The rules and professional expectations relevant to someone practising in France, for example, may differ from those applying to a practitioner in England or Australia. Working online does not automatically remove those differences.

The useful question isn’t simply “Do I have to keep everything for seven years?” It’s “Which requirements apply to my practice, and how have I made arrangements to meet them?”

Must my Clinical Executor keep all my notes?
This is where an important misunderstanding can arise. A Clinical Executor may be asked to help manage the immediate consequences of a therapist’s incapacity or death: identifying current clients, arranging appropriate communications and supporting continuity of care.

That isn’t necessarily the same as agreeing to personally store and manage confidential records for years. Longer-term custody, retention reviews and eventual secure disposal can potentially be arranged separately, subject to the applicable legal and professional requirements.

The distinction matters. A colleague may be willing to support your clients during an emergency without being willing or able to take on indefinite administrative responsibility. And where an executor lives in another country, additional questions arise about lawful access, international transfers of personal information and the responsibilities of whoever holds the records. These matters are much easier to discuss before an emergency than afterwards.

​So what might a workable arrangement look like?
I think it helps to separate the immediate task of looking after clients from the longer-term responsibility for their records. They are related, but they don't necessarily have to fall to the same person.

Depending on the requirements applying to your practice, you might explore arrangements such as:

• An agreed records custodian: Someone who is willing and appropriately authorised to take responsibility for secure storage, retention reviews and eventual disposal, without necessarily becoming involved in contacting clients.
• A professional records management service: A suitable provider may be able to store records securely and arrange their destruction when the applicable retention period ends. We'd need to establish whether they can handle sensitive therapeutic records, what contractual and data protection safeguards are required, and what the service costs.
• An existing practice management system: Some systems may offer options for retaining or exporting records after a practitioner stops working. It's worth asking your provider what happens following death, whether another authorised person can manage the account, and whether continued access depends on paying a subscription.

None of these arrangements should be assumed to transfer legal responsibility automatically. We'd need to establish who is authorised to act, what agreements are necessary, and who remains responsible for meeting data protection obligations.
And who pays? If records need to be retained for several years, we ought to consider storage costs now rather than leave someone else facing an unexpected bill.

I'd start by speaking to my nominated Clinical Executor about what they're actually prepared to undertake, then investigate the options for anything that falls outside their role. The result may be much more manageable than asking one colleague to take responsibility for everything.

What if nobody can find the Clinical Will?
A beautifully prepared Clinical Will is of limited value if nobody knows it exists.
Who would recognise that your continuity arrangements need activating? How would they find the instructions? What happens if the person you’ve appointed is unavailable?
Your family might need to know whom to contact, but that doesn’t mean they should have access to confidential client information.

Equally, the absence of an accessible Clinical Will doesn’t necessarily mean that nobody has any legal responsibility for the records. Those responsibilities may depend on the country concerned, how the practice operates and who has lawful control of the information.

The goal is to make the arrangements discoverable without making confidential records unnecessarily accessible.

Should clients have more say in what happens to their records?
I think this is a question worth taking seriously. We're dealing with some of the most personal information people share, and I can understand why a client might feel uncomfortable knowing their notes could be held by someone they've never met, particularly after their therapist's death. 

Why shouldn't we be discussing this with clients from the beginning, rather than making all the decisions ourselves?
There are complications, of course. Giving clients copies of their notes doesn't necessarily remove our own responsibilities, and a client's preference for destruction following our death may not override other obligations. Records can sometimes be needed to investigate a complaint or support a legal claim, including one brought by the client.

But that doesn't mean client preferences are irrelevant, or that we should simply retain everything because it's easier.
I'd suggest reviewing what we actually tell clients during contracting. Do they know what records we keep, why we keep them, how long we intend to retain them and what arrangements we've made in the event of our death or incapacity?
Could we invite clients to discuss their preferences, explain where our discretion is limited, and make sure those conversations are reflected in our policies and instructions?

We might also want to question how much information we need to record in the first place. Keeping records that are appropriate and sufficient for their purpose, rather than unnecessarily detailed, can reduce the amount of sensitive information requiring protection later.

