The Public Records (Scotland) Act 2011
NHS Ayrshire and Arran
Progress Update Review (PUR) Report by the PRSA Assessment Team
2nd August 2020
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 1
Contents
1. The Public Records (Scotland) Act 2011………………………………………... 3 2. Progress Update Review (PUR) Mechanism…………………………………… 4 3. Executive Summary……………………………………………………………….. 4 4. Authority Background……………………………………………………………… 4 5. Assessment Process……………………………………………………………… 5 6. Records Management Plan Elements Checklist and PUR Assessment…….. 6-18 7. The Public Records (Scotland) Act Assessment Team’s Summary…………. 19 8. The Public Records (Scotland) Act Assessment Team’s Evaluation………… 19
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 2
1. Public Records (Scotland) Act 2011
The Public Records (Scotland) Act 2011 (the Act) received Royal Assent on 20 April 2011. It is the first new public records legislation in Scotland since 1937 and came into force on 1 January 2013. Its primary aim is to promote efficient and accountable record keeping by named Scottish public authorities.
The Act has its origins in The Historical Abuse Systemic Review: Residential Schools and Children’s Homes in Scotland 1950-1995 (The Shaw Report) published in 2007. The Shaw Report recorded how its investigations were hampered by poor recordkeeping and found that thousands of records had been created, but were then lost due to an inadequate legislative framework and poor records management. Crucially, it demonstrated how former residents of children’s homes were denied access to information about their formative years. The Shaw Report demonstrated that management of records in all formats (paper and electronic) is not just a bureaucratic process, but central to good governance and should not be ignored. A follow-up review of public records legislation by the Keeper of the Records of Scotland (the Keeper) found further evidence of poor records management across the public sector. This resulted in the passage of the Act by the Scottish Parliament in March 2011.
The Act requires a named authority to prepare and implement a records management plan (RMP) which must set out proper arrangements for the management of its records. A plan must clearly describe the way the authority cares for the records that it creates, in any format, whilst carrying out its business activities. The RMP must be agreed with the Keeper and regularly reviewed.
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 3
2. Progress Update Review (PUR) Mechanism
Under section 5(1) & (2) of the Act the Keeper may only require a review of an authority’s agreed RMP to be undertaken not earlier than five years after the date on which the authority’s RMP was last agreed. Regardless of whether an authority has successfully achieved its goals identified in its RMP or continues to work towards them, the minimum period of five years before the Keeper can require a review of a RMP does not allow for continuous progress to be captured and recognised.
The success of the Act to date is attributable to a large degree to meaningful communication between the Keeper, the Assessment Team, and named public authorities. Consultation with Key Contacts has highlighted the desirability of a mechanism to facilitate regular, constructive dialogue between stakeholders and the Assessment Team. Many authorities have themselves recognised that such regular communication is necessary to keep their agreed plans up to date following inevitable organisational change. Following meetings between authorities and the Assessment Team, a reporting mechanism through which progress and local initiatives can be acknowledged and reviewed by the Assessment Team was proposed. Key Contacts have expressed the hope that through submission of regular updates, the momentum generated by the Act can continue to be sustained at all levels within authorities.
The PUR self-assessment review mechanism was developed in collaboration with stakeholders and was formally announced in the Keeper’s Annual Report published on 12 August 2016. The completion of the PUR process enables authorities to be credited for the progress they are effecting and to receive constructive advice concerning on-going developments. Engaging with this mechanism will not only maintain the spirit of the Act by encouraging senior management to recognise the need for good records management practices, but will also help authorities comply with their statutory obligation under section 5(1)(a) of the Act to keep their RMP under review.
3. Executive Summary
This Report sets out the findings of the Public Records (Scotland) Act 2011 (the Act) Assessment Team’s consideration of the Progress Update template submitted for NHS Ayrshire and Arran. The outcome of the assessment and relevant feedback can be found under sections 6 – 8.
4. Authority Background
NHS Ayrshire and Arran is one of the fourteen regions of NHS Scotland. It was formed on 1 April 2004.
It has a responsibility to provide health and social care to almost 400,000 people with an operating budget of around £700 million (for 2013-2014).
