Section 5: management of records when the minimum retention period is reached

This section covers the management of records once their business need has ceased and the minimum retention period has been reached. A detailed retention schedule is set out in Appendix II. This section includes information on the destruction and deletion of records, reviewing records for continued retention once their minimum period for retention has expired, and the selection of records for permanent preservation. It also includes information and advice about the transfer of records to Place of Deposits (PoD). Appendix I relating to public Inquiries should also be considered before destroying any records.

Appraisal is the process of deciding what to do with records once their business need has ceased and the minimum retention period has been reached. This can also be known as the disposition of records. The National Archives has produced guidance on appraisal.

Appraisal must be defined in a policy and any decisions must be documented and linked to a mandate to act (derived from the board). Any changes to the status of records must also be reflected in your organisation’s Record of Processing Activity. In no circumstances should a record or series be automatically destroyed or deleted.

When appraising records that have come to the end of their minimum retention period, you should consider the following:

Ongoing use

You might need to keep the record for longer than the minimum period for care, legal or audit reasons. In these cases, you can set an extension to the minimum period, provided it is justified and approved.

Classification of diseases (based on ICD10 code)

Some health conditions may lend themselves towards a longer, or extended, retention period.

Operational delivery

The way a service was delivered may have been pioneering or innovative at the time, which may justify an extended retention period or long-term archival preservation.

The way care is delivered

The records may be reflective of health or care policy at the time.

Series growth

If the records are part of a series that will be added to (type of record rather than additional content into existing records), you need to consider space issues in your local records store or organisation archive. For example, continued expansion of a series that is hardly recalled would not justify an extension to the retention period.

Recall rates

If a series of records is routinely accessed to retrieve records, then there may be justification for extending the retention period due to ongoing use. Whereas, for a series of records that has a very low recall rate, continued retention may be harder to justify.

Historical value

If the record has potential historical or social value (for example, innovative new service or treatment or care delivery method), then consider retaining for longer. It would also be helpful to have early discussions with your local PoD about potential accession, even if the record has ceased to be of operational value or use. PoDs will not normally accession records before 20 years retention has passed, unless there are exceptional circumstances for early transfer. The PoD must agree to the transfer PRIOR to it occurring. If early discussion with the PoD indicates the record (or series) will not be accessioned, and you have no ongoing operational use for the record or series, then you must securely destroy the record, and obtain evidence of destruction (for example, destruction certificate).

Previous deposits

The records you hold may be a continuation of a series that has historically been accessioned by a local PoD. It is important to find out what has historically been accessioned from your organisation to the PoD, so that a series of records remains complete. It is likely that records that add to an already accessioned series will continue to be taken by the PoD.

This list is not exhaustive, and organisations may have bespoke issues to consider as well.

Digital records can be appraised if they are:

• arranged in an organised filing system
• differentiated by the year of creation
• organised by year of closure
• clear about the subject of the record

If digital records have been organised in an effective file plan or an electronic record keeping system, this process will be made much easier. Decisions can then be applied to an entire class of records rather than reviewing each record in turn.

There will be one of three outcomes from appraisal:

• destroy or delete
• continued retention – this will require justification and documented reasons
• permanent preservation

All appraisal decisions need to be justified, follow policy or guidance, and be documented and approved by the relevant board, committee or group of the organisation.

If as a result of appraisal, a decision is made to destroy or delete a record, there must be evidence of the decision. It is good practice to get authorisation for destruction or deletion from an appointed committee or group with a designated function to appraise records, working to a policy or guidelines. Where the destruction or deletion process is new, or there is a change in the destruction process (such as a change of provider, or the method used), a DPIA must be completed and signed off by the organisation.

Paper records selected for destruction can be destroyed, subject to following ISO 15489-1:2016. Destruction can be conducted in-house or under contract with an approved offsite company. If an offsite company is used, the health or care organisation, as the controller, is responsible for ensuring the provider chosen to carry out offsite destruction meets the necessary requirements and can evidence this. This evidence should be checked as part of due diligence (for example, if the provider says they have the ISO accreditation, then ask for evidence of this). Other diligence activities, such as a site visit to the contractor, should also be carried out. Destruction provider companies must provide a certification of destruction for the bulk destruction of records. This certification must be linked to a list of records, so organisations have clear evidence that particular records have been destroyed.