For me, this is about finding a balance between respecting clients' wishes and meeting responsibilities that may continue beyond the therapeutic relationship. I don't think those aims are necessarily in opposition, but we do need to be more transparent about how we approach them.

Could someone actually access the information they need?
This is something I think we often overlook when preparing a Clinical Will. We might carefully document where our client records are held, but have we established whether someone else could actually access them if we became unavailable?
Two-factor authentication, encrypted devices and online practice management systems are designed to protect confidential information, quite rightly. But they can also create difficulties when the only person with access is no longer able to authorise it.

I'd suggest starting with your practice management provider. Ask whether they have a process for granting emergency access following a practitioner's death or incapacity, what evidence of authority they would require, and what happens to records if the subscription ends.

Then consider your other essential systems. Does your password manager offer an emergency access feature? Could your nominated person locate the instructions without accessing your personal devices? Are there arrangements for maintaining essential subscriptions while records are being secured?

I wouldn't recommend simply handing over passwords or disabling security protections. The aim is to establish an agreed, secure route for appropriately authorised access, with clear limits on what information someone may need and why.
And crucially, document what you've established. Knowing that a system has an emergency access procedure isn't much help if nobody knows how to initiate it when the time comes.

Where do we go from here?
I think one of the difficulties with clinical continuity planning is that every question seems to lead to another. What begins as writing a Clinical Will can quickly become an investigation into data protection, insurance conditions, digital access, record retention and responsibilities we may never have anticipated.

And much of that work falls to individual practitioners, who are already managing the demands of running their practices.
We don't necessarily need to resolve everything at once, though. If you're unsure where to begin, I'd suggest these five steps:

1. Check your current arrangements. Do you have a Clinical Will, and does your nominated person know where to find it?
2. Ask your insurer about record retention. Establish what your policy requires, including what happens if you die or stop practising, and request written clarification.
3. Review your client information and contracting. Are you transparent about the records you keep, how long you retain them and what might happen to them if you're no longer practising?
4. Discuss responsibilities with your nominated Clinical Executor. What are they willing and able to do? What would require a separate arrangement, particularly for longer-term record custody?
5. Write down what you've established. Update your Clinical Will and supporting instructions, identify anything still unresolved and decide when you'll review it.

You may find that you already have good arrangements in place. Equally, you might discover that a seemingly straightforward instruction depends on something you haven't yet organised.

I also think we're entitled to question why navigating these overlapping responsibilities is so difficult. We can take our professional obligations seriously while challenging the amount of interpretation and administrative work expected of individual therapists.

For me, the aim isn't simply to produce another document or demonstrate compliance. It's to leave arrangements that respect our clients' confidentiality, reflect their interests and give the people helping us a realistic chance of doing what we've asked of them.

And perhaps the most useful place to begin is by asking not just who will agree to be my Clinical Executor, but what exactly am I asking them to take responsibility for, and have I made that responsibility manageable?

Further reading

• UK Information Commissioner’s Office: Storage Limitation
• European Commission: Principles of the GDPR
• BACP Ethical Framework

This article offers general professional information, not jurisdiction-specific legal advice. Therapists should establish the requirements applicable to their own practice, clients, records and insurance arrangements.

Laura Harley is a BACP Accredited Counsellor, author and creator of the Clinical Continuity Toolkit. Drawing on her therapeutic experience and background in IT and data security, she develops practical resources for independent and international practitioners.

Her Clinical Continuity Toolkit provides 13 editable resources to help practitioners establish and review their own continuity arrangements.

The new BACP Ethical Framework makes having a Clinical Will an explicit requirement. But for independent, remote and internationally practising therapists, the more important question may be whether it can actually be put into action. 

Most therapists understand the importance of planning for unexpected illness, incapacity or death. We recognise our responsibilities to clients, the need to protect confidential information, and the importance of preparing for circumstances in which we might suddenly become unable to practise.

Yet there is often a considerable distance between recognising those responsibilities and establishing arrangements that someone else could realistically implement. We might have discussed a Clinical Will in supervision, identified a trusted colleague, or completed a template and filed it safely away. But there is a question I think deserves considerably more attention:

If something happened to you tomorrow, would your Clinical Will actually work?

