Data Retention Policy

Under the NHS Records Management Code of Practice audit records must be kept for at a minimum 5 or 6 years. Here is where you can look at the retention schedule:

http://www.scotland.gov.uk/Publications/2008/07/01082955/7

Each NHS Board is responsible for specifying its own data retention policy. In ANNEX D - 'THE MANAGEMENT, RETENTION AND DISPOSAL OF PERSONAL HEALTH RECORDS it states:

Each organisation must produce its own retention schedule, specifying the locally agreed retention periods, in the light of its own internal requirements. Organisations must not apply to any records a shorter retention period than the minimum set out in this schedule, but there may be circumstances in which they need to apply a longer retention period. Organisations should ensure that they are able to justify, particularly in terms of the Data Protection Act when applicable, the retention of records for longer than the minimum period set out in this schedule.
Electronic versus paper:

Provided that the electronic data :

  1. is backed up securely;
  2. it will continue to be routinely accessible throughout the period of retention; and
  3. all the information on the paper forms is also stored in the electronic data; then it is not necessary to keep paper copies as well.

Note this last point. If you make any notes on a form that are not recorded word for word in the electronic record, then the electronic and patient records are no longer copies of the same information and separate minimum retention periods must be applied to both. For example, if you write details of patient movement on a form to make it easier to find the notes, but do not enter that into SSCAS, then you must keep the form.
The retention schedule documents are always open to interpretation to a certain extent as they cannot possibly cover every single record-type.
Lothian Stroke Care audit data retention policy

Section 1: Minimum Retention Period

National policy requires that data should be retained for a “Minimum Retention Period”. The Minimum Retention Period is not clear, but may be either 5 years or 6 years. As it is not clear, we should work with a 6 year Minimum Retention Period.

Data in the audit are in two forms. Initial data collection is on paper forms, transferred to electronic storage as soon as practical. Regulations only require one version of the data to be kept for the Minimum Retention Period, provided that it is securely stored in such a manner to minimize risk of loss.

Actions to comply with the regulations:

  1. We will retain the electronic version for a minimum of 6 years. It will be kept on an NHS Lothian server which is included in the standard back up service.
  2. Paper forms will be kept until the data on them have first been published in the relevant National Report. They will then be securely destroyed.

Section 2: Beyond the Minimum Retention Period

The regulations require that justification must be given for retaining data beyond the Minimum Retention Period. This justification must be reviewed at least annually beyond the Minimum Retention Period for any particular data.

We intend to keep data indefinitely (subject to review) for the following reasons:

  1. To facilitate review of stroke care in Lothian over a longer period of time.
  2. To ensure service changes are achieving the desired effects over the longer term.
  3. To enable us to conduct analyses of situations where numbers of cases would be inadequate unless many years data are aggregated.
  4. To be able to conduct analyses of data for changes in patient population over longer periods of time.

We will review these justifications annually immediately after the publication of the National Report.