# What an OPD card is: the 8 details a Thai clinic record must capture, how long to keep it, and what a patient may ask for

Canonical: https://www.flowclinic.tech/en/blog/opd-card

Published: 2026-08-29

Updated: 2026-09-03

Language: en

Publisher: Flow Clinic (https://www.flowclinic.tech)

An OPD card is an outpatient medical record, and it is on the list an inspector checks every year. This guide covers the 8 details the card must be able to capture, how long you must keep it and from what date, what a patient can ask for, how PDPA treats before/after photos, and what an aesthetic clinic must add that a standard card has no room for.

### The short answer
1. **An OPD card is an outpatient medical record** — the per-patient record a clinic is required to keep under the **Sanatorium Act B.E. 2541, section 35(3)**.
2. The card must be **able to record 8 details**, as listed in the annual clinic inspection record that provincial health officers use — from the clinic's name and the patient number to drug allergies, diagnosis, treatment, and the treating doctor's signature.
3. Beyond the individual card, a clinic must also keep a separate **patient register** (name and age · patient number · date of visit) and store records in a **secure, orderly, easily searchable** place.
4. Records must be kept in an inspectable condition for **not less than 5 years from the date the record was made** — not from the patient's last visit. Breaching section 35 carries the penalty in section 65.
5. A patient **has the right to be told the information about their own care that appears in the record**, on request, under the Declaration of Patients' Rights; and under **PDPA section 30** they may request a **copy**, which the clinic must act on within **30 days**.
6. Health data is **sensitive personal data** under PDPA section 26 — before/after photos, test results and allergy history all sit here. The administrative fine reaches **THB 5 million**.

## What an OPD card is, and what the law calls it

OPD stands for outpatient department, so an **OPD card is the medical record of an outpatient** — someone who comes and goes the same day, which is every patient of a general or specialty medical clinic. "OPD card" is not a legal term; Thai law says **เวชระเบียน** (medical record), and the inspection form says **"เวชระเบียน หรือบัตรผู้ป่วย"** — medical record or patient card.

The duty comes from **section 35(3) of the Sanatorium Act B.E. 2541**, which makes the licensee and the operator jointly responsible to "provide and report evidence concerning the practitioners in the facility and the patients, and other documents relating to the treatment, in accordance with the criteria, methods and conditions prescribed in ministerial regulations, and to keep them in a condition that can be inspected for not less than five years from the date they were made." That duty sits with the **licence holder and the operator**, not with a doctor who covers the occasional clinic session.

### A patient register and a medical record are two different things

- **Record storage** — a cabinet, shelf or unit that is secure, safe, kept in order and **easy to search**. This is inspected as a separate item; a cabinet that does not lock, or a stack on a desk, fails.
- **Patient register** — a book or file listing visits, carrying at least three things: the patient's name and age · the patient number · the date of the visit. Plenty of clinics have per-patient cards but **no register**, and fail on that alone.
- **Medical record or patient card** — the individual patient's card, which must be able to record the 8 details covered next.

> **Aesthetic clinics are fully covered** — Specialty dermatology clinics, aesthetic clinics and surgical clinics that keep no patients overnight are all healthcare facilities under the same Act, and are inspected with the same clinic inspection form. A patient coming in for filler rather than illness does not remove the record-keeping duty — and aesthetic procedures are precisely where incomplete records hurt most when a dispute arises.

## The 8 details a patient card must be able to record

The list below is what the annual clinic inspection record sets out at item 4.1.3 — the card must be "able to record the details prescribed by ministerial regulation." The example and common-mistake columns are observations from practice, not part of the form.

*Items 1–8 per item 4.1.3 of the annual clinic inspection record · provincial forms word these slightly differently, so follow the form your own provincial health office uses*

| # | Detail the card must capture | Workable example | Common mistake |
| --- | --- | --- | --- |
| 1 | Name and address of the facility | Leelawadee Specialty Dermatology Clinic · 02-555-1188 | Blank forms with no clinic header, or one branch's header used across several branches |
| 2 | Patient number | HN-000318 | Using a phone number or nickname instead, so patients sharing a name get mixed up |
| 3 | Date of the visit | 3 Sep 2026 | Only the date the card was opened, not every visit since |
| 4 | Name, age, sex, address, phone, and other personal details | Ms. Panthita Sriwilai · 32 · female · Bangkok · 08x-xxx-xxxx | Name and phone only, no address, so nobody can be reached if something goes wrong |
| 5 | Symptoms, drug allergies, physical examination and laboratory findings | No known drug allergy · BP 118/76 · Fitzpatrick III | The allergy field left blank, which nobody can read as "none" rather than "not asked" |
| 6 | Diagnosis | Melasma, bilateral malar | The name of the package sold, written where a diagnosis belongs |
| 7 | Treatment | Botulinum toxin, glabella, 20 units total | "Session as per programme" with no site and no amount |
| 8 | Signature of the medical practitioner who provided the treatment | Doctor's signature with licence number | No signature at all, or the assistant who wrote the note signing instead |

## What an OPD card with all 8 details looks like

Below is the front of a dermatology clinic's patient card. The numbered markers show which item in the table each part answers. The back of the card is the visit grid — date, symptoms, diagnosis, treatment and the doctor's signature, once per visit.