Areas of responsibility include:
•Healthcare Quality, Governance and Standards
•Infection Control
•Patient safety
•Research and Development
•Waiting times
•Litigation
•Medical workforce
•Patient Management System
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 4
•Appraisal
The Executive Medical Director is the Board's Responsible Officer and the Assistant Director Healthcare Quality, Governance and Standards is the Caldicott Guardian. http://www.nhsaaa.net/
5. Assessment Process
A PUR submission is evaluated by the Act’s Assessment Team. The self-assessment process invites authorities to complete a template and send it to the Assessment Team one year after the date of agreement of its RMP and every year thereafter. The self-assessment template highlights where an authority’s plan achieved agreement on an improvement basis and invites updates under those ‘Amber’ elements. However, it also provides an opportunity for authorities not simply to report on progress against improvements, but to comment on any new initiatives, highlight innovations, or record changes to existing arrangements under those elements that had attracted an initial ‘Green’ score in their original RMP submission.
The assessment report considers statements made by an authority under the elements of its agreed Plan that included improvement models. It reflects any changes and/or progress made towards achieving full compliance in those areas where agreement under improvement was made in the Keeper’s Assessment Report of their RMP. The PUR assessment report also considers statements of further progress made in elements already compliant under the Act.
Engagement with the PUR mechanism for assessment cannot alter the Keeper’s Assessment Report of an authority’s agreed RMP or any RAG assessment within it. Instead the PUR Final Report records the Assessment Team’s evaluation of the submission and its opinion on the progress being made by the authority since agreeing its RMP. The team’s assessment provides an informal indication of what marking an authority could expect should it submit a revised RMP to the Keeper under the Act, although such assessment is made without prejudice to the Keeper’s right to adopt a different marking at that stage.
Key:
The Assessment The Assessment There is a Team agrees this Team agrees this serious gap in element of an element of an provision for G authority’s plan. A authority’s progress R this element update submission with no clear as an ‘improvement explanation of model’. This means how this will be that they are addressed. The convinced of the Assessment authority’s Team may commitment to choose to notify closing a gap in the Keeper on provision. They will this basis. request that they are updated as work on this element progresses.
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 5
Progress Update Review (PUR) Template: NHS Ayrshire & Arran 8th January 2020
Element Status of Status of Progress Progress Keeper’s Report Self-assessment Progress Review Self-assessment Update Progress Review Comment elements evidence assessment assessment Comments on Update Comment as submitted by the 02AUG20 under under status status Authority’s Plan 29JUN18 04OCT18 Authority since agreed agreed 04OCT18 02AUG20 03OCT16 04OCT18 Plan Plan 03OCT16 03OCT16
G G G G Update required on any No change No immediate action No change No immediate action required. 1. Senior Officer change required. Update required This remains as: Update required on any future on any future change John Burns, Chief Executive. change.
G G G G Update required on any No change No immediate action No change No immediate action required. 2. Records change required. Update required This remains as: Update required on any future Manager on any future change Robert Bryden, Health of change. Health Records Services and Natali Higgins, Information Governance Manager (Corporate Records).
G G G G Update required on any Health Records This update is noted with Health Records Thank you for the update regarding 3. Policy change The Personal Health thanks. It is positive to No change, the Personal health and corporate records Records Policy has hear that these Health Records Policy is due been reviewed in documents are being to be reviewed in November policies. September 2018 and reviewed as a matter of 2021. updated to reflect the best practice and that the The Assessment Team agrees that introduction of GDPR requirements of the Data Corporate Records the Health Board continues to and Scotland’s Digital Protection Act 2018 have No change. The Corporate provide appropriate guidance and Health and Care been implemented. Records Management Policy is Strategy. due for review in May 2020. support for staff creating, processing and managing records. Corporate Records The policy continues to be The Corporate published on both the Records Management organisations staff intranet and Policy was reviewed in public internet. May 2018 and updated to reflect the The policy itself and some of introduction of the new the content, e.g. lifecycle, is GDPR. highlighted within NHS A&A’s learnPro module training and The Corporate face to face training sessions. Records Management Policy is highlighted and explained at all Records Management Awareness Sessions and is published on both the intranet and internet.
