Data Protection Housekeeping Guidance

Your new organisation will provide you with a new personal email address and access to its email system. MCFT will provide them with a copy of your current mailbox (eg. Calendars, Inbox, Sent Items, sub-folders, contacts and tasks) on 1 April 2024 so you will continue to have access to your old files, appointments, calendars and contacts.

You must ensure you have reviewed your mailbox(es) before this date, following the housekeeping guidance below.

• Shared mailboxes (both Trust and NHSmail) that will need to be move transferred must be identified and notified to IT to ensure they are included in the transfer.  nhs.net mailbox will not transfer to the ICB as the ICB mailboxes are secured/accredited, staff advised to forward all relevant emails from nhs.net accounts to folder within current MCFT nhs.uk accounts
• Shared Trust mailboxes will be closed down in Mersey Care and out of office will be added and mailbox monitored by admin resource within Mersey Care for a specified timeframe. The ICB will open up a new shared mailbox account and staff advised
• Shared NHSmail mailboxes will be deactivated by MCFT.

Files held on personal drives (eg ‘H’ drive) or shared drives (eg ‘G’ or ‘T’ drives) will be automatically transferred as long as they are stored in the appropriate folder. Further guidance on this will be given at the time of the transfer.

It is often the case that things like accommodation moves and service transfers expose the need to have a good sort out of records and information in the office prior to the change taking place.

However, accommodation moves or service transfers shouldn’t be the only reason for sorting out your records and information; it should be part of a regular process. Many staff feel they do not have time to manage their records properly but the management of the records and information that you create and use should be part of your everyday work and not an exception.

A clear-out or a ‘Housekeeping Day’ is a good place to start. This means sorting through and only retaining those documents/records/information, which you absolutely need, that are necessary and not excessive, and appropriately disposing of those you don’t. This includes both paper and electronic information.

However, staff must be aware of the requirements of current national and local inquiries, such as the Independent Inquiry into Child Sexual Abuse, the Infected Bloody Inquiry and the Kirkup Review. Patient records and documents such as reports, reviews, briefings, minutes; notes and correspondence, however held (eg paper, electronic, microfiche, audio, video and any other means), that are potentially relevant to the Inquiries must not be destroyed.

For further information please contact records@merseycare.nhs.uk

A housekeeping session should not just happen, but should ideally be planned in advance so that time is set aside to complete the activity.

Think:

• When will it take place? (Avoid the school holidays when more staff may be on leave, unless you work in a team where you have more opportunity to have a housekeeping session during the holidays.)
• Consider whether to have a full or half day.
• Let everyone know that needs to know or should be involved.
• The Information Asset Owner and/or the Information Asset Administrator (IAO/IAA) for the assets of the service and team respectively should oversee and lead the housekeeping session.
• Get all relevant managers and team leaders involved: they need to manage their information and records too.

What will everyone do?

• Create checklists of what you wish to achieve – both as a Team and individually.
• For teams – split into groups or assign responsibilities if this works best, with each having a different task or particular part of the office or shared drive space to work on.
• Individuals – think about what you hold in your own work area, desk, locker, computer/laptop, laptop bag/work case, filing cabinet/cupboard, drawers, etc.
• Some of the information themes to consider is anything that is held on email, paper, shared drives and archive storage: For service transfers specifically:

- information relating to active patients,

- information relating to staff subject to TUPE,

- information that is relevant to you (ie your appraisal documentation) and the service (ie audit reports) that are transferring, and

- information relating to business decisions or other non-clinical (corporate) records.

Who else needs to know?

• Alert the Trust’s Estates and Facilities Team that there may be extra general waste and confidential waste for collection and disposal
• Alert the Trust’s Records Team as you may have clinical/corporate records to transfer or archive and some may need to be reviewed prior to transfer
•  If you’re going to be working in dusty, cramped conditions, arrange for the use of protective clothing (eg gloves, overalls etc).

On the Day

• You may wish to dress ‘down’ (with prior agreement from your line manager)
• Make sure that there are plenty of refreshments
• Stay calm – it is likely to be a big job!