**Leelawadee Specialty Dermatology Clinic** — Outpatient medical record (OPD card)
- (1) Facility: 88/3 Sukhumvit Road, Bangkok · Tel 02-555-1188
- (2) Patient number: HN-000318
- (3) Date of this visit: 3 Sep 2026 (card opened 14 Feb 2024)
- (4) Name · age · sex · address · phone: Ms. Panthita Sriwilai · 32 · female · Watthana, Bangkok · 08x-xxx-xxxx
- (5) Symptoms · allergies · examination: Malar pigmentation, 2 years · denies drug and food allergy · BP 118/76 · Fitzpatrick III · not pregnant
- (6) Diagnosis: Melasma, bilateral malar
- (7) Treatment: Q-switched laser, full face, 1 session · dispensed tretinoin 0.025% nightly
- (8) Treated by: Dr. Orawan (signature) · licence no.
Reverse: per-visit record grid · procedure consent forms · before/after photos · injection point map
_Sample front of an OPD card · every detail is invented; the clinic, patient, HN and licence number are not real_

> **Never leave the allergy field blank** — A blank in a medical record cannot be interpreted — a reader cannot tell "asked, none" from "never asked." Write it positively: "Denies drug and food allergy (asked 3 Sep 2026)." The same rule applies to pregnancy, isotretinoin use and keloid history, which are contraindications for several procedures.

## What the law doesn't demand, but an aesthetic clinic cannot do without

The inspection form is a floor for every kind of medical clinic. It was not designed for aesthetic work, which repeats over many sessions and whose result is visual. This table separates what is **required** from what is **advisable**, so the two don't get blurred when you design the form.

*"Required" = on the clinic inspection form · "Advisable" = practical recommendation, not a legal requirement*

| Item | Status | Why it earns its place |
| --- | --- | --- |
| The 8 details in the previous table | Required | They are on the form an inspector fills in each year |
| A patient register with its 3 fields, and a lockable store | Required | Both are inspected separately from the card itself |
| A separate consent per procedure, dated and signed | Advisable | One blanket consent at sign-up does not cover a procedure that has not happened yet, and it is the first document asked for in a dispute |
| Before/after photos with the date, same angle and same lighting | Advisable | Evidence of the result that words cannot replace — and it needs its own consent to take and to use |
| An injection map per session (site, amount, depth) | Advisable | Item 7 already requires the treatment to be recorded, but prose cannot carry position, so the next session repeats or corrects the wrong spot |
| Lot numbers of fillers, botulinum toxin and implants per session | Advisable | If a manufacturer recalls a lot, you must be able to say who received it without opening every folder |
| Contraindication flags: pregnancy, breastfeeding, isotretinoin, keloid, anticoagulants | Advisable | They must be visible before the procedure starts, not buried in the middle of visit four |
| Per-person access, and a trace of who opened the record | Advisable | PDPA section 37(1) requires measures against unauthorised access; a cabinet everyone can open does not provide them |

## How long to keep it, and what a patient may ask for

Section 35(3) says **not less than five years from the date the record was made**. The point people get wrong is "from the date it was made" — not from the patient's last visit. So for a patient seen over six years, the first year's sheets have passed the minimum while this year's still have five years to run. In practice most clinics keep the whole folder to the newest sheet, because it is simpler and safer. Five years is a floor, not a ceiling. Breaching section 35 carries the penalty in section 65: imprisonment up to one year, a fine up to twenty thousand baht, or both.

Patients have two routes to their information. The first is the **Declaration of Patients' Rights and Responsibilities**, issued jointly by the Medical Council and the other health professional councils on 12 August 2015; item 8 states that a patient has the right to be informed of the information about their own treatment appearing in the medical record, on request, following that facility's procedure, provided it does not infringe anyone else's rights. The second is **PDPA section 30**, which grants the right to access and to **obtain a copy**. A clinic may refuse only where the refusal is by law or court order and access would harm another person's rights and freedoms, and a refusal must be **recorded with its reasons**. Otherwise it must act without delay and **within 30 days** of the request.

