Ethics Guidance for Occupational Health Practice 9th Edition - Book - Page 43
Access rights and audit trails of records
3.34. Access to both paper and electronic occupational health clinical records should
be on a ‘need to know’ basis. Occupational health professionals and other
occupational health staff should only access records when it is necessary to
allow them to undertake their work. With increasing use of electronic records,
the creation of an ‘audit trail’ will become the norm for monitoring access to
occupational health clinical records in line with other clinical systems.
3.35. Larger occupational health services may have in-house IT staff who manage the
occupational health database, but others will need to seek external support.
Whether employed or contracted, systems administrators must be fully briefed
and trained on the confidential status of occupational health records and
should sign confidentiality agreements. When setting up access rights to an
occupational health database with the systems administrator, it is important to
provide explicit written details of the requirements for access. It is important for
the occupational health professional to be certain who has access to what
information
within
the
system.
The
occupational
health
professional retains professional and ethical responsibility for maintaining the
confidentiality of records even when there is a professional data processor.
Retention, Deletion and Destruction of records
Retention of records – Health Record
3.36. Employers are required to retain the ‘Health Record’ for specified periods in
order to meet statutory obligations which is different to the clinical
occupational health records. Occupational health professionals play an
important role in advising employers on the relevant regulations that apply to
the type of screening being carried out and the corresponding retention
requirements.
Retention of records – Occupational Health Clinical Record
3.37. There is no single definitive rule regarding the retention period for occupational
health clinical records. Current guidance from Records Management Code of
Practice - NHS Transformation Directorate 25 is for the period of the person’s
employment plus six years or until their 75th birthday, whichever is the sooner.
Page | 42
