Managing NHS Records and Data

The NHS is in transition. Organisations are transferring services and functions to new NHS bodies.  Is your Information Asset Register up-to-date?  Are your organisation’s Information Governance plans ready?

The Department of Health has published guidance for organisations transferring services and functions to new bodies.  ‘NHS Information Governance: Effective Management of Records during a period of transition or organisational change’ is essential reading for those responsible for managing NHS organisations through the current period of transition.

The guidance suggests that transferring organisations should:

  • Ensure that their information asset register is up to date – it is important to know what you hold before decisions are made as to where it should go.  This should be used to produce an information inventory, identifying how the records are used and what will be happening to them in the future.
  • Make decisions relating to records early in the process, with sufficient resources and senior management support being provided.
  • Prepare agreements outlining the terms of the transfer, giving clarity as to which organisation is responsible for what. The general rule is that where functions transfer to a new organisation, the related records should too.
  • Ensure that the receiving organisation has appropriate information governance structures in place.

Bear in mind that the transfer of records is only one option.  Organisations should also consider whether the particular records should be destroyed or archived instead.  The NHS has a long history, and SHAs may hold a large number of records inherited from previous organisations that do not have any clear successor.  Organisations are directed to consider whether there is a duty to transfer the records to a Place of Deposit under the Public Records Act 1958.

Where the records to be transferred include personal data, it is important to ensure that the necessary Data Protection Act registrations with the Information Commissioner are up to date and reflect the change in functions.  It will be necessary to ensure that any successor organisation receiving patient data complies with the requirements of the Information Governance Toolkit, and there must be an adequate plan for informing patients about the change.  The steps suggested range from information notices in appointment letters where the responsibility remains within the NHS, through to writing to each patient in advance if the service is transferring to a private sector supplier.

Where both active and inactive patient records are to be transferred, the guidance suggests that the inactive records should not be shared with the new organisation if at all possible, as there would be no need for the receiving body to hold inactive patient records.  In such circumstances, the guidance stresses that the inactive records should be archived so as to allow the easy tracing and re-activation if required.  The guidance recognises that in some instances it will simply not be practicable to separate inactive patient records from active files, in which case it advises that the transfer of all records to the new body would be justified in the public interest – provided that steps are taken to ensure that the records are only accessible on a ‘need to know’ basis.

An organisation may hold some patient records in its own right, with another organisation’s archived patient records.  This often causes confusion as to which organisation is the data controller.  It is important to understand that it may be that both organisations are data controllers of such information, irrespective of what labels have been applied in any transfer agreement.

The transfer of information between NHS organisations in transition can involve particular issues in specific fields.  Look out for further Hempsons updates including a consideration of data protection issues in the employment setting.