> **Closing down does not mean binning the files** — The Ministerial Regulation on the Operation of Healthcare Facilities (B.E. 2545), clause 34, requires that on closure the facility publishes notice so patients treated in the five years before closure can collect their medical records, X-ray films and other documents within two months. Anything unclaimed must be handed to a nearby facility willing to take it, and failing that to a state facility in the district — you may not dispose of it yourself.

## PDPA: a medical record is sensitive data, not ordinary data

![A camera for before/after photos beside a signed consent form in a treatment room](https://www.flowclinic.tech/images/blog/opd-card/opd-card-consent-photo.webp)

**PDPA section 26** classifies "health data" as sensitive personal data, which may not be collected without **explicit consent** unless an exception applies. The exception a clinic relies on is section 26(5)(a), covering medical diagnosis, the provision of health services, and medical treatment — where this is not compliance with a legal duty, it must rest on a contract between the patient and the medical professional. In short, **keeping the record in order to treat the patient is within scope**; using that same data for anything else is not automatically carried along with it.

- **Storage** — section 37(1) requires appropriate security measures against loss, and against access, use, alteration, amendment or disclosure without authority. A cabinet that locks with a short list of key-holders is the minimum you can demonstrate. A digital system needs a login per person, not one shared password for the whole clinic.
- **Access** — staff not involved in the care should not be able to read the whole record. The Medical Council's Ethics Regulation B.E. 2565, item 17, also bars a doctor from disclosing information obtained through practice where it could harm the patient, except with lawful consent or where required by law or duty.
- **Before/after photos** — these are health data too. Taking them for clinical purposes is a different thing from posting them. Keep the two consents separate, and state where the images will be used, for how long, and how consent can be withdrawn.
- **Sending things over LINE** — pushing photos or results into a staff member's personal chat puts sensitive data on a device the clinic cannot control and cannot later purge. If you must talk to patients on LINE, use the clinic's official account with a named owner, and never let a personal phone become the archive of record.
- **Deletion** — section 37(3) requires a system to check for and delete or destroy data once the retention period has passed. At the same time, the erasure right in section 33 does not reach data held under the medical exception or another legal duty, so a record still inside its five years cannot be deleted on request. Explain that to the patient in writing rather than simply refusing.

> **The penalty figures worth knowing** — PDPA section 84 sets an administrative fine of up to five million baht for breaching section 26 and for unlawfully using or disclosing sensitive data. Section 79 is the criminal provision: imprisonment up to six months or a fine up to five hundred thousand baht, rising to one year or one million baht where it was done to obtain an unlawful benefit.

## A paper filing system that actually works, and how to go digital without a gap

![An open paper patient folder beside a tablet showing the same record in digital form](https://www.flowclinic.tech/images/blog/opd-card/opd-card-paper-to-digital.webp)

The problem with paper folders is not the paper — it is filing by name, which breaks the moment a patient changes surname, spells it differently, or shares a name with someone else. A system that survives is **filed by HN**, with the name as a way to search rather than a way to store. The steps below work whether you are staying on paper or about to move.

1. Issue HNs sequentially, and never reuse one
   A fixed-width format such as HN-000318 reads easily and always sorts correctly. Don't bake a year or a branch code into the number — patients move between branches and the number becomes a lie. When a patient stops coming, their number does not go to somebody new.
2. File by HN, then colour-tab by the year of the last visit
   The colour tells you from the spine who has not been in for over two years. It serves both recall planning and knowing which folders are approaching a retention review, without opening a single one.
3. Give the folder a defined address during the day
   A folder may be in exactly three places: the cabinet · the named tray in a treatment room · the "to re-file" tray at the counter. Never on anybody's desk. Almost every folder that goes missing is one with no address during the day, and nothing should be left in the tray at closing.
4. Separate consents and photos from the treatment notes, but bind them with the same HN
   Consent forms are pulled out to be photocopied far more often than notes are, and keeping them loose together is how sheets go missing. Use sub-sleeves in the same folder, and write the HN on every sheet, not just on the cover.
5. Before going digital, decide which copy is the record
   Put in writing the date from which the system is the record and the paper before it is historical. Two copies that different people edit is a bigger risk than paper alone, and the hardest thing to explain to an inspector when the two disagree.
6. Migrate with the existing HNs — don't renumber
   Have the new system accept the old numbers and continue from the highest one imported. Old patients keep the card they already carry and are still findable. Renumber everyone and the old and new histories separate permanently, with nobody coming back to reconnect them.
7. Don't discard the paper, even once it is scanned
   Scanning does not discharge the section 35(3) duty, and the doctor's signature on the original is not fully replaced by an image in a dispute. Keep originals in a lockable cabinet until the retention period your clinic has set has passed — which cannot be less than five years.
8. Rehearse a copy request once a year
   Pretend a patient walks in today asking for a copy of their record. Time how long it takes to assemble it, who approves the release, and where the request is logged. If you cannot answer those, the clinic cannot actually meet the 30-day window in PDPA section 30.

