How to organise years of paper medical records and scans

Most people’s medical history lives in a drawer, a plastic sleeve, and two or three email accounts. Discharge summaries, lab printouts that have started to fade, a large envelope with an X-ray film in it, a CD from a radiology practice that no computer in the house can read any more, and a stack of specialist letters addressed to a GP you no longer see.

It takes a weekend rather than an hour, but it has a clear order, and the right order saves most of the work.

Disclosure

I am a doctor, and I founded exora, a personal health record app built for exactly this problem. It appears once, near the end. Everything before that works whatever you use, including nothing at all.

Step 1: work out what you are missing before you scan anything

The instinct is to start scanning the pile in front of you. Resist it for an hour, because the pile is not the record. It is whatever happened to survive.

Write a rough timeline instead: every GP practice you have been enrolled with, with approximate years, every hospital stay, every specialist, public or private, the community labs and radiology practices whose names appear on your results, and dentists, optometrists, physios and counsellors. Aim to notice the gaps, not to be complete, because the gaps are what you will request in step 2, and requests take weeks.

Start the requests first, then scan the pile while you wait. Doing it the other way round costs you a month.

Step 2: request the records you do not have

In New Zealand you have a legal right to your health information, from any provider that holds it. It comes from rule 6 of the Health Information Privacy Code 2020, which says you are entitled, on request, to confirmation of whether a health agency holds health information about you, and to access it. The procedure comes from the Privacy Act 2020. Four details make the difference between an easy request and a frustrating one:

• Twenty working days is the deadline. The Privacy Commissioner says an agency “must respond to a request for information within 20-working days”, and can extend that only in limited circumstances, explaining why and telling you when you will get the information. A Privacy Commissioner article for health providers says the clock runs “from the day after the health agency receives an access request.”
• It is usually free. The Commissioner’s fact sheet on access requests says public sector agencies, such as public hospitals, cannot charge at all. Private providers, which includes GP practices, can make a reasonable charge only in the two cases set out in clause 6 of the Code: a repeat request for the same or substantially the same information within 12 months, or a copy of an x-ray, video recording, MRI, PET or CAT scan photograph. If the charge is likely to be over $30, they must give you an estimate first. So ask once, for everything you want.
• Ask for electronic copies. The Commissioner says that if a person asks for their information in a particular form, “this is how you should provide it”, unless that would impair efficient administration, be contrary to a legal duty, or prejudice an interest protected by the withholding grounds. Say so explicitly: PDFs, by email or secure download. Otherwise you may get paper, and then you are scanning it yourself.
• Be specific, and put it in writing. There is no set form, but the Commissioner encourages writing because it creates a record. “My full GP record” or “everything about my stay in March 2024” saves a round of questions.

A short email to the practice, or to the hospital’s clinical records team, is enough: your name, date of birth, NHI number if you know it, the period you want, and a request for a complete copy in electronic form. Our New Zealand guide to getting your medical records covers the process, what can be withheld and what to do if you are refused.

Before you write, check what you can already download. Many GP practices share results and documents through a patient portal such as ManageMyHealth or MyIndici; our guide to test results in your patient portal explains what to expect. Health New Zealand’s My Health Record lets you have a PDF of your immunisation record emailed to you; our guide to getting your immunisation records explains how.

Step 3: sort before you scan

Sort the physical pile: one pile per person if you are doing a family, then roughly by period within each. Aim for “1990s, 2000s, 2010s, recent”, not exact dates: the dates go in the filenames later, and the computer does the fine sorting.

Pull two things into their own piles as you go. Anything where several pages belong to one document: a six-page discharge summary is one document, not six scans. And anything fading. Old printouts on thermal paper, such as some pharmacy receipts and older machine printouts, lose contrast over time. Those pages have a deadline, so scan them first.

Step 4: scanning settings that actually matter

Ignore most of what scanner software offers. Four settings matter.

Resolution: 300 dpi. Archives New Zealand’s guidance on destruction of source information after digitisation, written for public offices and local authorities, recommends a minimum of 300 ppi for text and photographic prints, in greyscale or colour. It also says the best resolution depends on the documents and on whether “the smallest meaningful element” in them can still be read in the scan. For faint handwriting, 400 dpi is a reasonable step up.

