GDPR – Records Management Policy

The practice is committed to complying with the statutory and professional guidelines including, but not limited to, Access to Health Records 1990, Caldicott Guidelines 1997, the Data Protection Act 2018, the Freedom of Information Act 2000, the Public Interest Disclosure Act 1998 and current guidelines from the General Dental Council.

Patients can be confident that their personal records, including medical records, are accurate, fit for purpose, contemporaneous, held securely and remain confidential and that other records, kept to protect their safety and well-being, are maintained and held securely. This policy applies to all team members and is maintained by TDA.

The practice:

• Will keep records securely and confidentially.
• Will not keep records for longer than necessary.
• Will store records in a secure, accessible way that allows them to be located when required.
• Will securely destroy records at the end of the retention period.
• If using a data processor, have sufficient guarantees regarding information security; take reasonable steps to ensure compliance with those measures; and have an appropriate contract.

This policy relates to the following records:

• Clinical records, including medical history forms, radiographs, consent forms, photographs, models, audio or visual recordings of consultations, laboratory prescriptions, referral letters.
• Accident records.
• Administration records, including personnel, financial, accounting, contracts, litigation and complaint handling.
• Risk assessments and audits, including health and safety, COSHH, fire safety, etc.
• Keep any other records as required by authorities such as the GDC, RQIA, HIW, HIS and other regulatory bodies.

All records are:

• Factual, consistent and accurate.
• Noted immediately after the event has occurred and therefore, contemporaneous.
• Noted clearly in a way that cannot be erased.
• Documented in such a way that the author and date of any amendments can be identified.
• Free of jargon, irrelevant speculation and offensive comments.
• Readable on scanned or photocopied images.

All team members follow the guidelines of record retention and the practice policies of confidentiality, archiving, and secure destruction.

Retention Period

Clinical records are retained for 10 years unless the treatment was complex or particularly difficult for patients, in which case for up to 30 years.

Paper records are disposed of by incineration or shredding, followed by secure disposal or fire with appropriate safeguards for confidentiality during the procedure.

Electronic records are destroyed by secure file shredding or physical destruction of the storage media. Where the practice cannot delete clinical records from patient software, the practice:

• Will not attempt to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way.
• Will not give any other organisation access to the personal data.
• Will surround the personal data with appropriate technical and organisational security.
• Will permanently delete the information if, or when, this becomes possible.

Storage of patient records if the practice closes

If a practice closes, the practice owners will consider providing details of these arrangements to their solicitor and are obliged to store records securely until the Retention Period expires (England, Northern Ireland and Wales).

Prior to the closure of the practice, the practice owners will arrange for records to be stored securely (state method, e.g. archive facility) for the Retention Period. Then, they will be confidentially destroyed unless a decision is taken to continue storage of all details of the arrangements recorded and kept.