A G A A NHS Ayrshire and Arran Within NHS Ayrshire & This update is noted with The Information Asset Register In previous updates NHS Ayrshire 4. Business are committed to Arran the decision was thanks. has been introduced across and Arran have indicated that they Classification developing and taken to focus on the the whole organisation. In implementing a functional, implementation of an excess of 200 meetings have were pursuing an Information Asset
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 6
three-tiered Business Information Asset The Information Asset taken place with managers Register structure around the Classification Scheme to Register and then use Register described and staff are in the process of management of their public records. improve the systematic the information sensibly addresses registering assets. The management of their collected to form the Elements 4, 5 and 11 organisation is taking a high The Assessment Team records. Whilst this must basis of a high level together, as well as level approach to this initially acknowledge that this action has remain a business decision Business Classification tackling some and over 800 assets have now been completed. for authorities, the use of a Scheme. Advice was requirements of the Data been registered at this point. functional classification sought from NRS as Protection Act 2018. It is The achievement of this objective scheme is considered good part of this decision reasonable to expect that The Information Asset Register practice. The Keeper is making process. the process of holds information on both, marks a measurable improvement similarly pleased to see that disseminating this to staff assets which contain personal in the records management local business units will be The Information Asset will take some time, identifiable information and provision in the authority. consulted in the planning of Register has been starting with senior assets which are of vital this document. designed to capture management. Once importance to the organisation. The Information Asset Register is the following records senior management The Action Plan has management elements understand the purpose NHS Scotland has agreed a now being populated at a local level identified a target date of 3- about each information and the benefit of this contract with Microsoft for the (the involvement of local business 5 years in which to asset: work it will be easier to implementation of Microsoft areas in the work is vital). The complete the Scheme and function achieve effective Office 365 (O365) across all Assessment Team looks forward to then roll it out to retention period compliance. 22 Boards in Scotland. The updates in subsequent PURs. departments. The Keeper earliest record held SharePoint application which recognises that due to the The Keeper is aware that is included within the O365 format This element remains at Amber size of this organisation where it is stored NHS Scotland is package will form the EDRM progress will inevitably be tracking developing a national system for NHS Scotland. If while this work is ongoing. made on an incremental EDRM system and that this is implemented within the basis. However he expects The Information Asset NHS Ayrshire and Arran Board, provided that the The Keeper is aware that all NHS to see continual progress in Register continues to are awaiting the roll out of appropriate polices, the coming years and this system. governance and staff training Boards are migrating their systems be rolled out across to a O365 solution. This is bound to requests that he is kept the organisation. are in place, this could informed as work continues Explanatory meetings The steady and realistic significantly improve the be incremental and take several in this area. have been held with approach to compliance organisations management of years to bed-in properly. The managers within the with this Element is to be corporate records. Assessment Team acknowledge This authority is also following Directorates: commended. The that NHS Ayrshire and Arran have considering the use of an Chief Executive authority is making As part of the implementation electronic document progress towards of O365, the NHSS Records correctly identified the importance of Human Resources management system such achieving a Green RAG Management Forum will “appropriate polices, governance Finance as SharePoint. The Keeper status for this Element. develop a national business Nurse Directorate and staff training” in making this asks that he is notified classification scheme which it major project a success. should any decision be Medical Directorate is intended will be adopted by taken. Public Health all Boards. The Information Corporate Support Governance Manager The Assessment Team recognise The Keeper agrees this Services (Corporate Records) is Co- that NHS Ayrshire and Arran’s element of NHS Ayrshire Pharmacy Chair of the Forum and will be Information Governance Manager and Arran’s records Directorate directly involved in the (Corporate Records) has been management plan under development of this. ‘improvement model’ terms. No further decisions consistently engaged in This means that the have been made developments in NHS Scotland authority has identified a regarding the centrally through the NHSS Forum. gap in provision (a full implementation of an This version are developing a BCS business classification electronic document and an update to the Code of scheme has not yet been management system. rolled-out in the This is due to the Practice while closely monitoring organisation) and have put organisation awaiting a the O365 implementation. measures in place to close national decision on that gap. The Keeper’s the impending agreement is conditional on upgrades to the him receiving updates as Microsoft software. the BCS project progresses.
