Records Management Code of Practice

Records are an essential part of health and care. Records include:

• the notes which the health and care professionals caring for you take about your care
• information which is used to run the NHS and social care (for example human resources records of the staff that care for you and the minutes of your hospital’s board meetings)
• information used for research (for example information about clinical trials)

Records come in different shapes and sizes. For example, a record may be a letter on paper, an email, a photograph, an X-ray, a text message, or even a plaster mould. 

To help ensure that these records are all managed consistently across England, we publish a Records Management Code of Practice. This provides important information to those responsible for managing records. It includes guidance on topics such as what the law says about managing records, how to file and store records and how long records should be kept for.  

Different records are kept for different lengths of time. Most records are destroyed after a certain period of time. Generally most health and care records are kept for eight years after your last treatment. GP records are kept for much longer. However this is being reviewed to ensure they are not kept for longer than necessary once you have left your GP practice (for example if you moved abroad or died). Some records are considered valuable in the longer term, for example for research. They can also enable the public to understand how an organisation worked in years to come. This includes records such as patient surveys. 

You have a right to obtain a copy of your personal data. This is commonly referred to as "subject access". You can obtain a copy of your personal data by making a Subject Access Request.

Everyone within a health and care organisation is responsible for managing records appropriately. It is therefore important that you understand how records should be managed - how records are created, maintained and disposed of appropriately.

The Records Management Code of Practice provides a framework for consistent and effective records management based on established standards. It covers organisations working within, or under contract to, the NHS in England. The code also applies to adult social care and public health functions commissioned or delivered by local authorities.

It includes topics such as legal, professional, organisational and individual responsibilities when managing records. It also provides guidance on the storage, retention and deletion of records. Different types of records should be kept for different amounts of time and the Records Management Code includes a retention schedule which sets out how long each type of record should be kept.  

The code is mainly written for those who are designated as responsible for records management within your organisation. This may be a records manager in a trust, a practice manager in a GP surgery or the person who has responsibility for records management in their role at a local authority. However even if this is not a core part of your role, as someone who works in a health and care organisation you should ensure the following: 

• You undertake appropriate training and understand your personal responsibilities. You should not handle any patient or service user records until your training has been completed. The training may be provided by your organisation, for example a hospital trust or care home provider, or may be provided by your department, such as a radiology department.
• You read and apply your organisation’s policy on managing records.
• You understand your professional obligations and adhere to the record keeping standards defined by your registrant body, for example by the General Medical Council,  the Nursing and Midwifery Council or Social Work England.
• You understand the Caldicott Principles and how to apply them.
• You know who is responsible for records management in your organisation in case of any question or query. In smaller organisations this may be a care home manager or practice manager.  In larger organisations the member of staff should usually report to the board.

The Records Management Code of Practice is an important document for records managers working in the NHS and adult social care and should be used as a basis for your own organisation’s records management policy. It covers:

• scope: what is a record and what records are covered
• records management obligations including legal, professional and management obligations
• organising and storing records including periods for retention

Your organisation should have a designated member of staff of appropriate seniority (for example care home manager or practice manager) who leads on records management. This role should be formally acknowledged and communicated throughout the organisation. Sometimes this role is part of the information governance team. If you have any record management responsibilities it is important that you read the Records Management Code of Practice and apply the guidance in your organisation. Each organisation must have an overall policy statement on how it manages all of its records. This statement must be endorsed by the operational management team, board (or equivalent), and made available to all staff at induction and through regular updates and training.

It is also important to note that there are currently a number of ongoing inquiries including the UK Covid 19 Inquiry and the Infected Blood Public Inquiry. This means that records must not be destroyed until guidance is issued by the relevant inquiry. Future inquiries may lead to specific records management requirements. If that happens we will publish additional guidance on our website.