Records, access, corrections, retention and information lifecycle

Manage accurate clinical records across creation, access, correction, retention, subject access and secure disposal while preserving historical integrity.

• Record information clearly, accurately and proportionately.
• Distinguish correcting an error from deleting an accurate historical entry.
• Understand the basic workflow for subject access.
• Recognise the importance of retention schedules and secure disposal.
• Protect third-party and legally restricted information when responding to access requests.

Good records support patient care, continuity, accountability and legal rights. They should be clear, accurate, contemporaneous where possible, attributable and proportionate to the clinical purpose.

Corrections should preserve the integrity of the record. Where an entry was wrong, the correction should be transparent rather than silently rewriting the historical record. Where the patient disputes a clinical opinion that was accurately recorded, the record may need an explanatory note rather than deletion.

Subject access is an individual right, but disclosure requires a structured process. Identity, scope, searches, exemptions, third-party information and the rights of others may all need consideration.

Retention periods are governed by current national and organisational schedules. The course should teach the need to use the current applicable schedule rather than memorising a single universal number.

Secure disposal is part of the information lifecycle. Paper, devices, removable media and cloud storage need controlled destruction/deletion appropriate to the risk and retention obligations.

Use CLEAR consistently across information decisions.

1. Clarify the purpose and recipient.
2. Locate the professional and legal authority.
3. Evaluate necessity, proportionality and the minimum information needed.
4. Ask about consent, objections, capacity, statutory duties or powers, and public-interest factors.
5. Record the reasoning, disclosure, advice and safeguards.

CLEAR is an educational scaffold, not a statutory legal test.

Scenario 1. A clinician discovers that yesterday’s note has the wrong medication dose documented.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 2. A patient asks for deletion of an accurate old diagnosis because they dislike how it reads.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 3. A subject access request includes emails containing identifiable information about another patient.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

• Never alter a medical record, even to correct an error.
• A patient can require deletion of any diagnosis.
• A subject access request means disclose every document unchanged.
• All NHS records have one universal retention period.

• What exactly is the purpose of using or disclosing the information?
• Who is asking, and have I verified identity and role?
• What professional, common-law, statutory and data-protection authority applies?
• Can the purpose be achieved with less or anonymised information?
• Does the patient expect this use, have they consented or objected, and does that matter in this context?
• Is there a nation-specific rule, local policy or specialist route I need to check?
• What should I document, and who should I consult if uncertain?

Optional reflection: Do not enter identifiable patient, colleague or employer information. Identify one situation in your practice where confidentiality, data protection and local governance could easily be conflated. How would CLEAR improve the reasoning?

• Clinical records should be clear, accurate and attributable.
• Corrections should be transparent.
• Accurate historical entries should not be falsified.
• A patient can challenge accuracy and ask for rectification.
• Subject access requires identity and scope management.
• Third-party rights may require redaction or withholding.
• Retention is governed by current applicable schedules.
• Secure disposal is part of confidentiality.
• Audit trails strengthen accountability.
• Record-access decisions should themselves be documented where necessary.

Check current versions for time-sensitive decisions.

• R10 - ICO: A guide to subject accessOpen official source
• R20 - ICO: Right to rectificationOpen official source
• R21 - GMC: Good medical practice: recording your work clearly, accurately and legiblyOpen official source
• R25 - Welsh Government: Managing health and social care records: code of practice 2022Open official source
• R27 - Scottish Government: Health and social care - records management: code of practiceOpen official source