This guidance has been reviewed by the Health and Care Information Governance Panel, including the ICO and NDG.

The panel exists to simplify information governance guidance. Have we done a good job? Let us know at

Records Management Code of Practice 2020

The draft Records Management Code of Practice 2020 sets out how records relating to health and care should be managed. It helps ensure that records are managed consistently across England.

We would welcome your views on this draft code through our consultation document here. The consultation closes on 11 December 2020.

Guidance for patients and service users

Records are an essential part of health and care. Records include:

  • The notes which the health and care professionals caring for you take about your care

  • Information which is used to run the NHS and social care (e.g. Human Resources records of the staff that care for you and the minutes of your hospital’s Board meetings)

  • Information used for research (e.g. information about clinical trials)

Records come in different shapes and sizes. For example, a record may be a letter on paper, an email, a photograph, an x-ray, a text message, or even a plaster mould. 

To help ensure that these records are all managed consistently across England, we publish a Records Management Code of Practice. This provides important information to those responsible for managing records. It includes guidance on topics such as what the law says about managing records, how to file and store records and how long records should be kept for.  

Different records are kept for different lengths of time. Most records are destroyed after a certain period of time. Generally most health and care records are kept for eight years after your last treatment. GP records are kept for much longer however this is being reviewed to ensure they are not kept for longer than necessary once you have left your GP practice (e.g if you moved abroad or died). Some records are considered valuable in the longer term, for example for research. They can also enable the public to understand how an organisation worked in years to come. This includes records such as patient surveys. 

You have a right to obtain a copy of your personal data. This is commonly referred to as ‘subject access’. Further guidance on subject access requests is here

Guidance for healthcare workers

Everyone within a health and care organisation is responsible for managing records appropriately. It is therefore very important that you understand how records should be managed (i.e. created, maintained and disposed of appropriately).

The Records Management Code of Practice provides a framework for consistent and effective records management based on established standards. It covers NHS and adult social care records (where the social care provision has an element of NHS funded care). 

It includes topics such as legal, professional, organisational and individual responsibilities when managing records. It also provides guidance on the storage, retention and deletion of records. Different types of records should be kept for different amounts of time and the Records Management Code includes a retention schedule which sets out how long each type of record should be kept.  

The code is mainly written for those who are designated as responsible for records management within your organisation. This may be a Records Manager in a Trust, a Practice Manager in a GP Practice or the person who has responsibility for records management in their role at a Local Authority. However even if this is not a core part of your role, as someone who works in a health and care organisation you should ensure the following: 

  • You undertake appropriate training and understand your personal responsibilities. You should not handle any patient/service user records until your training has been completed. The training may be provided by your organisation, e.g. hospital Trust or Care Home Provider, or may be provided by your department e.g. radiology department

  • You read and apply your organisation’s policy on managing records 

  • You understand your professional obligations and adhere to the record keeping standards defined by your registrant body e.g. by General Medical Council (GMC),  the Nursing and Midwifery Council (NMC) or Social Work England

  • You understand the Caldicott Principles and how to apply them

  • You know who is responsible for records management in your organisation in case of any question or query.  In smaller organisations this may be a care home manager or practice manager.  In larger organisations the member of staff should usually report to the Board.

Guidance for IG professionals

The Records Management Code of Practice is an important document for Records Managers working in the NHS and adult social care and should be used as a basis for your own organisation’s Records Management Policy. It covers:

  • Scope - what is a record and what records are covered

  • Records Management obligations including legal, professional and management obligations

  • Organising and storing records including periods for retention

Your organisation should have a designated member of staff of appropriate seniority (e.g. care home manager or practice manager) who leads on records management. This role should be formally acknowledged and communicated throughout the organisation. Sometimes this role is part of the IG team. If you have any record management responsibilities it is important that you read the Records Management Code of Practice and apply the guidance in your organisation. Each organisation must have an overall policy statement on how it manages all of its records. This statement must be endorsed by the operational management team, Board (or equivalent), and made available to all staff at induction and through regular updates and training.

It is also important to note that there are currently a number of on-going inquiries including the Independent Inquiry into Historic Child Sex Abuse (IICSA) and the Infected Blood Public Inquiry (IBI). This means that records must not be destroyed until guidance is issued by the relevant Inquiry. Future inquiries may lead to specific records management requirements. If that happens we will publish additional guidance on our website.