## Common mistakes

- **No separate patient register** — complete per-patient cards but no book or file listing visits by date, which is a different inspection item from the card itself.
- **Leaving the allergy field blank** — a blank does not mean "no allergy." Write the denial with the date it was asked.
- **Package names standing in for diagnosis and treatment** — "10-session brightening programme" is not a diagnosis under item 6 and not a treatment under item 7.
- **No doctor's signature per visit** — item 8 wants the signature of the practitioner who treated the patient, not of the assistant who wrote the note.
- **Editing a record by erasing what was there** — the Medical Council's 2022 ethics regulation, item 16, bars providing medical information or documents that do not accord with the truth. Strike through with a single line so the original stays readable, write the correction, then sign and date it.
- **Before/after photos living on a staff member's personal phone** — sensitive data the clinic cannot control, cannot purge, and cannot say who has seen.
- **Throwing folders out when relocating or closing a branch** — clause 34 of the 2002 ministerial regulation sets out the procedure, and patients retain the right to collect their own documents.
- **Counting the five years from the last visit** — the law counts from the date the record was made. Counting from the wrong end means discarding documents too early while believing you are compliant.

## Self-audit checklist

Pull ten folders at random and work down the list. It takes about twenty minutes. If the same item fails across several folders, the form is badly designed — it is not careless staff.

- [ ] The header carries the clinic's licensed name and address, for the branch that actually provided the care
- [ ] The patient number appears on every sheet, not only on the cover
- [ ] Every visit has a date, not just the first one
- [ ] Name, age, sex, address, and a phone number that reaches the patient
- [ ] The allergy field contains words, not a blank
- [ ] A diagnosis in clinical terms, not a package name
- [ ] The treatment names the site and the amount actually given
- [ ] The treating doctor's signature for every visit
- [ ] A separate patient register exists, with all three required fields
- [ ] The cabinet locks, is in order, and any folder can be found within a minute
- [ ] The latest procedure's consent form is in the folder, dated and signed
- [ ] Before/after photos are tied to the HN and covered by consent for the use they are actually put to
- [ ] The oldest sheet in the folder is intact and dated, so its age can be confirmed
- [ ] If a patient asked for a copy today, you can say who approves it, how many days it takes, and where the request is logged

## A medical record you can print the moment it is asked for
Flow Clinic keeps patient details, allergy history, every visit, before/after photos and signed consents under one HN, and prints a medical record document from the same screen — either the whole history or a single visit.
- HNs are issued automatically in one format across the clinic, never duplicated, and existing numbers can be carried over from an old system during migration.
- The printed medical record carries the clinic letterhead with its licence number, the patient's details, drug and food allergy history, then each visit — symptoms, vitals, diagnosis, procedures with the treated area, materials used, and the treating doctor with their licence number.
- Drug, food and latex allergies, pregnancy, isotretinoin use and keloid history appear as severity-tinted alert chips at the top of the patient record.
- Consents are versioned templates: the patient signs on screen, and the signed PDF is stored with its hash and a consent number, with the system flagging whether the signature still matches the current version or has gone stale.
- Before/after photos are attached per visit and typed as before or after, and selected pairs can be exported as a comparison sheet in several aspect ratios.
- The treatment chart is drawn on body diagrams the clinic uploads itself, with labelled pins and freehand marking.
- Every delete is a soft delete — patient data is never removed from the database — and every request is logged with the user, the route and the time.

