delivered the opinion of the court:
Plaintiff, Mary Lou Fox, appeals the dismissal of her second amended complaint. Plaintiff, as administrator of the estate of Donald R. Fox, filed a wrongful death action in the circuit court of Cook County. Count I of her second amended complaint alleged that certain acts of medical malpractice by defendant, Dr. Sheldon Cohen, caused the death of her decedent and prayed for $500,000 in damages. Count II of this complaint alleged, hypothetically and in the alternative, that Alexian Brothers Medical Center and its employees, Helen Lottman and Linda Lukaski, had negligently lost, destroyed, or misplaced EKG tracings and reports relating to the decedent, and that the medical center and its named employees had a duty to exercise reasonable care in the custody, safekeeping, and maintenance of records relative to patient care. Count III alleged, hypothetically and in the alternative, that William Shields, an administrator, and nurses Lottman and Lukaski, all employees of Alexian Brothers Medical Center, conspired with defendant Cohen, a staff member of the medical center, to and did hide, lose or secrete EKG tracings relative to the decedent. Both counts II and III alleged that the actions of the defendants deprived plaintiff of vital evidence necessary to sustain her burden of proof against defendant Cohen under count I, resulting in the loss of plaintiff’s cause of action, and prayed for damages in the amount of $500,000.
Prior to the filing of the second amended complaint and pursuant to court order, defendant Cohen filed an affidavit in which he stated that “no records [were] in his possession or control, including, inter alia, EKG tracings or analysis, emergency room records, notes or other written documents.”
*746Defendants, Alexian Brothers Medical Center, Helen Lottman, and William Shields,1 filed a motion to dismiss counts II and III on the grounds that they failed to state a cause of action; failed to allege grounds upon which tort relief could be granted; were barred by the two-year statute of limitations; and, in the alternative, were improperly joined with count I. Defendant Cohen filed a motion to dismiss count III on these same grounds.
The trial court granted defendants’ motions and dismissed counts II and III of plaintiff’s second amended complaint. As to count II the court stated that defendants owed no duty to the plaintiff to maintain certain medical records pertaining to the decedent. Absent such a duty, the trial court stated that the conspiracy as alleged in count III could not be proven; that joinder of counts II and III was therefore improper; and that because of these findings plaintiff’s request for leave to amend was denied. The court found no reason to delay enforcement or appeal of this order. Plaintiff filed a timely notice of appeal from this order.
I.
A.
On appeal, we are concerned only with whether counts II and III stated a valid cause of action in negligence. In order to state a cause of action founded upon negligence, plaintiff must plead the existence of a duty owed by the defendant to plaintiff, a breach of that duty, and an injury proximately resulting from the breach. (Cunis v. Brennan (1974), 56 Ill. 2d 372, 374, 308 N.E.2d 617.) The trial court dismissed count II on the basis that plaintiff failed to allege a duty. Count II was directed only against the hospital and its employees and not against the defendant doctor. The basis of the trial court’s order requires this court to initially consider whether a hospital has a duty to maintain medical records on its patients.
Defendants argue that there is no common law or statutory authority for imposing such a duty on a hospital. Plaintiff cites Cannell v. Medical and Surgical Clinic (1974), 21 Ill. App. 3d 383, 315 N.E.2d 278, and Rabens v. Jackson Park Hospital Foundation (1976), 40 Ill. App. 3d 113, 351 N.E.2d 276, as authority for imposing such a duty.
In Cannell, a case of first impression, this court was presented with the issue of whether a physician had a duty to disclose medical information to a patient on request. Relying on Emmett v. Eastern Dispensary & Casualty Hospital (D.C. Cir. 1967), 396 F.2d 931, which held *747that both the hospital and the doctor had a duty to disclose medical records, this court found that such a duty did exist. This court stated that the fiducial qualities of the physician-patient relationship required the disclosure of medical data to a patient or his agent on request, and that the patient need not engage in legal proceedings to attain a loftier status in his quest for such information. 21 Ill. App. 3d 383, 385.
In Rabens, the plaintiff in counts III and IV of his complaint alleged that he made a demand upon the defendant hospital and its supervising personnel to produce for examination and copying his hospital records, and that the defendants’ failure to do so caused him damages. Counts V and VI alleged a violation of a statutory duty under section 1 of “An Act relating to the inspection of hospital records” (Ill. Rev. Stat. 1973, ch. 51, par. 71), which provided that a hospital, upon the demand of any patient treated in that hospital, permit the patient’s physician or his authorized attorney to examine and copy records kept in connection with the treatment of that patient. This court, in reversing the trial court’s dismissal of counts III and IV, relied upon Cannell as authority for establishing the common law duty of a hospital to disclose upon request, medical data to a patient or his agent. In reversing the dismissal of counts V and VI, this court found that plaintiff adequately alleged the breach of a statutory duty.