Colour: greyscale is usually enough for typed pages; use colour where it carries meaning, such as a coloured chart, a highlighted result or a stamp.

Format: PDF, one file per document, with text recognition on. Not JPEG: a multi-page document should be one multi-page PDF. Turn on OCR (optical character recognition), which turns a picture of text into searchable text; Archives New Zealand mentions OCR as the kind of content indexing that “enables full-text searches”. If your software offers PDF/A, use it. It is one of the formats in Archives New Zealand’s specifications, which describe it as suited to long-term archiving because it is entirely self-contained.

Deskew and auto-crop: on. Straight, cropped pages read better and OCR more accurately.

Phone or flatbed?

A phone is fine for most of this. Use its document scanning mode rather than the plain camera: it detects edges, flattens the page and outputs a multi-page PDF. Use a flat surface, even light from the side, no flash, and keep your shadow out of the frame. A flatbed is worth it for hundreds of pages or anything fragile; hand-feed old pages rather than trusting a sheet feeder.

Step 5: the imaging problem

Imaging is where people get stuck, because there are two things in that envelope. There is the report, the radiologist’s written findings, and there are the images themselves. For most purposes, including giving your history to a new specialist, the report carries the information. It is a text document: scan it like anything else, and do that first, because it is easy and it is most of the value.

The images are different. Medical images are stored in a format called DICOM, and a disc with medical images on it is most likely a DICOM CD rather than a folder of ordinary pictures. Many computers no longer have a disc drive.

Practical options, in the order I would try them:

• Contact the hospital or radiology practice that did the scan. Ask what they can provide and in what form: another disc, a USB drive or a secure download. Arrangements vary, so this is a phone call or an email rather than something you can look up.
• Use your right of access. Images are health information the provider holds about you, so rule 6 covers them. A public hospital cannot charge you. A private radiology practice may make a reasonable charge for a copy of an x-ray or scan image, and must give you an estimate first if it is likely to be over $30. Expect to confirm your identity.
• Borrow an external USB disc drive and copy the disc contents into a normal folder, whether or not you can view them.
• Keep the DICOM files even if you cannot open them. They are the diagnostic-quality original. A radiologist or specialist can read them; a screenshot of a viewer is no substitute.

Old X-ray films can be photographed against a bright, even light, such as a window on an overcast day. That gives you a record that the study exists, not a diagnostic-quality image. The written report matters more.

Step 6: name files so you can find them later

One convention, applied consistently, and the problem is solved for good. Put the date first, in year-month-day order:

2019-03-14_ChristchurchHospital_DischargeSummary.pdf
2019-03-16_CommunityLab_FullBloodCount.pdf
2021-11-02_Dr-Ngata_CardiologyLetter.pdf

Date-first in YYYY-MM-DD order is the whole trick: it sorts chronologically on its own, in every operating system. Writing 14-03-2019, the usual New Zealand order, does not. Use the date on the document, the date of the appointment or the test, not the date you scanned it.

Keep folders shallow: a folder per person, and inside it one folder per year or per document type.

Step 7: back it up before you relax

You now have one copy, on one laptop, and one copy is not a record.

A common approach is the 3-2-1 rule: three copies of the data, on two different kinds of storage, with one copy somewhere else. For a household, that usually means the folder on your computer, a copy on an external drive, and a copy in a cloud service. The off-site copy survives a fire, a flood or a burglary.

For health information, choose cloud storage you trust with sensitive data, turn on two-step verification, and test the backup once by opening a file from it.

What to keep on paper

Do not shred as you scan. A few sensible rules:

• Keep anything you might need to show in person. Your child’s Well Child Tamariki Ora My Health Book, covered in our guide to Well Child Tamariki Ora checks, and anything with an official stamp or signature.
• Keep anything you cannot request again. If the practice has closed or the document came from overseas, that paper may be the only copy.
• Keep the DICOM discs until the files are copied and backed up somewhere you have checked.
• Be relaxed about routine duplicates, such as a letter your GP practice still holds.

