Records Management Training: You Should Not Handle Records Until It Is Done

NHS England's guidance for health and care professionals on records management contains a sentence that should change how most organisations run induction:

"You should not handle any patient or service user records until your training has been completed."

That is a pre-access gate. Not training within the first month, not training as part of a six-month induction programme. Before you touch a record.

The Code, and what it actually is

The Records Management Code of Practice 2021 is the reference document for records management in health and care in England. It was published on gov.uk and is now maintained by NHS England.

Be careful about its status. NHS England describes it only as "a guide to the management of health and care records" and "a framework of guidance based on established standards." No primary source states that it is statutory.

Its practical force comes from somewhere else, and this is the chain worth understanding: the Code is guidance, and the Data Security and Protection Toolkit makes complying with it a mandatory evidence item. The Toolkit's own wording for the 2026-27 year tells organisations their retention timetable "should be based on the Records Management Code of Practice 2021."

So if you are asked whether the Code is mandatory, the accurate answer is that the Code is not, and the Toolkit item that references it is. Our guide to information governance training and the DSPT sets out which Toolkit track applies to you and which items are mandatory.

Who it applies to — including social care

The Code applies to "organisations working within, or under contract to, the NHS in England." It also covers "adult social care and public health functions commissioned or delivered by local authorities."

That second limb is useful, because it gives social care providers a records framework that does not depend on whether the Toolkit reaches them. If you deliver commissioned adult social care, the Code covers your records regardless.

The training requirement, in full

Four duties sit on the individual, from NHS England's guidance for health and care professionals:

• "You undertake appropriate training and understand your personal responsibilities."
• "You should not handle any patient or service user records until your training has been completed."
• Read your organisation's records policy.
• Meet your professional registrant body's record-keeping standards, and understand the Caldicott Principles.

Training may come from the organisation — a hospital trust or a care home provider — or from a department, such as radiology. So a generic organisation-wide module may not discharge it where a department holds specialist records.

The pre-access gate is the operationally significant one. Think about what it means for agency and bank staff starting a shift at short notice, for a new administrator given access to a care planning system on day one, or for a student on placement. In most services those people are handling records before any records-specific training has happened. That is the gap this sentence closes, and it is the one worth auditing against.

Understanding the Caldicott Principles is also stated as an individual duty, which makes them part of the records training rather than a separate confidentiality topic. We cover all eight, and the subtle status of the Caldicott Guardian role, in our guide to the Caldicott Principles and the Guardian.

Retention: the structure and the changes

The retention schedule sits at Appendix II of the Code, and the online version has a search and filter tool rather than a flat table.

The headline position: most health and care records are kept eight years after the last treatment. GP records are kept considerably longer, with that period under review. Some records, such as patient surveys, are kept long-term for research purposes.

Three documented changes worth knowing, because they are the kind of thing a retention policy quietly fails to reflect:

• Dental clinical care records were reduced from 15 years to 11 years in August 2023.
• Retaining records beyond 20 years now requires approval from the Secretary of State, with some exemptions, also from August 2023.
• The GP patient records section for living patients was reworded for clarity in May 2024.

And one hard constraint that overrides the schedule entirely: records must not be destroyed while relevant inquiries are ongoing. The Code names the UK Covid-19 Inquiry and the Infected Blood Public Inquiry specifically. If your destruction schedule runs automatically, that is a hold you need to have applied deliberately rather than assumed.

Scotland has its own Code — and a statutory training duty England lacks

This is the most useful comparison in the subject, and it runs the opposite way to most four-nation comparisons.

Scotland's Records Management Code of Practice for Health and Social Care is at version 4.0, issued 16 August 2024 and effective from 30 August 2024, published by the Scottish Government's Digital Health and Care Division. It supersedes the Scottish version 3.0 from 2020. Its scope is "those who work within or under contract to NHS organisations in Scotland", and its named audience is records management leads, information governance leads, data protection officers, Caldicott Guardians and senior information risk owners.

Its training section says two things England's Code does not. First: "All staff involved in handling records, should be appropriately trained in their records management responsibilities, and are competent to carry out their designated records management duties. Training should cover paper and digital record formats."

Then the part with real legal weight: "Public authorities have a duty to ensure the provision of training for staff regarding records management in support of their compliance with Element 12 of the Keeper's Model Records Management Plan, under PRSA." PRSA is the Public Records (Scotland) Act 2011.

So in Scotland there is a statutory grounding for records management training that England's Code does not have. A Scottish public authority's records training sits under an Act of the Scottish Parliament; an English trust's sits under guidance made enforceable through a Toolkit item.

Two Scottish scope notes if you operate across the border. Scotland's retention schedule "does not cover social care and social work records and therefore does not apply to Local Authorities" — those use the Scottish Council on Archives Record Retention Schedules. And the Code recommends that "integrated health and social care records should be held for the longest retention period specified in the Code of Practice or the retention schedule belonging to the associated Local Authority."

What to do

Four things, in order of risk.

Apply the pre-access gate. Check whether agency, bank, student and newly-appointed administrative staff are getting records training before system access rather than after. In most services they are not, and this is the clearest stated requirement in the whole subject.

Rebuild your retention schedule from Appendix II rather than from an inherited spreadsheet. If it still shows 15 years for dental clinical records, it predates August 2023.

Check the inquiry holds are actually applied rather than noted, especially if destruction runs on a schedule.

If you operate in Scotland, train against the Scottish Code, cover paper and digital formats explicitly, and record the link to the Keeper's Model Records Management Plan — because there the training duty is statutory.

On frequency: neither Code sets a refresher interval, which is consistent with almost all mandatory training, as we set out in our guide to how often mandatory training is actually required. What both Codes do set is a trigger — and in England's case, the trigger is before you handle a record at all.