Accreditation practice pointer: storage, retention, and destruction of records
C6.4 E Our practice has appropriate procedures for the storage, retention, and destruction of records.
RACGP Standards for general practice
It is a legal requirement for general practice to maintain the privacy and security of health information.
Thus, general practice must have a continuity plan to protect information during adverse incidents, like a system crash. The business continuity and information recovery plan needs to include:
the processes by which all critical information relating to the practice’s operations (such as appointments, billing and patient health information) will be frequently backed up
a schedule of regular tests so that backups are being correctly created and can be accessed and read as expected
details of the secure offsite location where the backup information is stored
standard letters of agreement that external IT providers sign to indicate their commitment.
General practice must also maintain a privacy policy. RACGP has developed a Privacy Policy Template, which is available here:
Additionally, general practice teams might take regular privacy training.
When developing a process for the destruction of records, practices need to consider:
Consulting with their medical defence organisation for information on legal requirements and manage the risks
Using a cross-cut shredder to destroy paper documents containing sensitive material
Developing a system that provides timely identification of information that is no longer relevant
Having processes for the disposal of hard drives and other storage media.
Practices could also maintain policies for the management of patient health information and information technology.