Medical records

WQ.2/2023

WRITTEN QUESTION TO THE MINISTER FOR HEALTH AND SOCIAL SERVICES BY DEPUTY T.A. COLES OF ST. HELIER SOUTH

QUESTION SUBMITTED ON MONDAY 16th JANUARY 2023

ANSWER TO BE TABLED ON MONDAY 23rd JANUARY 2023

Question

Will the Minister provide details of the policy within the Health and Community Services Department in relation to third party data handlers who are responsible for the removal, storage and destruction of medical records from the General Hospital, in particular in relation to -

1. the criteria required for appointment as a data handler;
2. the level of screening applied to all employees of the data handler;
3. the Standard Operating Procedures for all areas
4. the regularity of risk assessments carried out, both personal safety and security risk; and
5. the frequency of on-going security checks and due diligence carried out and at what intervals to ensure compliance with the policy?

Answer

(a) & (b) Off-site storage providers are required to comply with a number of standards in relation to data handling. Storage suppliers are expected to broadly conform with the UK National Archive standards for record repositories and requirements for off-site storage of physical records. Providers are expected to:

Report damage or loss of records and any incidents in relation to the records stored by Health and Community Services.

Isolate Health and Community Services’ records from any other storage activity undertaken by the provider.

Ensure that potential hazards from external sources, including neighbouring properties, are carefully assessed and appropriate defensive measures taken.

Protect the building, which must be robust, brick, stone, or concrete, from unauthorised entry, fire, flood, or damp. It should also be protected from dust, pollutants, and pests, with an intruder and smoke alarm fitted.

Restrict access to records to an authorised provider and Health and Community Services employees.

Ensure that the identity of visitors to the site is recorded and in line with access protocols.

Maintain an auditable tracking system when handling Health and Community Services records.

Off-site storage provider staff, who have access to, and handle Health and Community Services’ records, are required to undertake checks to verify their identity, work status, a review of their employment history and criminal record.

All organisations, and their employees, are responsible for ensuring they comply with Data Protection (Jersey) Law 2018.

3. The Standard Operating Procedure outlines the responsibilities of Health and Community Services employees when engaging and interacting with off-site storage providers. Responsibilities include ensuring that:

No patient identifiable information is recorded on the outside of boxes.

Records are retained that document the contents of the boxes, and relevant retention periods. These records must be updated as and when necessary.

Arrangements are made with the appropriate off-site storage provider employee.

The retrieval of records, where the records become active or required for Health and Community Services activity, is managed by authorised personnel and in line with the tracer card.

Follow the access protocols adopted by the off-site storage protocol.

4. There is regular engagement with off-site storage providers. The personal safety of employees is the responsibility of the off-site storage provider, and the standards as outlined in the answer to (a) are maintained.
5. Health and Community Services is currently working with the Records Transformation Programme to review, rationalise and manage records stored within the department, and with off-site storage providers. Currently in the discovery phase, we are identifying records, and developing protocols in order to manage the records appropriately. The Programme team has also reviewed off-site storage and is in the process of renewing the standards expected of any provider. Thereafter, resource will be available to develop and implement processes that will see either the application of retention schedules, the transfer of records to Jersey Archive, the scanning of active health and social care records, or continued storage.

This programme of work will see both a reduction in the reliance of Health and Community Services on off-site storage providers, therefore reducing the associated risks, and a more efficient, and accessible health and social care digital record, reducing delays in accessing records for healthcare professionals.