Not whether it exists. Not whether it has been signed or stored somewhere safe. But whether another person could put your arrangements into action when you were no longer available to explain them. There is an important difference between documenting our intentions and establishing a system that allows those intentions to be carried out.

What changes for BACP members in November 2026?
The new BACP Ethical Framework for the Counselling Professions 2026 becomes mandatory for members at midday on Tuesday 3 November 2026. It introduces an explicit requirement concerning Clinical Wills under section 4.5, which addresses managing breaks and endings in ways that minimise their impact on clients and service users. Two provisions are particularly relevant.

Section 4.5(d) requires practitioners to manage unplanned breaks or endings in ways that minimise the risk of harm and disruption to clients.

Section 4.5(e) requires practitioners to have a Clinical Will and appoint an executor who is bound by confidentiality and can communicate with clients if the practitioner becomes unable to contact them or dies.

This is an important development. The previous framework already addressed the responsibilities involved in unexpected illness and death, including appointing somebody to communicate with clients. The 2026 framework makes the requirement for a Clinical Will explicit. For BACP members who have yet to prepare one, the November deadline provides a clear reason to act. 

But I would encourage practitioners to think beyond the existence of the document itself. BACP does not prescribe a particular template or detailed continuity planning system. The framework establishes professional responsibilities while leaving practitioners to determine how they will meet them in their own circumstances. That creates a practical question.

How confident are you that your arrangements could actually be implemented?

When the unexpected becomes reality
My interest in clinical continuity is both professional and personal. As a therapist, I have long understood the ethical importance of preparing for unexpected endings. My work and writing have explored grief, client death and the impact of loss within therapeutic practice. However, my understanding of continuity planning changed considerably when serious illness unexpectedly interrupted my own work.

I experienced first-hand what it means to be unable to manage the ordinary responsibilities of a clinical practice, and to need arrangements that do not depend on the practitioner being available to provide instructions. Experiences like this bring questions about clinical continuity into sharper focus.

• Who knows that something has happened?
• Who understands what needs to be done?
• How will clients be contacted?
• Where is essential information held?
• Who has permission to access it, and how can they do so securely?

These are not questions we can necessarily resolve from a hospital bed, during a serious personal crisis, or after an unexpected death. They need to be considered beforehand.

A Clinical Will is not the same as a continuity system
A Clinical Will is an important document. It can identify a nominated Clinical Executor, record a practitioner's wishes and provide authority and instructions for appropriate action. But the document is only one part of effective continuity planning.
Imagine that a therapist has prepared a Clinical Will naming a trusted colleague.

The colleague knows they have been nominated and has agreed to act if necessary.

Then the therapist suddenly becomes unavailable.

The colleague needs to establish which clients have appointments scheduled, how to contact them, where relevant records are held, what immediate safeguarding considerations may exist, and which communications are appropriate.

But perhaps the appointment system is protected by two-factor authentication linked to the therapist's personal telephone. Client contact details are stored in another system. Nobody knows where the relevant access instructions are kept, and the colleague is uncertain what authority they have to use the information.

The Clinical Will exists. The nominated person is willing.

Yet the arrangements may still be extremely difficult to implement.

A Clinical Will records what should happen. A functioning continuity system makes it possible for the right person to take appropriate action.

That distinction matters because continuity planning is not simply about producing a document. It is about anticipating the practical circumstances in which that document might be needed.

The particular challenges of working independently
For therapists working within organisations, some continuity arrangements may already exist. A practice manager might recognise an unexplained absence. Administrative staff may have access to appointment information. Established procedures may determine how clients are contacted following an unexpected interruption. For independent practitioners, those structures may be absent. Many of us are responsible for almost every aspect of our own practice. We manage appointments, records, client communication, financial administration, technology and professional correspondence.
We may be the only person who knows how these systems fit together.

This becomes particularly relevant for therapists working remotely or from home. There may be no colleague physically present to recognise that we have become unwell or that appointments are being missed. For lone practitioners, even identifying that continuity arrangements need to be activated can present a challenge. And for therapists working internationally, additional considerations may arise. Our clients, professional bodies, supervisors, nominated colleagues and information systems may be located across different countries.

A Clinical Executor might be based in the UK while the therapist practises from France. Clients may be located elsewhere, and records may be held using services operated across multiple jurisdictions. These arrangements are not necessarily problematic, but they require deliberate planning.