## Sources
1. [Sanatorium Act B.E. 2541 as amended — sections 35(3) and 65](https://hss.moph.go.th/fileupload_doc/D00000002319_28616.pdf) — Department of Health Service Support, Ministry of Public Health (Thai)
2. [Annual medical clinic inspection record — item 4.1, medical records](https://fdasamutsongkhram.org/wp-content/uploads/2023/08/%E0%B8%A1%E0%B8%B2%E0%B8%95%E0%B8%A3%E0%B8%90%E0%B8%B2%E0%B8%99%E0%B8%84%E0%B8%A5%E0%B8%B4%E0%B8%99%E0%B8%B4%E0%B8%81%E0%B9%80%E0%B8%A7%E0%B8%8A%E0%B8%81%E0%B8%A3%E0%B8%A3%E0%B8%A1-%E0%B8%9B%E0%B8%A3%E0%B8%B0%E0%B8%88%E0%B8%B3%E0%B8%9B%E0%B8%B5.pdf) — Consumer Protection and Public Health Pharmacy Group, Samut Songkhram Provincial Health Office (Thai)
3. [Declaration of Patients' Rights and Responsibilities — items 6, 8 and 9](https://www.tmc.or.th/pdf/declaration.pdf) — Issued jointly by the Medical Council and the health professional councils, 12 August 2015 (Thai)
4. [Personal Data Protection Act B.E. 2562 — sections 26, 30, 33, 37, 79 and 84](https://ratchakitcha.soc.go.th/documents/17082307.pdf) — Royal Gazette, Vol. 136, Part 69 Kor, 27 May 2019 (Thai)
5. [Medical Council Regulation on Maintaining Medical Professional Ethics B.E. 2565 — items 16 and 17](https://tmc.or.th/pdf/tmc-04-09122565.pdf) — Royal Gazette, Vol. 139, Special Part 272 Ngor, 23 November 2022 (Thai)
6. [Ministerial Regulation on the Operation of Healthcare Facilities (B.E. 2545) — clause 34, closure](https://th.wikisource.org/wiki/%E0%B8%81%E0%B8%8E%E0%B8%81%E0%B8%A3%E0%B8%B0%E0%B8%97%E0%B8%A3%E0%B8%A7%E0%B8%87%E0%B8%A7%E0%B9%88%E0%B8%B2%E0%B8%94%E0%B9%89%E0%B8%A7%E0%B8%A2%E0%B8%81%E0%B8%B2%E0%B8%A3%E0%B8%9B%E0%B8%A3%E0%B8%B0%E0%B8%81%E0%B8%AD%E0%B8%9A%E0%B8%81%E0%B8%B4%E0%B8%88%E0%B8%81%E0%B8%B2%E0%B8%A3%E0%B8%AA%E0%B8%96%E0%B8%B2%E0%B8%99%E0%B8%9E%E0%B8%A2%E0%B8%B2%E0%B8%9A%E0%B8%B2%E0%B8%A5_(%E0%B8%9E.%E0%B8%A8._%E0%B9%92%E0%B9%95%E0%B9%94%E0%B9%95)) — Transcript of the Royal Gazette text on Thai Wikisource (Thai)

## Frequently asked questions

### Can an OPD card be digital only, with no paper at all?
Section 35(3) requires records to be kept "in a condition that can be inspected" and does not specify paper. But the inspection form still checks for secure, easily searchable storage and for the treating practitioner's signature. The safe path through a transition is to state in writing the date from which the system is the record, keep the existing paper for the full retention period, and ask your provincial health office about local practice before dropping paper entirely.

### Once five years are up, can we destroy the records?
Five years is the minimum under section 35(3), not an instruction to destroy. PDPA section 37(3) only requires a system to check for and delete or destroy data once the retention period the clinic has set has passed. Before destroying anything, consider the limitation period for any dispute the procedure could give rise to, destroy in a way that cannot be recovered, and record what was destroyed, when, and by whom.

### A patient asks for a copy of their record. Can we refuse, and can we charge?
PDPA section 30 grants the right to access and to obtain a copy. A clinic may refuse only where the refusal is by law or court order and providing the copy would harm another person's rights and freedoms, and any refusal must be recorded with its reasons. Otherwise you must act within 30 days. The Act does not set a fee schedule, so charge the actual cost of copying and tell the patient in writing beforehand.

### Do before/after photos have to be in the record, and can we post them?
The inspection form does not require before/after photos, but for aesthetic procedures they are evidence of the result that prose cannot replace, so keep them under the same HN. Publishing them is a different purpose from treating the patient: it needs its own consent naming the channels, the duration, and how consent can be withdrawn — and you should check the healthcare-advertising rules with your provincial health office before every release.

### A doctor wrote something wrong. What is the correct way to fix it?
Never erase, scratch out or use correction fluid, because that removes the original entry. The Medical Council's 2022 ethics regulation, item 16, bars providing medical information or documents that do not accord with the truth. The accepted method is a single strike-through that leaves the original readable, the correction written after it, then a signature and date on the change. A digital system should keep an edit history for the same reason.

### With several branches, should HNs be one series or one per branch?
One series across the clinic is safer, because a patient who visits another branch does not get a second card and a second history. The card header and any printed document should still show the name and address of the branch that provided the care, per item 1. If each branch currently runs its own series, merge them at migration: keep existing patients' numbers and continue the new series from the highest one.