Retaining and storing pharmacy records in England

Defining pharmacy records

Pharmacy staff responsibilities

All healthcare staff are responsible for managing records appropriately.

Pharmacy staff are expected to:

• understand their record keeping responsibilities
• follow local records management policies
• comply with their professional standards
• maintain confidentiality
• satisfy information governance requirements
• undertake appropriate training
• know who their designated records management lead is

Pharmacy managers should work closely with the organisation lead for record management. The Chief Pharmacist will usually have the final decision on management of pharmacy records where the organisation cannot provide clear guidance.

Organisation responsibilities

Each organisation should have a designated member of staff who leads on records management and a policy statement which is available to all staff. Organisations may also have Information Asset Owners (IAOs) who can support and advise senior pharmacy staff.

Organisations can be asked for evidence of a records management process.

Applying our advice

There are several national resources to support records management and retention. Where these do not provide clear advice for pharmacy records, we provide interpretation and best practice advice.

Minimum retention time

We advise on the minimum retention time for pharmacy records but in some situations the record may need to be kept for longer. If 2 or more resources recommend more than one retention time then use the longer retention time.

Refer to the section extending retention time below, and our topic specific articles for further advice.

Pharmacy prescriptions

The RMCoP advises pharmacy prescription records to be retained for at least 2 years. A record of the prescription may also be held by the NHS Business Services Authority (BSA) and there will usually be an entry on the person’s health record. Where this is not the case, you may need to consider extending the retention time.

Extending retention time

The RMCoP is the primary records management framework used within NHS organisations. Recommended retention periods are minimum retention times and some records may need to be retained for longer.

Prescriptions not sent to BSA

Prescriptions not linked to patient records or sent to BSA

If the prescription is not sent to the BSA and there is no entry in the patient’s record, the prescription should be retained longer as there are no other records. Under the Data Protection Act 2018 (Section 205) (DPA) this would be:

• at least 8 years for adults
• until their 25th birthday or until their 26th birthday, if they were 17 years when the treatment ended, for children

Negligence claims

The Limitation Act 1980 sets time limits for civil claims. For clinical negligence claims involving personal injury, a claim must normally be brought within:

• 3 years from the date of injury, or
• 3 years from the date the person first became aware that the injury may have been caused by the treatment provided

The Limitation Act does not specify pharmacy record retention times directly. It influences retention requirements by recognising that claims may arise years after a product was supplied. This may be relevant to:

• dispensing records
• clinical intervention records
• vaccination records
• technical services records
• incident investigation records
• complaint records

Defective products

The Consumer Protection Act 1987 (CPA) allows claims relating to defective products, including medicines and medical devices.

Product liability claims under the CPA are usually brought:

• within 3 years of the claimant becoming aware of the damage, defect and identity of the producer
• and no later than 10 years after the product was first put into circulation

The CPA does not specify pharmacy record retention times directly. It influences retention requirements by recognising that claims may arise years after a product was supplied. Pharmacy records may be needed to demonstrate:

• what product was supplied
• batch numbers
• storage conditions
• transportation arrangements
• manufacturing processes
• quality control
• traceability from supplier to patient
• actions taken following recalls or defects

Storing records

Where possible, organisations should be moving to digital records.

An NHS case study on the environmental benefits of digital over paper encourages:

• moving from paper to digital records
• avoiding data duplication
• use of server-less technology
• only keeping records that are needed

Digital records

A digital record has the same minimum retention requirements as all other formats but with additional governance.

Digital records must always be recoverable in an accessible format and provide information about who has accessed the record throughout its retention period.

Digital information needs to be maintained so that it can be accessed despite advances or changes in digital technology. Records must continue to be accessible and usable.

The Digital Preservation Handbook provides further information at an organisational level as well as technical solutions and tools.

Paper records

Paper records do not have automatic audit logs. Storage will incur costs which will increase with the storage time or amount stored.

Carbon footprint

Digital records will reduce environmental impact by reducing waste and reducing paper-based communications.

Carbon dioxide released by data centres can contribute to increasing the NHS carbon footprint and this may increase with high resolution images, for example.

Low carbon software and application designs are potential options to reduce the NHS digital carbon footprint.

Paper records should be environmentally friendly and contribute to the NHS target to reduce its carbon footprint. For example, shredding and recycling records instead of incinerating them once the retention period has ended.

Off-site storage

Off-site record storage applies to paper records and records stored in cloud-based solutions.

Off-site records should have:

• a full inventory of what is held off-site
• an application of the retention period to each record
• a disposal log
• evidence of secure disposal

The National Archives has produced guidance to identify and support the requirements for selecting and transferring paper records and further guidance on identifying and specifying requirements for offsite storage of physical records.

Organisations must conduct a Data Protection Impact Assessment (DPIA) if they want to start storing records off-site.

Destruction of records

In no circumstances should a record be automatically destroyed or deleted.

The following are examples of information which should not be destroyed:

• Subject Access Request (SAR)
• notified legal proceeding
• coroner’s inquest
• public inquiry

Once the minimum retention period has been reached, additional steps need to be taken before the record can be destroyed or deleted.

Reviewing records

Review records once their business need has ended and the minimum retention period reached. The National Archives has guidance on record appraisal.

Document the reason for all decisions as evidence, before destroying or deleting records.

Destroying paper records

Paper records can be destroyed in-house or under contract with an approved off-site company.  There must be clear evidence, for example a certificate of destruction, that the records have been destroyed.

Records that do not contain personal data or confidential material can be destroyed in a less secure manner and do not require a certificate of destruction.

If there is doubt, treat the record as confidential for destruction.

Destruction of digital records

Deleting a digital record may not meet ISO 27001 standards since the information can sometimes be recovered. Organisations should consider procuring systems that allow permanent deletion of records.

If the system doesn’t allow for permanent deletion, reasonable steps should be taken to remove the record from access in daily or regular activity. For example, by archiving the record.

Continued retention

Organisations must have policies in place identifying records which should be retained for longer than the minimum period such as:

• public inquiries
• ongoing access requests
• continued business need

The decision to retain records beyond the minimum period must be recorded and a date set for further review.

Refer to Section 5.4 of the RMCoP for further advice.

RPS Greener Pharmacy Guide

This article relates to the RPS Greener Pharmacy Guide domain: Pharmacy staff; Level 2 (Silver); Action 5.2.1 Optimise digital record storage by deleting unnecessary computer files, including those stored in the cloud.

Update history