Records Management Code of Practice

1. Purpose and scope

This Code of Practice sets out the standards and procedures that Hillcrest Neuro Clinic applies to the creation, maintenance, storage, retrieval, and disposal of all records — clinical and administrative — in accordance with the NHS Records Management Code of Practice 2021, UK GDPR, the Data Protection Act 2018, and applicable healthcare regulations.

It applies to all staff who create, handle, or are responsible for records in any format, including electronic and paper records.

2. Principles of good records management

All records created and maintained by Hillcrest Neuro Clinic must be:

• Accurate — reflecting a true account of events, decisions, and clinical findings
• Complete — containing all relevant information required for the purpose
• Timely — created as close as possible to the time of the event or decision
• Legible — clearly written or typed and unambiguous
• Attributable — clearly identifying the author and date of creation
• Secure — protected from unauthorised access, loss, or damage

3. Clinical records

Clinical records include all information relating to a patient's care, including assessment reports, correspondence, questionnaire responses, medication records, and clinical notes. These records:

• Are created and maintained in our secure clinical management system
• Are accessible only to authorised clinical and administrative staff
• Are backed up regularly to prevent data loss
• May be shared with other healthcare providers only with patient consent or where legally required

4. Retention schedules

We follow the NHS Records Management Code of Practice 2021 retention schedules:

5. Disposal of records

Records that have reached the end of their retention period are disposed of securely. Paper records are shredded using a confidential waste service. Electronic records are permanently deleted in accordance with NCSC guidance. A record of disposal is maintained.

6. Subject access requests

Patients and other data subjects have the right to request access to records held about them. Requests should be submitted in writing to [email protected]. We will respond within one calendar month in accordance with UK GDPR requirements. Further information is available in our Privacy Policy.

7. Responsibilities

The Clinic Director is responsible for ensuring compliance with this Code of Practice. All staff are responsible for creating and maintaining accurate records in accordance with these standards. The Data Protection lead is responsible for overseeing compliance with UK GDPR and the Data Protection Act 2018.

8. Review

This Code of Practice will be reviewed annually and updated as necessary to reflect changes in legislation, NHS guidance, or organisational practice.