Records that do not contain personal data or confidential material can be destroyed in a less secure manner (such as confidential waste bins that do not provide certificates of destruction). If in doubt, material should be treated as confidential and evidentially destroyed. Do not use the domestic waste or put records on a rubbish tip to destroy identifiable, confidential material, because they remain accessible to anyone who finds them. The British Security Industry Association (BSIA) has provided a guide on information destruction.

Destruction implies a permanent action. For digital records "deletion" may not meet the ISO 27001 standard as the information can or may be able to be recovered or reversed. Destruction of digital information is therefore more challenging. If an offsite company is used, the health and care organisation as the controller should check with the ISO whether the provider meets the necessary requirements, similar to the process for the destruction of paper records.

One element of records management is accounting for information, so any destruction of hardware, hard drives or storage media must be auditable in respect of the information they hold. An electronic records management system will retain a metadata stub which will show what has been destroyed.

The ICO guidance Deleting personal data sets out that if information is deleted from a live environment and cannot be readily accessed then this will suffice to remove information for the purposes of UK GDPR. Their advice is to only procure systems that will allow permanent deletion of records to allow compliance with the law.

Electronic systems will vary in their functionality. They may have the ability to permanently delete records from the system or not. Where a record that has reached its retention period and has been approved for destruction, then the record should be deleted if the system allows that function. A separate record should be kept of what record has been deleted.

If a system doesn’t allow permanent deletion, then all reasonable efforts must be made to remove the record from normal daily use. It should be marked in such a way that anyone accessing the record can recognise it as a dormant or archived record. All activity in electronic systems must be auditable, and (where appropriate) local policies and procedures should cover archived digital records.

In relation to FOIA, the ICO guidance Determining whether information is held advises that once the appropriate limit for costs incurred for that FOI has been reached, there are no more requirements to recover information held. The only exemption to this would be where the organisation is instructed by a court order.

The following are examples of when information cannot be destroyed or disposed of:

If it is subject to a form of access request, for example, Subject Access Request (SAR), FOIA request.

If it is required for notified legal proceedings, for example, a court order, or where there is reasonable prospect of legal proceedings commencing (an impending court case). This information will possibly be required for the exercising or defending of a legal right or claim.

If it is required for a coroner’s inquest.

If it is of interest to a public inquiry, for example, who will issue guidance to organisations on what kind of records they may require as part of the inquiry. Once notified, organisations can re-commence disposal, taking into account what records are required by the inquiry. If in doubt, check with the inquiry team.

The retention periods given in Appendix II are the minimum periods for which records must be retained for health and care purposes. In most cases, it will be appropriate to dispose of records once this period has expired, unless the records have been selected for permanent preservation.

Organisations must have procedures and policies for any instances where it is necessary to maintain specifically identified individual records, or group of records (clinical or otherwise) for longer than the stated minimum, including:

• temporary retention
• public inquiries
• ongoing access request, for example, where the ongoing processing of an access request cuts over the minimum retention period - it would not be acceptable to dispose of a record that is part way through being processed for an access request because the minimum retention period has been reached
• where there is a continued business need beyond the minimum retention period, and this is documented in local policy

There will be occasions where care specialties will create digital records that have different retention periods. For example, a radiology scan might need to be kept for the minimum of 8 years, and then destroyed as the record is no longer required. Yet a different image for a similar case may need to be kept for longer due to the nature of that particular case. In these situations, organisations can apply different retention times and this should be picked up at the review stage once the 8 years has expired.

Where records contain personal data, the decision to retain must comply with UK GDPR. Decisions for continued retention beyond the periods laid out in this Code must be recorded, made in accordance with formal policies and procedures by authorised staff and set a specific period for further review.

Generally, where there is justification, records may be retained locally from the minimum period set in this Code, for up to 20 years from the last date at which content was added.

For NHS individual staff and patient records that have a recommended retention period beyond 20 years (for example, maternity records), these can be retained for longer as specified in Appendix II, in this case for 25 years. The Secretary of State for Science, Innovation and Technology has approved the retention of NHS individual staff and patient records up to 20 years where this is necessary for continued NHS operational use. This may be reflected in an extended retention period beyond 20 years being mandated by the Code (such as with the maternity records). Where organisations use this provision locally to retain records for longer than 20 years, this must be documented in published policies.