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 7
G G G G Update required on any The organisation This update is noted with Overall there has been no Thank you for the update regarding 5. Retention change continues to follow the thanks. Retention change. As per the previous changes to the retention schedules. Schedule retention schedule schedules are not static. update the organisation provided within the The authority has made continues to follow the Scottish Government good progress in keeping retention schedule provided This is a recognition that a retention Records Management: the retention schedules within the Scottish schedule is a ‘living document’ and NHS Code of Practice under review and Government Records will be subject to continual minor (Scotland) Version 2.1. identifying areas where Management: NHS Code of change year on year. changes were required. Practice (Scotland) Version Health Records Given the work evident in 2.1. The Operational other Elements, it is to be As noted above the Assessment Procedure for the expected that the audit of The Head of Health Records Team recognise that NHS Ayrshire Destruction of compliance with corporate and the Information and Arran’s Head of Health Records Personal Health records retention Governance Manager Services and Information Records continues to schedules has not yet (Corporate Records) have be used within the been completed. This participated in the ongoing Governance Manager (Corporate organisation to demonstrates that the review and update of the Code Records) have been consistently manage authority is realistic in of Practice. engaged in developing the updated retention/destruction of what can be achieved at Code of Practice through the NHSS personal health present and is mindful of Health Records Forum. records. This was what further work is The Operational Procedure for updated to version 4.0 needed. the Destruction of Personal in April 2017 to include Health Records was updated guidance on the The Keeper has been to Version 4.1 in September retention of records monitoring the 2018 to include updated required for litigation development of the new guidance on the retention of purposes. version of the NHS Code records relating to bleeding of Practice and disorders. Corporate Records recognises that NHS The Retention Ayrshire and Arran will Corporate Records Schedule for adopt the retention As per the previous update the administrative/corporat decisions of this code retention schedule for e records was when it is implemented. corporate records is included removed from the in the local Corporate Records Corporate Records Retention & Disposal Policy. Management Policy This policy is available on both and inserted in the the public website, staff new Corporate intranet and is highlighted Records Retention & within the learnPro training Disposal Policy (see module and face to face below). training sessions.
There has been no progress as yet with auditing compliance of the corporate records retention periods.
A G A G NHS Ayrshire and Arran Health Records This update is noted with Both documents continue to be The Keeper agreed the original 6. Destruction recognise that procedures The Operational thanks. Sampling for used within the organisation. NHS Ayrshire and Arran Records Arrangements for the secure and Procedure for the quality assurance by a In August 2019 a joint Management Plan on an irretrievable destruction of Destruction of senior member of staff statement was circulated administrative records Personal Health prior to destruction is best throughout the organisation via improvement model basis partly on (predominantly held Records V4.0 practice and the authority the daily communications the grounds that the authority could electronically) are not continues to be used is to be commended for email bulletin (Daily Digest) to not be confident that staff were implemented throughout within the organisation developing this system in remind staff that they must destroying digital records at the end the organisation. The to manage relation to highly sensitive refer to the appropriate authority has retention/destruction of clinical records. disposal policy when of their retention periods. He was acknowledged the need to personal health appraising records. convinced that processes were in develop a Corporate records. A percentage place to remedy this. The
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 8
Records Destruction of clinical records that Assessment Team is pleased to Procedure and roll this out have been selected for Health Records acknowledge that the authority now to all functional areas. destruction are As noted above, it is to be The Operational Procedure for Moreover, arrangements sampled by a Senior expected that the audit of the Destruction of Personal appears to be compliant in this for auditing compliance with member of staff to compliance will take some Health Records was updated element. these procedures will be provide quality time. It is very positive to Version 4.1 in September put in place. The Keeper assurance. that the Corporate 2018 to include updated Clearly, once all the public records believes that NHS Ayrshire Records Retention & guidance on the retention of of the authority which are currently and Arran have identified a Corporate Records Disposal Policy has been records relating to bleeding managed on designated shared gap in provision and have The Corporate approved and its disorders. committed to putting Records Retention & existence communicated drives have been migrated to the processes in place to close Disposal Policy was to staff at least twice and Corporate Records O365 system the routine and that gap. The Keeper approved by the is being promoted through There have been no changes controlled destruction of these requests that he is kept Information other techniques. to the policy or processes electronic records should be more informed of progress under Governance previously mentioned. The robust. However, this functionality this element and that he is Committee in The authority appears to data cleanse of corporate provided with a copy of the November 2017. It be well on the way to records is ongoing across the will probably not be universally guidance procedures once has been circulated achieving a Green RAG organisation. This continues operational for some time. In the approved. throughout the status for this element. to be led by the Directorate meantime it will remain important