Email Archiving for Aged Care Providers NSW

Since 1 November 2025, when the Aged Care Act 2024 commenced alongside the strengthened Quality Standards, email has stopped being correspondence and started being evidence. A single mailbox now routinely holds the only record of a family raising a concern, a GP confirming a medication change, a rostering decision made at 2am, and a manager escalating an incident.

Most providers we speak to do not have an email problem. They have five unresolved decisions. Until those are settled, every audit, complaint and coronial request turns into a scramble through individual inboxes — some of which no longer exist.

This page sets out the five decisions. Each one links to a page that works through it in detail.

Decision one: what actually gets captured

Section 154 of the Act makes it a condition of registration that a provider keeps and retains "the kinds of records prescribed by the rules". The kinds are prescribed in Chapter 4, Part 7 of the Aged Care Rules 2025. Email is not named as a record class — but email is frequently the container the record arrives in.

That distinction matters. A consent confirmation sent by a daughter at 9pm is a record about care regardless of the fact it arrived as an email. If your capture rule is "archive the clinical team's mailboxes", you will miss it, because it landed with reception.

The defensible position is to capture organisation-wide and classify afterwards, rather than decide up front which mailboxes matter. Selective capture requires you to predict where evidence will arrive, and nobody can do that reliably in a care setting.

Decision two: where the record lives

If the only copy of a message lives in the mailbox of the person who sent it, then the person who sent it controls whether the record survives. That is true whether they delete it deliberately, clear their mailbox to free up space, or simply leave.

An archive that captures before delivery removes that dependency. The record exists independently of the mailbox, the person, and their employment status. This is the single most common gap we find, and it is why protecting email records when staff leave is treated as its own topic — in a sector with the turnover aged care carries, mailbox-dependent records are records with an expiry date nobody chose.

Decision three: how long you keep it

Seven years is the figure, but the reasoning behind it is widely misquoted, and the misquote creates its own exposure.

The seven-year obligation for a currently registered provider comes from the Aged Care Rules 2025 made under section 154(a), measured from creation of the record. It does not come from the Privacy Act. That is worth stating plainly, because the Australian Privacy Principles push in the opposite direction: APP 11.2 requires an entity to take reasonable steps to destroy or de-identify personal information once it is no longer needed for any permitted purpose.

So retention and destruction are both obligations, pulling against each other. Keeping everything forever is not the safe option — it is a different breach. There is also a separate seven-year rule for former providers, running from the date registration ceases, which matters in any merger, divestment or wind-up. Email retention obligations for aged care providers works through the periods and the triggers that extend them.

Decision four: who can retrieve it, and how fast

Retention without retrieval is storage, not compliance. The tests that matter are set by the timeframes other people impose on you.

Retrieval demands aged care providers are actually held to
Trigger	Who asks	Timeframe you are working to
Priority 1 reportable incident	Aged Care Quality and Safety Commission	Notify within 24 hours of becoming aware
Priority 2 reportable incident	Aged Care Quality and Safety Commission	Notify within 30 days of becoming aware
Quality audit or site visit	Commission Quality Auditors	During the visit, on request
Complaint investigation	Commission, family, or advocate	Within the response period set by the Commission
Coronial or legal request	Court, coroner, or solicitor	Set by subpoena or notice to produce

SIRS notification timeframes are published by the Commission: Priority 1 within 24 hours, Priority 2 within 30 days. A 24-hour clock is not compatible with asking IT to restore a departed employee's mailbox from backup. See email archiving to support complaints and investigations.

The second half of this decision is access control. Strengthened Quality Standard Outcome 2.7 requires that access be "appropriate to their role" — so an archive where every manager can read every message fails the Standard from the opposite direction to one where nobody can find anything.

Decision five: how you prove all of the above

Under the strengthened Standards an auditor is not satisfied by a policy document. Outcome 2.7 requires you to "regularly review your information management system to make sure it works well" and to act on what the review finds. That is a request for evidence of operation, not evidence of intent.

In practice, three things get asked for: the configured retention rules themselves, an audit log demonstrating that records could not have been altered or removed, and a live search producing a complete thread with its attachments intact. Meeting audit requirements with email data management covers what that evidence looks like in front of an auditor.