It must be remembered that in some cases of health and social care, there may be gaps between episodes of care. If a patient or service user begins a new episode of care whilst their previous record is still within agreed retention periods, then these episodes of care will link, and the retention period will begin again at the end of the current episode. This may mean that some or all of the information from the previous episode will go over a 20-year retention mark, but this is acceptable as it links to a more recent care episode.

For records that are not staff or patient records, for example, board minutes, a different arrangement is in place. Where an organisation needs to keep any other type of record beyond 20 years, then approval must be sought separately from the Secretary of State for Science, Innovation and Technology. This is the case even where the recommended retention period is longer in the Code.

The only exceptions to this are records which mainly relate to information on (i) controlling asbestos including air monitoring records and (ii) ionising radiation including radioactive waste records. These types of records can be kept for the minimum retention period set out in Appendix 2 without needing approval.

Organisations should always check current legislation. Any applications for approval should be made to The National Archives in the first instance ([email protected]) 

The Public Records Act 1958 requires organisations to select records for permanent preservation. Selection for transfer under this Act is separate to the operational review of records to support current service provision. It is designed to ensure the permanent preservation of a small core (typically 2-5%) of key records, which will:

• enable the public to understand the working of the organisation and its impact on the population it serves
• preserve information and evidence likely to have long-term research or archival value

Records for preservation must be selected in accordance with the guidance contained in this Code. Any supplementary guidance issued by The National Archives and local guidance from the relevant PoD should always be consulted in advance of any possible accession. This is to ensure it is appropriate to transfer the records selected. As a rule, national organisations, such as NHS England, will accession their records to The National Archives, and local NHS and social care organisations will accession their records to the local PoD, as appointed by the Secretary of State for Science, Innovation and Technology.

Selection may take place at any time in advance of transfer. However, the selection and transfer must take place at or before records are 20 years old. Records may be selected as a class (for example, all board minutes) or at lower levels down to individual files or items.

Records can be categorised as follows:

• transfer to PoD: this class of records should normally transfer in its entirety to the PoD – trivial or duplicate items can be removed prior to transfer
• consider transfer to PoD: all, some or none of this class may be selected (as agreed with the PoD)
• no PoD interest

Other records should not normally be selected for transfer. Whilst there may be occasions where records to support research are transferred (for example, to support research into rare conditions), records should not be transferred just because they relate to research or with the sole purpose of preservation in case they could be used for future research. The Public Records Act 1958 is not designed to support the routine archival of research records. Records should not be transferred unless they specifically meet the criteria below. If in doubt, it is recommended to check with the local PoD.

Where it is known that particular records will be transferred to PoDs routinely, this should be noted in the records management policy (or equivalent) alongside the reason for the routine transfer. Likewise, one-off transfers should also be noted for reference. It is not practical to update local policies each time a transfer is made. If a particular type becomes a regular transfer, this could be added to the next update of the records management policy. It may be sufficient to publish a link to the PoD's public catalogue or The National Archives Discovery Catalogue to which data for transferred records is added annually. Where it is known a record will form part of the public record at creation, it must be preserved locally until such time it can be transferred. PoDs will know which types of records they will always take (such as board minutes).

The Tavistock and Portman NHS Foundation Trust has a policy for the selection of material for permanent preservation: a method for selecting the works of eminent clinicians’ work and a panel for selecting historical records. Where a clinician has amassed a lifetime of research or important cases these may be identified and retained.

Records of individual persons may also be selected and transferred to the PoD provided this is necessary and proportionate in relation to the broadly historical purposes of the Public Records Act 1958 and PoD agreement. For example, individual patient files relating to a hospital that is now closed and the files are coming to the end of their retention. In West Yorkshire, a hospital, which opened in 1919, closed in 1995 and in 2011 patient files were still being transferred to the local PoD to finish the series. All patient records for the hospital are now at the PoD.

Patient or service user confidentiality will normally prevent use for many decades after transfer and the physical resource will be substantial (for example, x number of archive boxes) therefore the transfer of patient or service users records should only be considered where one or more of the factors listed below apply:

• the organisation has an unusually long or complete run of records of a given type
• the records relate to population or environmental factors peculiar to the locality
• the records are likely to support research into rare or long-term conditions
• the records relate to an event or issue of significant local or national importance
• the records relate to the development of new or unusual treatments or approaches to care, or the organisation is recognised as a national or international leader in the field of medicine or care concerned
• the records throw particular light on the functioning, or failure, of the organisation, or the NHS or social care in general
• the records relate to a significant piece of published research

Any policy to select patient or service user records should only be agreed after consultation with appropriate clinicians, the group or committee responsible for records management and (if necessary), the Caldicott Guardian. This decision, and the reasoning behind the decision, should be published in the minutes of the meeting at which this decision is taken. Routine transfers of patient or service user records to a PoD can be included in the records management policy of the organisation or its equivalent.