organisation via: The Assessment Team Corporate Records that staff are correctly prompted to The Keeper is able to agree Daily would welcome further Management Champions destroy records appropriately. The this element of NHS communication updates and in due through the sub group action Ayrshire and Arran’s email which goes course provision of plans. example of the paper record review records management plan to all staff with an evidence of these shows that NHS A&A are pursuing under ‘improvement model’ email account significant steps forward. Following a recent update at this. terms. This means that he The Chief the Corporate Management acknowledges the authority Executive who Team* meeting, Directorates If this was a formal re-submission it has identified a gap in cascaded it to the were given a six month period provision (in this case, lack Directors for to review the paper records, is likely that this element of the Plan of staff guidance on the circulating within appraise them for disposal and would turn from Amber to Green. routine deletion of records their departments. improve storage conditions. A held electronically), but he further update was provided to agrees that they have put in Compliance with this the Corporate Management place measures to close policy is not yet being Team in December regarding that gap. His agreement is monitored, however the progress made. conditional on his being through awareness updated as the project sessions and records The Information Governance progresses. management sub Manager (Corporate Records) groups, staff are being regularly provides advice asked to carry out a regarding retention periods not data cleanse. Sub covered within the Scottish groups have action Government retention plans to monitor the schedule and advises what progress with the data departments require to cleanse. consider when appraising documents. They routinely A Retention & visit departments at their Disposal register has request to support them with also been rolled out in the appraisal of paper or each Directorate. The electronic documents. master copy is held by the Records *The Corporate Management Management Team meetings chaired by the Champion. Chief Executive and all Directors attend. The processes for the destruction of confidential waste and device hardware remain the same.
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 9
A G A G NHS Ayrshire and Arran Memorandum of This update is noted with The Memorandum of In their original submission NHS 7. Archiving and have selected Ayrshire understanding has thanks and the Keeper Understanding has been Ayrshire and Arran identified Transfer Archives as the repository recently been signed would be glad of a copy of agreed and signed by both for records selected for by Ayrshire Archives the signed Memorandum organisations. Ayrshire Archives as an appropriate permanent preservation. An and has been of Understanding as soon repository for the public records action under this element submitted to the as it is available. A full register of historic selected for permanent has been identified as the Interim Director of records has been created and preservation. creation of a Memorandum Public Health for The joint work with a meeting will be arranged with of Understanding between signature. This will be Ayrshire Archives is a Ayrshire Archives in early 2020 the authority and Ayrshire signed on Tuesday 25 commendable initiative to discuss the records and They set an objective of formalising Archives to formalise these September 2018. and should assist in services provided, including transfer arrangements through a transfer arrangements. The developing appropriate exploration of the potential memorandum of understanding Keeper commends this Action has been taken public access to NHS arrangements for digital between the archive service and the initiative and asks that he is jointly with Ayrshire records of enduring value records. health board. The Assessment sent a copy of this MoU as Archives to establish in due course. It is soon as possible. what historic records important that both the Team is pleased to acknowledge they are holding on authority and the archives that this has now been done. The Keeper is able to agree behalf of the repository have complete element 7 on ‘improvement organisation and what records of what is held. In If this was a formal re-submission it model’ terms while he historic records due course this should is likely that this element of the Plan awaits a signed MoU. continue to be stored include appropriate within the organisation. arrangements for digital would turn from Amber to Green. A comprehensive records of enduring value. register is being collated and further discussions will be arranged with Ayrshire Archives to discuss the contents of the register. G G G G The authority has stated a The eHealth This update is noted with In 2018 NHS Ayrshire & Arran The Assessment Team notes that 8. Information future aim of bringing department are thanks. As with other achieved Cyber Essentials the authority has recently been Security themselves into compliance progressing towards Elements, the authority is accreditation. with ISO-27001. The compliance with the to be commended for its awarded Cyber Essential Plus Keeper will be notified standard. steady development NHS Scotland Health Boards certification: when the authority is towards its stated goal, in have been tasked with NHS Ayrshire & Arran confident of having attained The Senior Technical this case of compliance complying with the Information Ailsa Hospital, Dalmellington Road, this standard. The Keeper Specialist for IT with ISO-27001. Security Policy Framework Ayr, KA6 6AB welcomes this approach Security is liaising with (ISPF) which is aligned to ISO and looks forward to Heads of Services and 27001. NHS A&A have carried Sector: Human Health and Social hearing from the authority. progress is being out a gap assessment and are Work monitored within an working with various Certificate 3075927977800023 Information Security departments to gather Certificate Level: Cyber Essentials Policy Maturity evidence of compliance of Date issued: 19/03/2019 Assessment work on areas where there are Framework and Action gaps. The Competent Plan. Authority (the Scottish Thank you for the update regarding Government) will be auditing the Scottish Government security NHS A&A against this in 2020. audit. The Assessment Team looks forward to an update on this in subsequent PURs.
