As therapists you will keep a lot of personal information on your patients (name/address/ date of birth etc.) You will also be keeping medical records. Do you know when you need to dispose of this data and what you need to do if a patient requests that the information you keep is erased?
Being able to make and maintain records is a requirement of HCPC registration. Keeping detailed records is a requirement of CSP membership
All record keeping is governed by the Data Protection Act 2018. This is the UK’s implementation of the General Data Protection Regulation (GDPR).
Under GDPR regulations data must only be kept for as long as necessary for the original reason it was collected. The legal requirement to retain records for a certain period relates to the legal period for bringing civil claims under either Personal Injury law or Contract law as defined by the Limitation Act 1980 and The Limitation (Northern Ireland) Order 1989.
Each UK country sets out minimum retention periods for NHS health records. The minimum retention periods apply to all formats/mediums which contain components of information relating to the health record. Although the retention periods quoted apply to the health departments in the devolved nations, private practitioners would be advised to apply the same retention periods.
Retention schedules vary according to the type of record. In general, retention schedules are:-
● for those with capacity eight years from the date of the last treatment
● for adult records, and for children eight years after their 18th birthday or until 25 years of age.
● Other types of records may need to be stored indefinitely e.g. long term chronic ongoing treatment cases – the notes must document the reason for this retention
● Records from any clinical trials may be subject to a different retention period, this needs to be adhered to and referenced in the medical record.
● Pharmaceutical records may have differing retention periods – this needs to be checked and documented alongside the prescription.
● HR records should be retained as per HR standards and regulations.
● Administerial record retention should follow the relevant standard e.g. GDPR, accounting rules etc. (CSP)
Once the retention period has expired you must securely destroy and dispose of the records. This can be carried out using a shredding company, burning on a fire or by using a cross shredder.
A record of the destruction of records, showing their reference, description and date of destruction should be maintained.
The Information Commissioner’s Office (ICO) gives the following information in relation to patient notes and the right to be forgotten.
“The right to erasure, also known as the right to be forgotten, is not an absolute right. Individuals will have the right to request that their personal data is erased, however you will need to take the context into consideration.
If you have a legal obligation to hold this information for a certain amount of time (in this example, 8 years) then this would be your justification for refusing to comply with the right to erasure request.
As you have a legal obligation to hold the notes for 8 years, you will not be required to erase this information. However, you may wish to consider if there is any other personal data which you no longer require, and erase this accordingly.
One other area to consider is the storage limitation principle. Stating that you should not hold the personal data for longer than you need it, you should look to erase the information after the 8 years has elapsed.”
References:
The Information Commissioner’s Office (ICO)
Medical Defense Society
The Chartered Society of Physiotherapy(CSP)
To stay up to date with HCPC compliance click here.