Any records selected should normally be retained within the NHS or social care (under the terms of Retention Instrument 122) until the patient or service user is deceased, or reasonably assumed to be so and then can subsequently be transferred. Records no longer required for current service provision may be temporarily retained pending transfer to a PoD. Records containing sensitive or confidential information should not normally be transferred early, unless in agreement with the PoD. If a patient or service user expresses a wish that they do not want their health or care record transferred to a PoD, this must be respected unless the transfer is required by law.

Records selected for permanent preservation should be transferred to the relevant PoD appointed by the Secretary of State for Science, Innovation and Technology. PoDs are usually public archive services provided by the relevant local authority. Current contact details of PoDs and the organisations which should transfer to them can be found on The National Archives website. As a general rule, national public sector organisations will deposit with The National Archives, while local organisations will deposit with a local PoD. For example, NHS England will deposit with The National Archives, whereas a local NHS body or local authority will deposit with the local PoD. This could be the county record office, or a specialised facility run by local authorities for the county.

There will be a mandatory requirement to transfer some types of records whereas others will be subject to local agreement. The retention schedule included with this Code identifies records which should be transferred to the locally approved PoD when business use has ceased. There may also be records of local interest which need to be accessioned to the PoD (such as a continuation of a series already accessioned). Prior to any transfer being made, a discussion must be had with the local PoD to enable agreement on which records will be transferred and the process for doing so. (Also refer to Appendix I, which provides information about public inquiries that may impact upon the selection of records for transfer).

Transferred records should be in good condition and appropriately packed, listed and reviewed for any FOIA exemptions. Records selected for transfer to a PoD (after appraisal) may continue to be exempt from public access for a specified period after transfer in accordance with Section 66 of FOIA. For more detail on the transfer process and sensitivity review refer to The National Archives guidance.

Once transferred to the PoD, records will still be owned by the organisation transferring them and all relevant laws will apply. Individual records deposited with PoDs are still protected by the UK GDPR, FOIA and duty of confidentiality. Where records are kept for permanent preservation for reasons other than care, consideration should be given to preserving the records in an anonymised way to protect confidentiality. Where this is not possible, then consider removing as many identifiers as possible. If you are looking to preserve a record because the treatment provided was innovative or highlights new ways of working, then the identity of the patient is not required. For individual care, it would be required, as the record may need to be retrieved.

Where a local PoD (PDF) holds records and access is requested, the PoD will liaise with the depositing organisation before releasing any information (including any checks for SARs required by UK GDPR and any exemptions under FOIA). This allows for a check for any harmful information that may be in the record or if there are other grounds on which to withhold the record. Where a public interest test is required, the transferring organisation must carry this out and inform the PoD of the result. The depositing organisation must make a decision on what information to release and where information is withheld, explain the reason why (except in exceptional circumstances, for example, a court order to the PoD).

Unless there are exceptional circumstances, PoDs will not normally continue to apply FOI exemptions to records more than 100 years old.

Where a patient or service user has died the UK GDPR no longer applies but FOIA applies regardless (PDF) as to whether the individual is alive or not. The Section 41 (confidence) exemption of FOIA and the duty of confidence remain relevant so records cannot be accessed by anyone who does not have a lawful basis to view a record. FOIA decisions indicate that, in general, health and social care information will remain confidential after death.

The duty of confidence does diminish over time, but it is recommended that at least 10 years should have passed after a person's death before reviewing the consequences of relaxing disclosure controls on information about a person previously regarded as confidential. This review should consider the potential harm or distress to surviving family members of disclosing information that might be regarded as particularly sensitive or likely to attract publicity, and the risks that the disclosure might undermine public trust in the health and care system. When a person is deceased, the Access to Health Records Act 1990 may enable access to the health record for a limited purpose by specified individuals (such as the Personal Representative and those with a claim arising out of the death of the person). The Transformation Directorate of NHS England has produced guidance on access to records of deceased individuals.