The 2026 BACP Ethical Framework explicitly recognises that professional and legal responsibilities may vary between jurisdictions. Its requirements concerning confidentiality, safeguarding and cross-border working reinforce the importance of understanding the contexts in which we practise. We cannot simply assume that a traditional, locally focused Clinical Will template will address every practical consideration.

The information security problem
Before training as a therapist, I spent more than a decade working at IBM as an IT consultant. I have a degree in IT and extensive professional experience and training in information and data security. That background has strongly influenced how I think about clinical continuity. One of the central challenges is balancing two responsibilities that can initially appear to conflict.

We must protect client information against unauthorised access.

But we must also establish a secure and appropriate means for an authorised person to obtain essential information if we become unexpectedly unavailable.

Good information security does not mean making information inaccessible under every circumstance. It means establishing appropriate controls so that access is available to the right people, for legitimate purposes, under defined conditions. In therapeutic practice, this is particularly important because we hold deeply sensitive personal information. We cannot resolve the issue simply by sharing all our passwords with another person. Nor is it sufficient to store everything securely if nobody else can access the information when it is genuinely needed. A workable arrangement requires consideration of authority, access, security and proportionality.

The nominated person should be able to obtain the information necessary to undertake their agreed responsibilities without automatically receiving unrestricted access to everything in the therapist's professional or personal life. This is where clinical continuity planning becomes an exercise in information management as much as professional ethics.

Five practical steps towards a workable Clinical Will.
If you already have a Clinical Will, here are five things you can do to find out whether it would actually work.

1. Establish who would notice your absence.
If you work alone, who would realise that something was wrong? Agree with a trusted person how an unexpected absence would be recognised and who they should contact. Make sure your nominated Clinical Executor knows how they would be alerted. We cannot assume that clients reporting missed appointments will be enough.

2. Have a proper conversation with your nominated person.
Rather than simply asking a colleague whether they'll be your Clinical Executor, talk through what the role actually involves. What would they be comfortable doing? What would fall outside their responsibilities? What support might they need? Agreeing these boundaries now is considerably easier than expecting someone to work them out during a crisis.

3. Make an inventory of essential information.
Write down where your appointment diary, client contact details, relevant records and communication systems are held. Consider what would happen if your telephone was unavailable and two-factor authentication prevented access. You don't need to give someone all your passwords, but you do need to establish a secure, workable route to the information they're authorised to use.

4. Write down what needs to happen first.
Imagine your nominated person receiving a telephone call telling them you have suddenly become unavailable. What should they do that day? Who needs contacting? How would they identify clients who might need particular attention? A short, clearly ordered set of instructions and prepared communication templates can make an enormous difference.

5. Ask someone to test your arrangements.
Give your nominated person a hypothetical scenario and ask them to explain how they would respond, without giving them access to confidential client information. Where would they begin? What information or instructions would they be missing? Use what you learn to improve your plan, and review it whenever your systems, contacts or working arrangements change.

​None of this requires an elaborate system, but it does require us to think beyond the document itself. The aim is to leave someone with a realistic way of carrying out our wishes, rather than a collection of instructions they cannot put into practice.
​
Try looking at your practice through somebody else's eyes
Here's an exercise you could try today. It should take about ten minutes.

Imagine you've become unexpectedly unavailable and a trusted colleague has been asked to step in. They cannot contact you for instructions.

Open your Clinical Will and the documents that accompany it. Now imagine you're seeing them for the first time.

Could you work out who to contact, where the appointment information is held, how to access it securely, and what needs to happen first?

Try following the instructions exactly as they're written, without relying on anything you happen to know about your own practice.

Make a note of anything that requires explanation, depends on information stored elsewhere, or assumes access to a device or account that might be unavailable.

Those gaps become your starting point for improvement.

Better still, ask your nominated colleague to review the arrangements with you. You don't need to share confidential client information to discover that an instruction is unclear or that an important step is missing.

I think this is where continuity planning becomes much more tangible. Instead of asking whether we've fulfilled an obligation, we're asking whether we've left another person with something they can realistically use.

​What happens to the records afterwards?
There's another question that I think deserves more attention: what happens to our clients' records once the immediate arrangements have been made?

