Updated: Code of Practice on managing health and care records

NHSX’s Records Management Code of Practice 2021 (4 August 2021) provides guidance on how to keep health and care records, including how long to keep different types of records.

It is essential reading for organisations working within the NHS or under contract to the NHS in England as well as adult social care and public health. It covers both private patients treated on NHS premises as well as patients treated on behalf of the NHS in the private sector. It also states that private providers can use this Code for guidance (although it also references the Private and Voluntary Health Care (England) Regulations 2001).

This replaces the previous Records Management NHS Code of Practice dated 2006 (and revised twice since) as well as various Health Service Circulars.

The Code contains five sections covering:

  • Scope of the Code
  • Records management obligations
  • Organising records
  • Records storage for operational use
  • Management of records when the minimum retention period is reached

A number of issues are covered from legal, professional, organisational and individual responsibility when managing records to how to design and implement a records management system, including advice on sorting, retaining and deleting records – and applies to all records, such as: an email, a photograph, an x-ray, a text message or even a plaster mould.

One of the first points it makes is that wherever possible organisations should be moving away from paper towards digital records.

The Code is supported by three important appendices:

  • Appendix 1:Public and Statutory Inquiries
  • Appendix 2: Retention schedule (with the periods listed being considered as the minimum)
  • Appendix 3: How to deal with specific types of records (such as Continuing Healthcare, Individual Funding Requests and Transgender patients)


The Code references the Independent Inquiry into Historic Child Sex Abuse and the Infected Blood Public Inquiry in particular.

It also notes the forthcoming Covid-19 Public Inquiry and whilst there are not details of what records will be required at this stage the Code notes that it is likely that records relating to policy and decision making will be required as a minimum.

The bottom line is that if in doubt retain records until there is clear instruction from the Inquiry.


All organisations and IG managers need to comply with the standards in this Code – with CQC inspecting to ensure that effective management systems are in place.

The Code is to be read in conjunction with the Professional Records Standards Body structure and content of health and care records standards and the Code of Practice on the management of records issued under section 42 of the Freedom of Information Act 2000.

Posted by


Mills & Reeve Sites navigation
A tabbed collection of Mills & Reeve sites.
My Mills & Reeve navigation
Subscribe to, or manage your My Mills & Reeve account.
My M&R


Register for My M&R to stay up-to-date with legal news and events, create brochures and bookmark pages.

Existing clients

Log in to your client extranet for free matter information, know-how and documents.


Mills & Reeve system for employees.