Information Governance Records Management Guidance Note Number 004: Compiling A Records Inventory

Background

The Scottish Government Records Management NHS Code of Practice (Scotland) Version 2.0 makes reference to the need for each NHS organisation to establish and maintain mechanisms through which departments can register records and media containing business or personal identifiable information they are maintaining. The Code of Practice makes reference to the need for Boards to provide a managerial focus for records of all types in all formats, including electronic records, throughout their life cycle, from planning and creation through to ultimate disposal. The term Records Lifecycle Management describes the life of the record from its creation or receipt in the organisation, throughout the period of its active use, then into the period of inactive retention, (such as closed files which may still be required for reference) and then finally when it is disposed of by either confidential destruction, or permanent preservation in an archival facility.

A crucial component of NHS Information Governance is knowing what records are held, where they are kept, who the data controller is and how the information contained within the record is being used. Compiling a records inventory will enable an NHS Board to proactively and consistently manage its records and ensure that information is available at the point of need. It will also assist the NHS Board to ensure they meet statutory obligations and standards in respect of:

• Data Protection Act (1998)
• Freedom of Information (Scotland) Act 2002
• Records Management NHS Code of Practice (Scotland) 2010
• Information Governance Standards (Scotland)
• Professional Guidelines e.g. Royal College of Physicians guidance on record keeping standards

The records inventory assists NHS Boards to achieve compliance with the Information Governance standards by:

• Identifying responsible record holders or owners;
• Identifying information sharing arrangements within the NHS and externally;
• Identifying whether records are held electronically or on paper;
• Enabling records collections to be mapped to records retention schedules to ensure compliance and that where appropriate out of date or replicated records are destroyed;
• Identifying training needs and enabling the organisation to respond, thereby ensuring that staff responsible for records management possess appropriate knowledge and skills;
• Identifying storage pressures and inappropriate storage conditions, thereby allowing corrective action to be taken;
• Identifying deficiencies in security arrangements for records, both manual and electronic.