Personally, I feel uncomfortable with the idea of deeply confidential information being handed to someone a client may never have met, with the expectation that they'll look after it appropriately. I imagine many clients would feel similarly.
But we also need to consider why records might have to be retained. An insurer may expect us to preserve evidence in case a complaint or legal claim arises years after therapy has ended. Records can be important to the client as well as the practitioner, particularly if the therapist is no longer alive to explain their decisions.

That doesn't mean every therapist must keep records for seven years, or that retention should be indefinite. In the UK, the ICO doesn't prescribe a universal retention period. The difficulty is establishing what applies to our own circumstances, then turning that into a workable policy.

I'd suggest starting with three conversations:

• With your insurer: What records do you expect me to retain, for how long, and why? What happens to those requirements if I die?
• With your clients: What have I explained about retention and disposal during contracting? Have I considered their wishes, particularly regarding what happens after my death?
• With your nominated Clinical Executor: Who would be lawfully responsible for the records, where would they be held securely, who could access them, and how would eventual disposal be arranged?

We also need to distinguish between holding records securely and reading their contents. Someone may need responsibility for their safekeeping without requiring unrestricted access to sensitive therapeutic notes.

What troubles me is how much of this research, interpretation and policy development falls to individual practitioners. We're expected to understand overlapping professional, legal and insurance requirements, and then create arrangements that will still work when we're no longer here to oversee them.

I don't think that responsibility should be underestimated. But asking these questions now, and documenting the answers, is a practical place to begin.

Beyond compliance: continuity planning as professional care
I understand why therapists postpone this work. Thinking about our own illness or death isn't particularly appealing, and there's already an extraordinary amount of administration involved in running an independent practice.
​
The approaching BACP deadline gives us another reason to act, but I think we risk missing something important if we approach this simply as another compliance exercise.

We're not just preparing documents. We're trying to make an extraordinarily difficult situation a little more manageable for our clients and for whoever is left to deal with our professional responsibilities.

And I don't think we need to have everything worked out before making a start.

If you take one thing away from this article, I'd encourage you to arrange a conversation with the person you've nominated as your Clinical Executor. Ask them what they understand about the role, what concerns they have, and what they would need from you to carry it out.

You might discover that your existing arrangements are more robust than you realised. Or you might uncover gaps that hadn't occurred to either of you.

Either way, you'll have done something practical towards making your Clinical Will more than a document sitting in a folder.
For me, that's what clinical continuity planning should be about: making it possible for someone else to act with care, confidence and respect for our clients when we cannot.
​
From having a Clinical Will to having a workable plan
I developed the Clinical Continuity Toolkit in response to the gap between documenting professional intentions and creating practical arrangements that another person can implement. Drawing on my experience as a therapist, my personal experience of unexpected practice interruption, and my background in IT and information security, the toolkit provides a structured approach to continuity planning. It contains thirteen documents organised into nine sections, including a step-by-step Workbook, Clinical Continuity Will, worked examples, secure information arrangements, an operational Handover, communication templates and role-specific instructions. It is designed to be adaptable to different practice settings, including independent, remote, lone-working and international practice.

The objective is not simply to help therapists produce another document, but to help them establish arrangements that make sense for their own circumstances and can be understood by the people who may eventually need to use them.

The toolkit is available at an introductory price of £69 / 79 € until 12:00 CET on 3rd November 2026. After that, the standard price will be £89 / 99 €. It's a one-time purchase, with no ongoing subscription.
​​
Explore the Clinical Continuity Toolkit

Professional reference
British Association for Counselling and Psychotherapy (2026). Ethical Framework for the Counselling Professions 2026, particularly sections 3.1, 3.2 and 4.5.
Read the official BACP Ethical Framework 2026 (PDF)

Laura Harley is a BACP-accredited therapist and author of Confidential Grief: A Therapist's Guide to Client Suicide, Death, and the Impact on Practice. She previously worked for more than a decade as an IT consultant at IBM and has extensive experience in information security and data management. She practises internationally from France.
​
This article offers general professional reflection and does not constitute legal or regulatory advice. Practitioners should ensure their continuity arrangements are appropriate to their own professional obligations and applicable legal requirements.