NHSScotland Caldicott Guardians: Principles into Practice

5. Records Management

5.1 The Scottish Government Records Management NHS Code of Practice provides guidance on the required standards of practice in the management of records for those who work within or under contract to NHS organisations in Scotland. It is based on legal requirements and professional best practice. The Code of Practice can be found here.

5.2 NHS Records Management and Information Lifecycle

Records and information are considered to have a "lifecycle" from creation or receipt in the organisation, throughout the period of its 'active' use, then into the period of 'inactive' retention, (such as closed files which may still be required occasionally) and then finally to either confidential disposal or (for a very small proportion) permanent preservation in an archival facility.

A similar "information lifecycle" approach applies to managing the flow of an information system's data and associated metadata from creation and initial storage to the time when it becomes obsolete and is deleted.

5.3 Roles and Responsibilities for Records Management and Organisational Responsibility

The records management function should be recognised as a specific corporate responsibility within every NHS organisation. It should provide a managerial focus for records of all types in all formats, including electronic records, throughout their life cycle, from planning and creation through to ultimate disposal. It should have clearly defined responsibilities and objectives, and necessary resources to achieve them. Great care must be taken when transferring clinical records between one site and another e.g. for disposal and only receptacles approved for the storage and transportations of health records should be used to prevent such records falling into the wrong hands.

Designated members of staff of appropriate seniority (i.e. Board level or reporting directly to a Board member) should have lead responsibility for corporate and health records management within the organisation. The model within each Health Board may differ dependent on local accountability. This lead role should be formally acknowledged and made widely known throughout the organisation.

The manager, or managers, responsible for the records management function should be directly accountable to, or work in close association with the manager or managers responsible for Freedom of Information, Data Protection and other information governance issues as well as the Medical Director who is operationally accountable for the quality of clinical information contained within personal health records in the organisation.

The NHS Board: is responsible for ensuring that it corporately meets its legal responsibilities, and for the adoption of internal and external governance requirements.

The Chief Executive: has overall responsibility for records management in the NHS Board. As accountable officer he /she is responsible for the management of the organisation and for ensuring appropriate mechanisms are in place to support service delivery and continuity. Records Management is key to this as it will ensure appropriate, accurate information is available whenever required.

The Caldicott Guardian: has a particular responsibility for reflecting patients' interests regarding the use of patient identifiable information. They are responsible for ensuring patient identifiable information is shared in an appropriate and secure manner (as previously mentioned in this document).

The Health Records Manager: is responsible for the overall development and maintenance of health records management practices throughout the organisation. They have particular responsibility for drafting guidance to support good records management practice in relation to clinical records and for promoting compliance with this Records Management - Code of Practice, in such a way as to ensure the efficient, safe, appropriate and timely retrieval of patient information.

The Corporate Records Manager: is responsible for the overall development and maintenance of corporate and administrative records management practices throughout the organisation. They have particular responsibility for drafting guidance to support good records management practice (other than for clinical records) and for promoting compliance with this Records Management - Code of Practice.

Local Records Management Co-ordinators: The responsibility for records management at directorate or departmental level is devolved to the relevant directors, directorate and departmental managers. Senior managers of units and business functions within the NHS Board have overall responsibility for the management of records generated by their activities in compliance with the NHS Board's records management policy. Local Records Management Co-ordinators may be designated to support the Health and Corporate Records Manager(s) to oversee local implementation and compliance.

All Staff:

All NHS staff, whether clinical or administrative, who create, receive and use documents and records have records management responsibilities. All staff must ensure that they keep appropriate records of their work and manage those records in keeping with the Records Management - Code of Practice and the relevant policies and guidance within their Board.

5.4 Training

All staff, whether clinical or administrative, must be appropriately trained so that they are fully aware of their personal responsibilities as individuals with respect to record keeping and management, and that they are competent to carry out their designated duties. This should include training for staff in the use of electronic records systems. It should be done through both generic and specific training programmes, complemented by organisational policies and procedures and guidance documentation. For example, Health Records Managers who have lead responsibility for personal health records and the operational processes associated with the provision of a comprehensive health record service should have up-to-date knowledge of, or access to expert advice on, the laws, guidelines, standards and best practice relating to records management and informatics.

5.5 Policy and Strategy

Each NHS organisation should have in place an overall policy statement, endorsed by the Board and made readily available to staff at all levels of the organisation on induction and through regular update training, on how it manages all of its records, including electronic records.

The policy statement should provide a mandate for the performance of all records and information management functions. In particular, it should set out an organisation's commitment to create, keep and manage records and document its principal activities in this respect.

The policy should also:

• outline the purpose of records management within the organisation, and its relationship to the organisation's overall strategy;
• define roles and responsibilities within the organisation including the responsibility of individual NHS staff to document their actions and decisions in the organisation's records, and to dispose of records appropriately when they are no longer required;
• define roles, responsibilities and procedure for safe transfer, storage or confidential disposal of records when staff leave an organisation, or when NHS Board premises are being decommissioned;
• define the process of managing records throughout their life cycle, from their creation, usage, maintenance and storage to their ultimate destruction or permanent preservation;
• provide a framework for supporting standards, procedures and guidelines; and
• indicate the way in which compliance with the policy and its supporting standards, procedures and guidelines will be monitored and maintained.

The policy statement should be reviewed at regular intervals (a minimum of once every 3 years or sooner if new legislation, codes of practice or national standards are introduced) and, if appropriate, it should be amended to maintain its currency and relevance.

For further advice you should contact your Local Health Records or Corporate Records Manager.

Alternatively, if you seek policy advice, in relation to the NHSS Code of Practice on Records Management, you may wish to contact:

Records Management Lead

eHealth Strategy Division

eHealth Directorate robert.bryden@scotland.gsi.gov.uk