Defendants distinguish these cases on the basis that they were concerned with the production of existing and available records, whereas, in the present case, there is no assertion that the hospital failed to produce an existing record. However, plaintiff argues that the common law duty to disclose patient records as established by Cannell and Rabens and by statute would be meaningless without a corresponding duty to maintain records in the first instance. Plaintiff cites the case of Quinones v. United States (3d Cir. 1974), 492 F.2d 1269, as analogous to the present case.
In Quinones, plaintiff, a former Government employee, brought an action against the Government alleging its failure to use due care in maintaining complete and accurate records of his employment history resulting in damage to his reputation. There was no precedent on whether such a claim stated a cause of action in negligence under Pennsylvania law, which law the court found governed. Citing section 281(a) of the Restatement (Second) of Torts (1965),2 the court began by asking whether the plaintiff’s employer owed a legal duty to the plaintiff. The court acknowledged statements from various commentators to the effect that there is no universal test for determining the existence of a duty, and *748that duty depends on how far the law’s protection will be extended. The court then turned to section 285 of the Restatement (Second) of Torts (1965) , which provides:
“The standard of conduct of a reasonable man may be
(a) established by a legislative enactment or administrative regulation which so provides, or
(b) adopted by the court from a legislative enactment or an administrative regulation which does not so provide, or
(c) established by judicial decision, or
(d) applied to the facts of the case by the trial judge or the jury, if there is no such enactment, regulation, or decision.”
The court examined Federal administrative regulations and a manual issued by the Civil Service Commission and found that they contemplated the dissemination of information to prospective employers and imposed certain safeguards, thus evidencing that a risk to an employee’s reputation was contemplated. The court found that a corresponding duty to use due care in keeping and maintaining employment records did exist. While Quinones did not deal with the precise issue presented by the facts in the instant case, we find its analysis in determining the existence of a legal duty particularly applicable here.
Under Illinois law, a duty has been defined as an obligation imposed by law which requires one to conform to a certain standard of conduct for the protection of another against an unreasonable risk. (Fancil v. Q.S.E. Foods, Inc. (1975), 60 Ill. 2d 552, 554, 328 N.E.2d 538; Barnes v. Washington (1973), 56 Ill. 2d 22, 26, 305 N.E.2d 535, 554.) Prosser, in commenting upon duty, stated, “Changing social conditions lead constantly to the recognition of new duties. No better general statement can be made, than that the courts will find a duty where, in general, reasonable men would recognize it and agree that it exists.” (Prosser, Torts, §53, at 327 (4th ed. 1971).) In Darling v. Charleston Community Memorial Hospital (1965), 33 Ill. 2d 326, 331, 211 N.E.2d 253, cert. denied (1966) , 383 U.S. 946, 16 L. Ed. 2d 209, 86 S. Ct. 1204, our supreme court, quoting from Prosser on Torts, 331 (3d ed. 1964), stated:
“ 0 ° in negligence cases, the duty is always the same, to conform to the legal standard of reasonable conduct in the light of the apparent risk. What the defendant must do, or must not do, is a question of the standard of conduct required to satisfy the duty.’ ”
In Darling the court found that, although not conclusive as to a finding of duty, which finding is particularly within the province of the courts, hospital regulations adopted by the Illinois Department of Public Health under the Hospital Licensing Act (Ill. Rev. Stat. 1963, ch. 111½, pars. 142 through 157) and Standards for Hospital Accreditation of the American *749Hospital Association were relevant in evaluating the standard of conduct to which a hospital may be required to conform.
In determining the standard of conduct here, we look to pertinent legislative enactments, administrative regulations, and standards set forth by the American Hospital Association. The Hospital Licensing Act empowers the Illinois Department of Public Health to adopt rules, regulations, standards, and statements of policy needed to implement, interpret, or make specific the provisions and purposes of the Act. Ill. Rev. Stat. 1977, ch. 1115½, par. 151(c).
Pursuant to its rule-making power, the Department of Public Health has promulgated certain licensing requirements. Section 12 — 1.2(b) (amended May 12, 1976) of the licensing requirements, in pertinent part, provides:
“For each patient there shall be an adequate, accurate, timely, and complete medical record. Minimum requirements for medical record contents are as follows: 0 0 0 physical examination report; e ” ” diagnostic and therapeutic reports on laboratory test results, * s * and any other diagnostic or therapeutic procedure performed; * *
Section 12 — 1.4 (amended May 12, 1976) of the licensing requirements provides that “[a]ll original medical records or photographs of such records shall be preserved in accordance with a hospital policy based on American Hospital Association recommendations and legal opinion.”
