There are a range of guidance documents (for example the Information Commissioner’s Use and Disclosure of Health Information) that interpret statutory requirements and there may be staff within organisations who have special expertise in, or can advise on, particular types of disclosure.
DoH and the HSC has developed a protocol for sharing service user information for secondary uses and a data access agreement template.
Personal Data Guardians or their support staff should be involved in any proposed disclosure of confidential patient information, informed by and in accordance with the DoH, Code of Practice on Protecting the Confidentiality of Service User Information.
Data Protection officers may be available to advise on subject access requests by members of the public.
Guidance documents and additional materials on Freedom of information and Data Protection can be found on the Information Commissioner’s website.
The mechanisms for transferring records from one organisation to another should also be tailored to the sensitivity of the material contained within the records and the media on which they are held.
Information Security staff should be able to advise on appropriate safeguards.
The protocol for the hospital transfer of patients and their records should be adhered to when hospital patient records are being transferred.
The regional discharge and patient transfer protocol for patients with clostridium difficile infection should be adhered to as appropriate.
Retention and disposal arrangements
Detailed guidance on retention periods for a full range of records is provided in Part 2 of GMGR.
This guidance applies to electronic and paper records.
It has been agreed with PRONI who have identified records which they want to permanently preserve and records which are to be reviewed, to give Organisations and PRONI the chance to determine their evidential or historical importance at a later date.
The classes of records to be reviewed will involve a consultation between PRONI, and Organisation medical and records management professionals.
All Organisations are required to have internal procedures to ensure records listed for permanent preservation are transferred to PRONI, records listed for destruction are destroyed and records requiring review are reviewed.
It is particularly important under Freedom of Information legislation that the disposal of records – which is defined as the point in their lifecycle when they are either transferred to PRONI or destroyed – is undertaken in accordance with clearly established policies which have been formally adopted by the organisation and which are enforced by properly trained and authorised staff.
The principles governing the closure and subsequent retention of electronic records are identical to those for paper records.
If a file is to be deleted, then it is the data controller’s responsibility to ensure it is also deleted from any back-up systems.
Information in a deleted file or in a back-up, whether a server, disc or tape, may be regarded as being held by a public authority for the purposes of the FOIA depending on the particular circumstances of the individual case.
The ICO position on this issue has been modified in the light of the Information Tribunal decision in Mr P Harper v The Information Commissioner EA/2005/0001.
Similarly, individual rights of access to their personal information can also be invoked if data has not been securely deleted from all systems.
A public authority should consider how to keep a record of information held in this way and whether there are practical steps required to recover it.
Information that has been deleted or sent to a back-up server is not likely to be readily retrievable for business purposes and retrieving it may not be a practical option.
However, each public authority should consider what information in deleted files is still held, what information is held in back-ups and what steps are needed or required to retrieve it.
Transfer of paper records to PRONI
When an Organisation is ready to transfer files to PRONI, its Records Management Officer should contact PRONI giving contact details and a brief description of the records due to transfer.
PRONI will then forward a schedule for completion.
The schedule will be the Organisation’s record of the transferred files and should be completed in detail (the reference number, file title, covering dates, and the terms of access to the file).
A decision on the terms of access for each file needs to be made prior to transfer and this should be recorded on form PR14 (available from PRONI) to accompany every file, or in some cases, classes of records, if appropriate.
Any queries about access should be referred in the first instance to the Records Management, Cataloguing and Access Section, PRONI.
Arrangements should be made with PRONI to agree a convenient time and date to transfer the records.
See also Part 2 of the Lord Chancellor’s Code of Practice on the management of records issued under section 46 of the Freedom of Information Act 2000 which specifically relates to the transfer of public records.
PRONI will accept records for transfer when the completed schedule and access terms have been agreed.
You and your contact in PRONI should check off the files against the schedule when the files are being transferred, sign the schedule and each retain a copy.
Transfer of electronic records to PRONI
Electronic records deemed suitable for transfer for permanent preservation should be managed by the originating Organisation.
As such the records should be maintained in live servers/environments until transfer can take place.
Those records not required by PRONI for permanent preservation should be destroyed as soon as their business need comes to an end.
While the Disposal Schedule in Part 2 applies to both electronic and paper records, the creation of electronic disposal schedules within an Electronic Document Records Management System may require a separate project to ensure their operational viability.
The transfer of electronic records from Organisations to PRONI will be governed by a set of policy documents, including a digital preservation strategy.
Organisations who have already implemented electronic record keeping systems should contact PRONI for the advice and guidance required to plan for the transfer of records.