Principle: E4 Records management

Overview

To meet the requirements of this contributing outcome, your organisation must assure that it manages records in accordance with its professional responsibilities and the law. This includes all the types of records which are defined as being covered in the scope of the Records Management Code of Practice 2021.

Managing records appropriately

The Records Management Code of Practice 2021 will support you in developing a policy and managing records appropriately. It provides a framework for consistent and effective records management based on established standards. It covers organisations working within, or under contract to the NHS in England. The Code also applies to adult social care and public health functions commissioned or delivered by local authorities.

Record locations

You should ensure that your organisation has technical and organisational measures in place to protect the integrity of records over their period of use and retention. These should reduce the possibility of misfiles and records being held in the wrong locations. These may include:

• technical controls to prevent unauthorised access and alteration
• training to make staff aware of the potential for error and their professional obligations when accessing and filing records
• lessons learned activities following records integrity breaches to raise awareness and address problem processes 

Records appraisal

Appraisal is the process of reviewing records at the end of their retention period to determine whether they should be kept for longer or disposed of. Appraising records at the end of their retention periods will support organisational accountability measures and help you maintain the efficiency of your records management systems by limiting records held to only those of value.

You should have a realistic plan for appraising and removing records which reflects your organisation taking reasonable efforts to remove data which is no longer necessary. A practical way of achieving this is outlined below.

Records can be categorised into suitable groups according to the systems and storage solutions where they are held (your information asset register may be a useful starting point for this). For example: 

• physical clinical records
• records stored on an electronic patient record system (EPR)
• corporate records held in cloud storage (generated through Microsoft Office 365 services, for example)
• health records held in cloud storage (generated through Microsoft Office 365 services, for example)
• patient data held on bespoke clinical systems

For each record group, an appraisal approach can be outlined which takes into account the:

• technical capabilities of storage solutions and systems for removal
• staff resources available for manual review and removal of records wherever this would be needed
• risk of retaining the records 

Your organisation’s approach to appraisal and removal for each records group could then be documented, signed off by the relevant committee, and any residual risks associated with ongoing retention of records which may have elapsed their retention periods accepted by your SIRO to demonstrate achievement of the outcome.

Records disposal

There are several ways you might dispose of records after appraisal, depending on how they have been stored by your organisation.

Disposal methods are explained in the Records Management Code of Practice 2021, but the ones you are most likely to come across are:

Destruction of digital records - destruction implies a permanent action. Any destruction of hardware, hard drives or storage media must be auditable in respect of the information they hold. For further information including on the standards for secure sanitisation. See B3.e media/equipment sanitisation and National Cyber Security Centre guidance.

Putting records beyond use - if a system doesn’t allow permanent deletion, then reasonable efforts should be made to remove the record from normal daily use. It should be marked in such a way that anyone accessing the record can recognise it as a dormant or archived record.

Destruction of paper records – paper records selected for destruction can be destroyed, subject to following ISO 15489-1:2016. Destruction can be conducted in-house or under contract with an approved offsite company.

Whatever disposal method is used, your organisation should maintain evidence of: 

• what information was disposed of
• when the disposal took place
• the method used
• the individuals responsible for authorising and carrying out the disposal

This helps demonstrate compliance with records management requirements and provides assurance that records have been disposed of appropriately and in line with approved retention schedules.

See B3.e Media/equipment sanitisation for more information relating to reuse, repair, disposal or destruction of devices, equipment and removable media. 

Destruction via third party suppliers

Where records are stored, processed or disposed of by a third-party supplier, your organisation should obtain appropriate evidence that disposal has been carried out securely. 

The form of evidence will depend on the nature of the service being provided and the level of assurance that can reasonably be obtained. For example: 

• records destruction providers may provide certificates of destruction 
• cloud and software-as-a-service (SaaS) providers may instead provide contractual commitments, audit reports, service documentation, or written confirmation that data will be or has been deleted 

Any evidence provided by the supplier should be retained alongside your records of your own internal disposals to demonstrate that reasonable assurance has been obtained.

Supporting evidence

To support your response, you can upload (or link to) evidence which best demonstrates your achievement of the contributing outcome. Examples include: 

• records management policy or equivalent
• evidence of processes in place to reduce the probability of records being filed in incorrect locations
• record keeping system 
• retention and disposal process 
• documented evidence of records disposed of 

This is not an exhaustive list. You're welcome to provide other types of evidence if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate.

Interpreting indicators of good practice

Additional guidance

For additional guidance, see:

NHS England | Records Management Code of Practice

Overview

This contributing outcome relates to your organisation evaluating and improving its coded clinical data.

Data quality

You should have regard to relevant information standards, data quality sources and related resources to inform your internal policies, processes and procedures for data quality. 

This is important to ensure that collection of data is consistent throughout the NHS and other care providers. It also supports the flow and quality of information used, so that health and care professionals are presented with the relevant information where and when it's required to provide effective care and treatment to service users.

See detailed data quality guidance for more information. 

Clinical coding

Organisations depend on clear, accurate coded clinical data to provide a true picture of patient hospital activity and the care given by clinicians.

Coded clinical data is important for:

• monitoring provision of health services across the UK
• research and monitoring of health trends
• NHS financial planning and payment
• clinical governance

See detailed clinical coding guidance for more information.

Training

Training for clinical coding has set standards for:

• the time frame in which it's completed
• the materials used to support it
• who is eligible to undertake national courses

See detailed clinical coding training guidance for more information.

Audit

There are established procedures in place at acute and mental health trusts for regular quality inspections of the coded clinical data for inpatient and day case episodes. These are undertaken by approved clinical coding auditors using and applying the latest version of the ‘Terminology and Classifications Delivery Service’ Clinical Coding Audit Methodology to demonstrate compliance with the clinical classifications OPCS-4 and ICD-10.

See detailed clinical coding guidance for more information.

Supporting evidence

The documents which may be appropriate to review and upload in support of your response to this contributing outcome could include:

• clinical coding policy 
• clinical coding practices 
• clinical coding audit documentation