Information Governance Records Management Guidance Note No 9: Transportation of Manual Records

Records Management Policy

A dated, documented Health Records Policy approved by the NHS board or its delegated committee is in place. This has been written/reviewed within the last three years. The records management policy makes reference to operational procedures for the transportation of manual records.

Training of Staff

Effective information governance practice is a feature of high quality health services in NHS Scotland. By ensuring that information is obtained, held, used and shared securely and appropriately, it underpins professional and patient confidence in services. The NHS Scotland Information Governance Competency Framework provides broad guidance on recommended content, delivery and governance of education and training to support effective information governance practice across a range of staff groups in NHS Scotland. Learning outcome H1 describes the competencies NHSS staff should possess in order to 'Store, transport and transfer health records and other personal or other sensitive data securely and effectively'. NHS Boards should ensure that the learning outcomes of Domain H1 are incorporated in to appropriate staff awareness and training programmes.

Secure Transportation of Business and Personal Health Information and Records

To comply with the Data Protection Act 1998 and the Human Rights Act 1998 and to conform to Caldicott principles it is necessary to ensure that data which can be linked to an individual (either patient, staff or visitor) which is sensitive or confidential in nature or business sensitive, is transported in a secure manner. The transportation packaging method will be determined according to the means by which the data or record is to be transferred.

Transportation Packaging Methods

A number of handling and transportation packaging methods may be employed for the secure transfer of physical records within NHS boundaries and to partner organisations. These include:

• Single record envopak carriers with seals
• Multiple record envopak carriers with seals
• Pneumatic tube carriers
• Brown paper envelopes
• Brown paper and string
• Non-tearable textured envelopes
• Purpose designed plastic boxes with seals
• Lockable pilot bags

Transportation packaging methods employed must be fit for purpose and in accordance with local NHS Board procedures for the transfer of records and personal / business sensitive information. All returnable transportation packaging methods should be permanently printed with the departments return address in order that they can be returned and easily identified in the event of the data / records going astray.

Privacy Markings

Privacy markings should always be used on envelopes / packages containing business or person identifiable information.

'Confidential- Clinical Information' - for all patient identifiable information of a clinical nature

'Confidential - Personal Information' - for personal identifiable information which should be opened by the addressee only

'Confidential - Business Information' - for business information or corporate records.

Boards should consider double wrapping envelopes and packages so that the privacy markings are contained in the inner packaging. This may not be practicable when re-usable carriers and boxes are in use.

Physical Transportation

Internal mail / transportation - data and records being physically transported by NHS staff or approved contractors within NHS board boundary.

It is imperative that any data or records containing business or person identifiable information are transported internally using one of the approved transportation and packaging methods.

The delivery address should be written in full, legible and visible.

Bundles of health records which are being transported internally by Health Records or other approved NHS staff must be securely tied or secured in approved carriers, boxes or trolleys in a manner which prevents patient details being visible.

Data and records must be transferred using appropriate trolleys or cages and never be deposited and left unattended in areas that are not secure e.g. entrances, corridors, stairways or in vehicles where the package is visible or the vehicle unlocked.

On no occasion should transit envelopes be used for the transportation of business or person identifiable information.

Privacy markings should always be used on the approved packaging method and wrappings / envelopes marked with the return address.

External mail / transportation - data and records being transported via approved couriers, taxis or Royal Mail

The suggested service used to mail data and records is Royal Mail Special Delivery as this service offers a tracking facility which allows the sender to check the safe arrival of the records

Whenever it is necessary for data and records to be delivered by taxi or special courier staff should ensure that they are using a company which has been approved by their NHS Board.

Data and records should be double wrapped (best practice is to use non tearable envelopes or packaging). Both layers of packaging should be addressed to the named recipient or department; the inner layer should bear the appropriate privacy marking. Both layers of packaging should have a return address.

Transportation in vehicles

If staff require to take records, files, notes or other correspondence containing business or person identifiable information outside their base location in order to perform their duties, this should be subject to a risk assessment and approval by the appropriate line manager ensuring adherence to Data Protection, Caldicott, NHS Scotland and local NHS Board policies.

During working hours any records, files, notes or other correspondence containing business or person identifiable information must be stored locked in the van or car boot.

Where health board vehicles are used and parked on NHS premises overnight, the vehicle must be emptied of all data and records to a secure storage location at the end of each day.

Where private vehicles are used when visiting a patient or staff member only the relevant paper work should be removed from the vehicle. All other paper work must remain locked in the boot. Outwith working hours the best practice is to return, files, notes or other correspondence at the end of the day to the base location. However it is recognised that this is not always practical. If data or records cannot be returned they should be taken into the staff member's home in a locked carrier and stored safely and securely preventing inappropriate access to the files. You should refer to your local NHS Board policy for guidance.

Tracking

Data and records should be formally booked out from their normal filing location either manually or electronically according to the approved systems in place within your NHS Board. Whenever data and records are being collected by an external 3rd party e.g. taxi or approved courier a formal booking out system should be put in place to record that the package has been uplifted. A similar process should be in place for the receiving party to confirm safe receipt.