G G G G Update required on any In order to promote This update is noted with The fundamental requirements As with all other Scottish public 9. Data change compliance with the thanks. Compliance with to promote compliance with authorities NHS Ayrshire & Arran Protection new General Data the new Data Protection the updated Data Protection have been required to review and Protection Regulation Act 2018 has clearly been Legislation have been the organisation has thoroughly addressed, completed, with the exception update their data protection
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 10
taken the following with a review of policies, of the completion of the procedures in light of the 2018 action: forms and procedures Information Asset Register, the legislation. aligned with staff training. ongoing maintenance is now Review and As noted, the Information considered business as usual. updating of all Asset Register described The Assessment Team policies regarding under Element 4 is being The Information Governance acknowledges that the public facing data protection and used very sensibly to pull team continue to progress a Heath Board website has been the handling of together related wider information governance updated appropriately: personal requirements under action plan which https://www.nhsaaa.net/data- identifiable different legislation: encompasses the information. recording the lawful basis implementation of the IAR and protection-notice/ for holding information wider remit of the information Review and alongside the retention governance team. For comments regarding the updating of the periods and within a Information Asset Register see organisations classification system is element 4 above. mandatory e- excellent practice. learning module on Safe Handling of Information. Every member of staff within the organisation has been asked to complete the updated module.
A new Data Protection Notice has been published on the public website.
Implementation of an Information Asset Register in order to clarify legal bases for processing and ensure information is processed / stored / accessed and shared appropriately.
Ongoing review and update of the forms and processes surrounding Data Protection Impact Assessments, Data Processing Agreements, and System Security Policies.
Arrangement of 20 open awareness sessions aimed at all staff which were
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 11
held in bases across the organisation. The Head of IG has also provided many direct sessions to teams/ departments.
G G G G Update required on any No change. No immediate action No change. No immediate action required. 10. Business change required. Update required NHS A&A has organisational Update required on any future Continuity and on any future change wide business continuity change. Vital Records strategies, departmental business continuity plans and IT disaster recovery plans in In 2016 the Keeper agreed that the place. record recovery procedures in NHS A&A were appropriate and is content that these procedures are still in place.