According to a statement prepared by the American Hospital Association’s committee on medical records and the American Medical Record Association’s planning and bylaws committee, (Statement on Preservation of Medical Records in Health Institutions (1975)):
“The primary purpose of the medical record is to document the source of the patient’s illness and the treatment he receives. Although the medical record is kept for the benefit of the patient, the physician, and the health care institution, it is the property of the health care institution with other interests recognized by law.”
The statement goes on to say:
“The length of time medical records should be retained will vary depending upon the purposes for which the record is being kept. In formulating a record-retention policy, a health care institution must be guided by its own clinical, scientific and audit needs and the possibility of future patient litigation.” (Emphasis added.)
The Association, taking into consideration that the period of retention would be affected by the type of legal action pursued and the statute of limitations applicable to that action as established by the laws of different States, recommended that complete patient medical records in health *750care institutions be retained for 10 years after the most recent patient care usage.
The introduction of the Record Retention Guide for Illinois Hospitals published by the Illinois Hospital Association provides, “[a]n Illinois health care institution in formulating a record retention policy must be guided by its own needs 0 “ the possibility of future patient litigation and state and federal laws.” (Emphasis added.) The Guide recommends that medical records and EKG tracings be retained for 10 to 22 years.
The Accreditation Manual for Hospitals, published by the Joint Commission on Accreditation of Hospitals (1970, updated 1973), provides that “[t]he hospital shall maintain such facilities and services as are adequate to provide medical records that are accurately documented, readily accessible and can be easily used for retrieving and compiling information.” The purposes of the medical record as stated in the manual include, among others, to furnish documentary evidence of the course of the patient’s illness and treatment during each hospital stay; to serve as a basis for review, study, and evaluation of the care rendered to the patient; and to assist in protecting the legal interests of the patient, hospital, and responsible practitioner.
The regulations require that a hospital keep a complete and accurate medical record on each patient. The purposes of this requirement are manifold, each relating to the betterment and protection of the patient as well as the hospital. It is clear that the regulations and recommendations set forth above contemplate the possibility of future patient litigation based upon treatment or care rendered. In view of the increasing number of medical malpractice actions being filed and in order to safeguard the patient’s interest as well as the hospital’s interest in such litigation, we think it necessary that reasonable care be used to maintain complete and accurate medical records. The authorities advocate that it is both desirable and feasible that a hospital assume the responsibility of keeping such records. By finding that a hospital does owe a duty to its patients to use reasonable care in maintaining medical records, we need not resolve such questions as how long or in what specific manner such medical records must be maintained. Those questions are reserved for the trier of fact in its determination as to what is reasonable under the facts of each case.
The conspiracy alleged in count III of the complaint is merely an aggravation of the wrongful acts alleged in count II. In a civil case, the wrongful acts alleged to have been done in pursuance of a conspiracy, and not the fact of the conspiracy itself, is the gist of the action for damages. (Ammons v. Jet Credit Sales, Inc. (1962), 34 Ill. App. 2d 456, 465, 181 N.E.2d 601.) Thus, the viability of count III depends upon whether the allegations of count II state a cause of action.
*751B.
The existence of a legal duty fulfills only one of the elements necessary for stating a valid cause of action in negligence. Another necessary element is that an injury proximately occurred from a breach of that duty. The injury must be actual; the threat of future harm not yet realized is not enough. Prosser, Torts §30, at 143 (4th ed. 1971).
Counts II and III allege that the hospital’s breach of its duty caused plaintiff to lose her malpractice action against the defendant doctor as alleged in count I of the complaint. However, plaintiff has not yet sustained any injury. The medical malpractice claim under count I is still pending. Plaintiff’s theory of recovery in counts II and III is based upon the notion that she will sometime in the future lose her malpractice action because of the absence of an EKG tracing. Such a notion at this point in time is contingent on the unheard proof and result in the malpractice action. That plaintiff will lose her malpractice action because of a missing EKG is, as of now, purely speculative and uncertain. Liability cannot be predicted upon surmise or conjecture as to the cause of the injury. (Driscoll v. Rasmüssen Corp. (1966), 35 Ill. 2d 74, 219 N.E.2d 483.) Plaintiff’s action under counts II and III is premature.
The recent decision of the third district of this court in DMI, Inc. v. Country Mutual Insurance Co. (1980), 82 Ill. App. 3d 113,402 N.E.2d 805, supports our position. In sum this court held that because any damage at the time of bringing the action was a mere possibility, the action was premature.
Based upon the foregoing, we affirm the judgment of the circuit court of Cook County dismissing counts II and III of the plaintiff s complaint. This makes it unnecessary for us to consider the issue raised as to whether counts II and III were properly joined with count I of the complaint.
Affirmed.
STAMOS and HARTMAN, JJ., concur.