How long will providers keep their copies? Under the Health (Retention of Health Information) Regulations 1996, the minimum retention period is 10 years, beginning on the day after the most recent date on which the provider gave you services. The Privacy Commissioner’s summary puts it as keeping records for 10 years from the last time services were provided to the patient, and notes two exceptions: when the provider has transferred the files to a new provider, or given the complete file to the patient. Separately, rule 9 of the Code says a provider must not keep health information for longer than it needs it for lawful purposes, although it may keep it where that is necessary or desirable for providing you with care.

Ten years is a minimum, not a promise to destroy, but records from a clinic you last saw fifteen years ago may no longer exist. Keep the paper that matters to you.

The step people skip: making it usable

When you finish, you have a searchable, backed-up folder of PDFs, which is far better than a drawer. It is still not a health record. Searching for “cholesterol” gets you eleven documents; it does not get you your cholesterol over eleven years. The question “when did this actually start” still means opening documents side by side. Text search finds words; a health record is about facts, dates and how they relate. Closing that gap is either patient work, keeping your own summary, or software.

Where exora fits, and where it does not

exora is a personal health record app. You upload the PDFs you have just made, and exora reads them for you, with a reading system built for medical records. It pulls out the conditions, medicines, results, procedures, allergies and immunisations, and assembles them into one searchable record with a timeline. Every fact links back to the page and line of the document it came from, so you can check any of it. It works on iOS, Android and the web. exora is free to start, with an optional membership.

Where it does not help, plainly:

• It can misread. The reading is automated, so check anything that matters against the original. That is why every fact links back to it.
• No connection to Health New Zealand. exora has no link to My Health Record, your GP’s portal or any Health New Zealand system, and no New Zealand health-data certification. It does not request records for you.
• Your data is stored in Sydney, Australia, outside New Zealand. How we handle it is on our security page; read it before you upload anything.
• It is not medical advice. It organises what you already have. It does not diagnose or interpret anything.

For a fair comparison with the official tools, see My Health Record, your GP portal and a personal health record app. If some of your records are in another language, see getting medical records translated. Whatever you use, the folder is the valuable part, and it is yours. The next step is understanding what it says.

The short version

1. Map your providers and notice the gaps.
2. Request the missing records under rule 6: usually free, 20 working days, and ask for electronic copies.
3. Sort the pile roughly by person and period. Scan fading thermal paper first.
4. Scan at 300 dpi, greyscale for text, one multi-page PDF per document, OCR on.
5. Scan imaging reports as documents. Ask the hospital or radiology practice for the images, and keep the DICOM files.
6. Name everything YYYY-MM-DD_Provider_Type. Keep folders shallow.
7. Three copies, two kinds of storage, one off-site. Then test it.

If something you read worries you, take it to your GP, not the internet. Sorting records is admin; interpreting them is not.

Sources

• Health Information Privacy Code 2020 (version as at 1 May 2026), rule 6 (access), rule 9 (retention) and clause 6 (charges, $30 estimate)
• Privacy Act 2020
• Privacy Commissioner: ask for your information (20 working days, extensions)
• Privacy Commissioner: HIPC fact sheet 4, dealing with access requests (public agencies cannot charge; private agencies’ two exceptions)
• Privacy Commissioner: health info, the right to know made easy (clock starts the day after, written requests)
• Privacy Commissioner: providing information in a certain form
• Health (Retention of Health Information) Regulations 1996, regulations 5 and 6 (10-year minimum retention period), and the Privacy Commissioner’s summary
• Archives New Zealand: destruction of source information after digitisation (300 ppi, PDF/A, OCR)
• DICOM standard: medical images on CD

Access rights, timeframes and charges are sourced to the Health Information Privacy Code and the Privacy Commissioner, retention to the Health (Retention of Health Information) Regulations 1996, and scanning settings to Archives New Zealand, linked inline and checked on 9 November 2026. Retention periods are minimums; imaging arrangements vary between providers, so treat that section as a starting point for a phone call. This article is general information, not medical or legal advice. How exora handles your information is in our privacy policy.