Policies to read first:

1. Waste Management Policy (SA22)
2. Health Records Policy (IT06)
3. Corporate Records Policy (IT04)
4. Confidentiality and Data Sharing Policy (IT10)
5. Corporate Data Protection Act 2018 General Data Protection Regulation Policy (IT14)

Use:

Use the Records Management Code of Practice for Health and Social Care 2021 retention schedules to help you decide what to get rid of – do not keep anything ‘just in case’. This is deemed unnecessary and excessive and will not comply with Data Protection law which requires data minimisation and storage limitation.

You are most likely to find that you are holding some information that is beyond its retention date and can therefore be appropriately disposed of.

NHSX_Records_Management_CoP_V7.pdf (england.nhs.uk)     

This does not currently apply to certain records required by the national inquiries. See ‘Preparing for Transfer – Good Practice and Housekeeping’ above.

Throw out:

• THINK FIRST – is it confidential? Is it a vital business record?
• Any out-of-date trade or professional magazines, supplies catalogues, marketing material, etc.

Keep:

• Only keep information that is essential and business critical
• Relevant and/or up-to-date trade or professional magazines, supplies catalogues, marketing material, publications, etc, in a managed team central resource library or shared folder.

Check:

• Any paper document or piece of information that contains person confidential data must be disposed of securely via confidential waste. If in doubt contact the Records Team (contact details are at the end of this guidance)
• Duplicate records (1) – paper records that have been scanned should be confidentially disposed of as soon as the scanned copy is quality checked. Keeping the paper copy after this is considered duplication of records.

Keep a record:

It is recommended that you keep a list of the records/document/information both paper and electronic you are getting rid of, giving the reason and date of disposal – this will act as an audit trail and can be used for reference should there be any future queries or requests in relation to one of those items (eg a deleted email or document).

Confidential waste:

• Separate personal/sensitive records from other paper waste and dispose of accordingly (ie personal/sensitive records must be disposed of in confidential waste sacks and confidential waste bins, and not general waste sacks and bins)
• Do not leave bags of confidential waste out in corridors as they will be accessible to other staff, patients and contractors. They must be locked away until collected by the confidential waste contractors
• Request additional confidential waste sacks or bins if needed in advance of the housekeeping session.

Electronic documents:

• When sorting the shared drive (eg ‘G’ or ‘T’ drives) for a service transfer, arrange the information into separate folders (eg data to be transferred, data to be retained and data to be deleted) as this method can help to make the final transfer process run smoother. The Records Team will supply an inventory form.
• Only information pertinent to the transfer should be held in the transfer folder (eg team leader personnel information such as supervision notes or other information not held in ESR which may be relevant to the continuity of local management of staff and for HR management by the new provider. Also, patient information which is not part of the patient care record but may still be required for continuity of care of a particular patient).
• An additional control to consider is around specific team manager’s folders to ensure that they do not get transferred into the main team shared drives if they contain confidential information.
• Delete duplicate electronic records from your team shared files and folders. If you genuinely need more than one copy, decide which version is the Master and create shortcuts to it if required.
• Delete multiple draft versions: once completed it’s the final version(s) that count as the formal record. You are less likely to give out-of-date and inaccurate information by retaining the final version(s).
• Remember your personal drive (eg ‘H’ drive). The only files needing to be retained on your personal drive should be work related and personal to you (eg a copy of your recent appraisal or update with your manager). Files that contain staff or patient identifiable data or key business information should not be stored in a personal drive.
• Confidential folders can be created on the main network drive, which can be accessible to appropriate staff who also require access to this information. Log a job with the IT Service Desk advising the file path and the names of the staff who should have access.
• Remember your computer hard drive (eg. ‘C’ drive) and any files saved on your desktop. Use of your computer or laptop hard drive is against the Trust’s policies and therefore must not be used. If, however, you have been using your hard drive you should be aware that this is not backed up; if you lose it, there’s no means of retrieving it. Any data must be transferred to the appropriate shared/personal drive immediately.
• If the Team uses any shared passwords for documents, these should be noted and handed over the new organisation.