Attachments are where this most often falls over. A care plan PDF or an incident photograph can carry a different retention rule to the message that delivered it, and expire separately. A record that has lost its attachment is not a complete record.

Where family and resident correspondence sits

Correspondence with residents and their families cuts across all five decisions and deserves separate treatment, because it is simultaneously the most sensitive category, the most likely to be produced in a complaint, and the least likely to be recognised as a record at the moment it is written. Protecting resident and family correspondence covers consent, context and the practical reality that these threads are usually the ones a complaint turns on.

Our immutable mailbox archive captures messages before they reach the inbox, stores them in Australian AWS regions, and makes them searchable and exportable independently of any mailbox. Retention rules are configured to your record classes rather than applied uniformly, so you are neither under-retaining a care record nor over-retaining personal information you no longer have a purpose for.

Where you also need the Microsoft 365 side configured — retention labels, audit logging, sensitivity classification, access reviews — that is covered under Microsoft 365 for aged care providers. Where the question is governance and prioritisation across sites, our aged care vCIO engagement is the usual starting point.

Aged Care record-keeping challenges we solve

Meeting Audit requirements with Email data management

Unexpected quality audits are a fact of life for Aged Care facilities. Rapid access to email evidence, irrespective of who's inbox it was sent to is a challenge and may be the only way to answer an audit question. Imagine if you could query every email across every Inbox for that missing artefact in less than 20 seconds.

Email data retention for audit enquiries

Protecting Email in High Staff-turnover roles

Staff turnover is disruptive in any care situation. The potential for loss of email data during such an event is high, but can be managed.

Explore permanent email storage

Protecting Resdient and Family Correspondance

Email is a critical information exchange tool between residents, their families and care staff - managing accountability takes planning

Explore solutions for family correspondance

Incident reports and complaint Investigation

Rapid access for investigators requiring complete communication trails to verify care quality and response actions

Easing to burden of Incident Response

How long do I need to retain emails for?

Emails documenting resident care plans, incidents, complaints, or family communications must be retained for at least 7 years after the last service entry under Privacy Act requirements and Aged Care Rules

Discover your email retention obligations

Is email specifically named as a record we have to keep under the Aged Care Act 2024?

No.

Section 154 makes it a condition of registration to keep the kinds of records prescribed by the Aged Care Rules 2025, and email is not itself a prescribed class.

The obligation attaches to the content, not the format. When a prescribed record — a care decision, a consent, an incident detail, a complaint — exists only inside an email, that email is how you evidence it.

Providers who read the absence of the word "email" as an absence of obligation are the ones who cannot produce the record later.

Does the Privacy Act require us to keep emails for seven years?

No, and this is a common and consequential mix-up.

The seven-year period for a registered provider comes from the Aged Care Rules 2025 made under section 154(a) of the Act.

The Privacy Act works the other way: APP 11.2 requires reasonable steps to destroy or de-identify personal information once it is no longer needed for a permitted purpose.

Citing the Privacy Act as the source of a retention obligation is not just imprecise, it obscures the fact that indefinite retention carries its own risk.

If we already have Microsoft 365 retention policies, do we still need archiving?

They solve different problems and most providers need both.

Microsoft 365 retention governs how long content is kept and when it is disposed of within the tenant. An immutable archive captures the message independently of the mailbox before delivery, so the record survives mailbox deletion, licence removal, tenant misconfiguration and staff departure.

Retention answers how long. Archiving answers whether the record still exists to apply that period to.

What happens to a resident's email records after they pass away?

The retention clock generally runs from creation of the record rather than from the end of the relationship, so records do not become disposable at that point.

Separately, an unresolved complaint, a coronial interest or any legal proceeding suspends disposal entirely for the material in scope.

The practical approach is to keep normal rules running while applying a hold to anything connected to an open matter, and to be able to demonstrate that the hold was applied.

Can staff still delete emails normally once archiving is in place?

Yes.

Capture happens before delivery, so what a staff member does with their copy has no bearing on the archived record.

This matters more than it sounds: any system that depends on staff behaving correctly under pressure at the end of a shift is not a compliance control.

Staff manage their mailboxes as they always have, and the evidence base is unaffected.

Email Archiving for Aged Care Providers