Health and social care - records management: code of practice

Section 1 - Introduction

1.1 Background

1 This Code of Practice is a framework to support the consistent approach to, and effective management of, data, information and records. It is based on current legal requirements and professional best practice.

2 It is relevant to NHS Boards, and organisations who work with or under contract to them, to support the delivery of health care services across Scotland. This also includes public health functions in Local Authorities and social care where there is joint care provided within the NHS. Any organisation that processes health care data, information and records under the Public Bodies (Joint Working) (Scotland) Act 2014 should use this Code of Practice, including subcontractors processing data, information and records on behalf of NHS Boards and contracted third party providers.

3 The Code of Practice has been developed by the Scottish Government Digital Health and Care Information Assurance Team, in collaboration with representatives of the Scottish health and social care sector, including records managers, archivists, information governance professionals, clinicians, social care and social work representatives from the NHS, Local Authorities, GP practices, Royal Colleges, and Regulatory Authorities. It draws on advice and published guidance available from the Scottish Government Freedom of Information Unit and the National Records of Scotland, and from best practice followed by a wide range of organisations in both the public and private sectors.

1.2 Strategic Context

4 This Code of Practice plays a pivotal role in supporting the implementation of strategies and policies across health and social care in Scotland.

5 The vision of the current Digital Health and Care Strategy 2021 is: ‘To improve the care and wellbeing of people in Scotland by making best use of digital technologies in the design and delivery of services.’ The strategy also supports the aims of the NHS Recovery Plan in its ambition to address the backlog in care and meet ongoing healthcare needs for people across Scotland. It will support reform of the care system, including better integration of health and care services.

6 This refreshed strategy also provided the framework for the development of Scotland’s first Data Strategy for Health and Social Care. The Data Strategy sets out to ensure that health and care data supports the delivery of health and care services and that it does so in a way that empowers citizens and supports innovation and research.

7 Information is at the core of the health and care strategic direction in Scotland. To achieve the ambitions of both strategies it is crucial that there is a national approach to the management of data, information and records, which is a key aim of this Code of Practice.

• This will result in a more consistent approach to data information and records management across health and care, better enabling the implementation of digital systems and enhancing the interoperability across systems, which ultimately will allow for mitigation of some of the information risks.
• This will enable opportunities for citizens to have a more consistent experience with regards to their information across the health and care system, regardless of their location.
• This will support the improved delivery of services, enabling the sharing of information across health and social care, increasing efficiency and supporting better use of the information held to the benefit of citizens in Scotland.

8 Therefore adoption of the standards within this Code of Practice is fundamental to achieving the vision and aims of the strategies.

9 Going forward, it is acknowledged that, in order to best support integrated working and meet the aims of the Digital Health and Care Strategy and Data Strategy, it will likely be beneficial to develop this Code of Practice to reflect and inform policies and practices across health, social work, and social care more broadly. Work in this area is ongoing, in collaboration with Local Government partners, and it is anticipated that this will be incorporated in future versions of this Code of Practice.

1.3 Aims

10 This Code of Practice aims to harmonise the management of data, information, and records across organisations in order to promote consistency of approach and support the ‘Once for Scotland’ ethos. It aims to achieve this by:

• outlining records management best practice in relation to the creation, use, storage, management and disposal of data, information, and records (including, where appropriate, the archival preservation of vital and historically important records);
• providing guidance on the general legal obligations that apply to data, information and records within the health care sector;
• setting out recommendations for best practice to assist in fulfilling these obligations, e.g. adhering to information governance and cyber security standards;
• setting out recommended periods of retention for data, information and records held by organisations, regardless of the media on which they are held;
• indicating where further guidance on records management may be found;
• explaining the requirement to select, and transfer to a designated place of deposit, those records for archival preservation.

11 It is important that, where possible, organisations use a consistent approach when managing their data, information and records. This not only supports cross-organisation working and information sharing, it also supports the implementation of national strategies which aim to improve the care and wellbeing of people in Scotland by making best use of data, information, records and digital technologies in the design and delivery of services. This Code of Practice plays an important role in setting out how to manage records and information within such technologies to enable communication, support the integration of care, enhance availability of information, and improve working practices.

1.4 Scope

12 This Code of Practice applies to data, information, and records, in any format, or stage of processing in the delivery of health care functions and associated supporting business services. This includes those handled by third parties on behalf of NHS Boards in connection with health care and associated administrative purposes.

13 Formats include, but are not limited to:

• Paper
• Digital
• Email
• Scanned
• Audio/Video recordings
• Photographs/medical imaging
• Microform (microfiche/microfilm)
• Instant messaging/SMS
• Social media posts
• Website content (internet/intranet)

14 The Code of Practice does not cover the retention of human material, in the form of samples or specimens or dental moulds; however, it does cover any data, information or records associated with them. Further guidance can be found at Section 5.32.

15 The records retention schedule detailed at Annex B does not cover social care and social work records and therefore does not apply to Local Authorities or organisations contracted by them in relation to the delivery of social care and social work services. Local authorities base their retention schedules on standards and guidance provided within the Scottish Council on Archives Record Retention Schedules (SCARRS)^[1].

16 Local Authorities should however refer to the retention schedule at Annex B when managing any NHS health and/or corporate records held by them.

17 It is recommended that integrated health and social care records should be held for the longest retention period specified in the Code of Practice or the retention schedule belonging to the associated Local Authority. This information should be documented in the relevant integrated records agreement.

1.5 Document Management

18 This version is a renewed baseline version which further expands into the evolving health and social care sector. It provides generic overarching records management guidance as well as record-specific guidance and signposting to additional professional/industry standards, guidance, further information.

19 The document will be updated on an ongoing basis through a change management process and therefore will be subject to regular change. This will ensure that the document is responsive to changes within the health and social care sector with regards to business need and regulatory/legislative requirements.

20 The change management process will involve review and approval by various stakeholders and professionals depending on the assessed level and context of the requested change.