Scotland Records Management Code of Practice

1 SCOTTISH GOVERNMENT Records Management HEALTH AND SOCIAL CARE code OF Practice ( Scotland ) 2020 A guide to the required standards of Practice in the Management of Records for those who work within or under contract to NHS organisations in Scotland . The Scottish Government, Edinburgh 2020 2 Crown copyright 2020 You may re-use this information (excluding logos and images) free of charge in any format or medium, under the terms of the Open Government Licence. To view this licence, visit or e-mail: Where we have identified any third-party copyright information you will need to obtain permission from the copyright holders concerned.

2 This document is available from the Scottish Government Health and Care Information Governance website at The Scottish Government St Andrew s House Edinburgh EH1 3DG Produced by the Scottish Government supported by the National NHS Scotland Records Management Group. Published by the Scottish Government, June 2020 3 DOCUMENT CONTROL SHEET Title: Records Management : Health and Social Care code of Practice Date Issued: 18th May 2020 Effective From: 1 June 2020 Version/Issue Number: 202006 Document Type: code of Practice Document status: Active Author: Scottish Government lead Short Life Working Group for the RM CoP review Contacts: Elena Beratarbide, IG Policy Lead, Information Assurance & Governance Team, NHS Scotland , Health and Social Care Tracy Gill, Chair NHSS cotland Records Management Group.

3 Owner: Scottish Government, Digital Health and Care Directorate Contact: Target Audience Records Managers, Information Governance Leads, Data Protection Officers, Caldicott Guardians, Senior Information Risk Owners with responsibility to cascade to all staff Supersedes Scottish Government Records Management : NHS code of Practice ( Scotland ) Version January 2012 Distribution list : open access to this document is available via the NHS Scotland IG website publications: 4 Contents Foreword 7 Background 7 Strategic Context 8 Aims 9 Types of Records Covered by the code of Practice 9 Introduction 11 General Context 11 Regulatory Framework.

4 Legal and Professional Obligations 13 Social Care Records 14 Roles and Responsibilities 15 Roles 15 Training 17 Policy and Strategy 17 NHS Records Management and Information Lifecycle 19 Records Creation 20 Managing Records 21 Records Maintenance - Storage and Scanning 22 Records Inventory/Information Asset Register 23 Records Management Systems Audit 23 Disclosure and Transfer of Records 23 Retention and Disposal Arrangements 24 Appraisal of Records 24 Records Closure 26 Records Disposal 26 Records Security and Business Continuity 28 Useful Guidance 29 Adopted Persons Health Records 29 Ambulance Service Records 29 NHS 24 Records 29 Asylum Seeker Records 30 Child School Health Records 30 Complaints Records 30 Controlled Drugs Regime 31 Data Processors.

5 Subcontractors and Changes in Contracts 31 Deceased Person 32 Digital Records 34 Management of Metadata 34 Naming Conventions 35 Information Asset Registers 35 Version Control for Electronic Records 35 Format on Dates 35 Access Controls 36 5 Disposal Management 36 Email Management 36 Duplication of Electronic Data 37 Distributed Records 37 Transient Records 38 Ownership of Electronic Records 38 Social Media Records 38 Scanned Records 38 Cloud-Based Records 39 E-Disclosure of Evidence (parties in litigation) 39 BYOD (Bring Your Own Device) Records 39 Websites and Intranet 39 Duplicate Records 40 Family Records 40 General Practitioner Records 41 Human Fertilisation 41 Integrated Records 42 Long Term Conditions (LTC) 43 Mental Health Records 43 Occupational Health Records 44 Oncology Records 44 Patient/Client Held Records 45 Prison, Youth Offenders & Secure Units (Mental) Health Records 45 Records Dealt with Under the NHS Trusts and Primary Care Trusts (Sexually Transmitted Disease)

6 Directions 2000 46 Specimens and Samples 46 Staff Records 46 Transgender Persons Health Records 47 Witness Protection Health Records 48 Further Guidance, Websites and Links 49 The Management , Retention and Disposal of Personal Health Records 50 Scope of Schedule 50 Responsibilities and Decision Making 51 Retention Periods 51 Disposal and Destruction of Personal Health Records 52 Decision Making 52 Disposal and Destruction 53 Interpretation of the Schedule 54 Health Records Retention Schedule 57 Core Retention Periods 58 Specialty Records Retention Periods 59 Pathology (sub-categories)

7 64 Births, Deaths & Adoption Records 65 Clinical Trials & Research 66 Cross-specialty Records 68 The Management , Retention and Disposal of Administrative Records 74 Administrative Records 76 6 Communications 76 Corporate Governance 78 Estates and Facilities 84 Financial Management 88 Human Resources 93 Information & Communication Technology 96 Annex A: Acknowledgments 98 Annex B: Standard Setting Bodies 100 Annex C: Glossary of Records Management Terms 102 7 Foreword Background 1 The Records Management : NHS code of Practice , version , was published by the Scottish Government in January 2012, as a guide to the required standards of Practice in the Management of Records for those who work within or under contract to NHS organisations in Scotland .

8 2 This document is a refreshed version for a wider setting including Health and Social Care. It is based on current legal requirements and professional best Practice . 3 This guidance has been drafted by the Scottish Government in collaboration with representatives of the Scottish Health and Social Care setting, including Records managers, archivists and information governance experts from the NHS, Local Authorities and GP practices . 4 This 2019 update specifically takes into account the Public Records ( Scotland ) Act 2011, the Public Bodies (Joint Working) ( Scotland ) Act 2014, the Children and Young People ( Scotland ) Act 2014, the Multi Agency Public Protection Arrangements (MAPPA), the Health Board Provision of Healthcare in Prisons ( Scotland ) Directions and recommendations for Records Management from key recent public inquiries, particularly the Scottish (Historical) Child Abuse Inquiry (2015).

9 This review also takes in the requirements of recent changes to the following: Data Protection legislation1, NHSS Information Security Policy Framework (2018 and 2019) 2 and the extended powers of the Information Commissioner s Office (ICO)3, 5 It s recognised that the culture within the health and social care context is changing as a result of greater service integration driven by the Digital Health and Care Strategy 2018. Together with the natural evolution towards a digital paper lite environment, and the use of portals for health and social care groups, clinicians and patients.

10 This Records Management for Health and Social Care 1 General Data Protection Regulation (EU) 2016/679 ( GDPR ) 2 Scottish Government and 2019 Framework 2018 Information Security Policy Framework and 2019 Framework 3 Information Commissioner s Officer (ICO) 8 code of Practice 2019 (from this point onwards referred to as the code of Practice ) is a guide to the Practice of managing Records . It is relevant to organisations who work within, or under contract to NHS organisations in Scotland . This also includes public health functions in Local Authorities and Social Care where there is joint care provided within the NHS.