A G A A NHS Ayrshire and Arran Health Records The tracking Health Records Thank you for this update. 11. Audit Trail recognise the importance of TrakCare Patient arrangements described No change having arrangements in Management System along with the naming place for the auditing and is deployed throughout conventions and version Corporate Records The Assessment Team notes that a tracking of records. Not the board to record the control show considerable The Corporate Records new information governance only will the development of physical movement of care in the management Naming Convention & Version document, Corporate Records the Business Classification acute, mental health of clinical records. Control Guideline was Electronic Storage Guideline is Scheme greatly improve and maternity paper reviewed in August 2019 operational in the authority. such arrangements but this based personal health however it was agreed that no programme of work will records. Accredited Although the corporate changes were required. The also be accompanied by electronic systems are records are less well next review is due in 2021. In their original submission NHS the rolling-out of policies used to record clinical managed than clinical Face to face training has also A&A committed to keep its surrounding document information, impose records at present, the been created to complement information governance policy control and naming naming authority is clearly getting the guideline (see element 12). documents under review and the conventions. A conventions/version to grips with establishing methodology to gauge control at time of tracking systems, naming Controlled Document Policy - Assessment Team acknowledge compliance with these record creation and conventions and version No change. that this is being done. policies will also be during updating. SCI control guidelines. Again introduced. The Keeper Store and Clinical the Information Asset The SharePoint The O365 migration should greatly commends these Portal Systems use Register described under Implementation Group has increase the control over document endeavours and requests the NHS Scotland Element 4 is being used been stood down from that he is updated as work Clinical Document sensibly to deal with these meetings at present due to the tracking although it will take some in this area progresses. Indexing Standard issues. pending implementation of time for this to be universally thereby ensuring there O365. However the applied in the authority. However, in The Keeper agrees this is uniformity in storage membership continues to the short term the Assessment element of NHS Ayrshire and retrieval of clinical review and approve proposed Team would expect the populated and Arran’s records documents. changes and inclusions to the management plan under SharePoint AthenA site. Information Asset Register to ‘improvement model’ terms. Corporate Records strengthen this element. (For This means that he A Corporate Records The Corporate Records comments regarding the O365 acknowledges that an Naming Convention Electronic Storage Guideline migration and the Information Asset authority has identified a and Version Control was approved in March 2019 Register see element 4 above). gap in records Guideline has been and is accessible on the staff management provision, in circulated throughout intranet. The guideline is this case a lack of board- the organisation to all promoted through records The Assessment Team notes the wide record tracking, but is staff via email. management sub groups and continued use of local records convinced that the authority at face to face training management ‘champions’. This is to has committed to a process Records Management sessions. be commended. to close that gap. The Champions have
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 12
Keeper’s agreement is circulated the guideline The governance process for Until the Information Asset Register conditional on him receiving within their the creation of new drives has is completed and rolled-out this updates as the project directorates and sub been implemented and all progresses. groups are monitoring requests for new ‘shared’ element remains at Amber (it is implementation. SharePoint offers drives are reviewed by records likely to match element 4). The potential for electronic management champions to Assessment Team looks forward to An updated version of records management and ensure there is a legitimate updates in subsequent PURs. the Controlled the work that has been requirement for the drive and Document Policy has undertaken on naming to ensure it is the best solution. been rolled out across conventions, version the organisation which control and retention and provides a new disposal schedules will document template, make for a straightforward which includes version transition to this or any control fields in the other software system. As footer and a document noted under Element 4, control sheet. the Keeper is aware of the national development of The implementation of an EDRMS and that NHS the Information Asset Ayrshire & Arran are Register will help to awaiting this roll out. identify records which move around the The development of this organisation and storage guideline is enable review of pragmatic, bringing whether there are standardisation to a range adequate processes in of storage areas led by a place. variety of software systems and uses. The SharePoint Implementation Group Developing procedures is exploring the for shared drives sits well implementation of a beside the work on Corporate Document electronic storage and on Management platform version control/naming however this work is conventions and retention subject to national and disposal schedules. decision regarding the It is important that until a upgrade of Microsoft decision can be made on software. a the use of SharePoint or other common software, A Corporate Records that records continue to Electronic Storage be managed and no Guideline has been additional problems drafted. It provides created. clear guidance about where electronic The process described documentation should should mitigate against be stored and covers the possibility of the following platforms: additional, unmanaged Personal drives (H:\ problems. The authority drive) is to be commended for Shared drives taking account of these (Network drive) issues and putting in My Documents and place methods of PC/laptop desktops controlling and minimising (C:\ drive) problems until national Intranet - AthenA decisions are made. (Microsoft SharePoint)
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 13
Email accounts Overall, the authority is (Microsoft Outlook) showing steady progress Electronic systems towards achieving a (e.g. PMS, Datix, Green status. SSTS)
A governance process for the creation of shared drives is being implemented. Staff will now be asked to complete forms and liaise with managers and the Records Management Champion prior to submitting a request for a new drive. This is in order to ensure there is a legitimate requirement for the drive and to ensure it is the best solution. The forms will be completed to provide the purpose of the drive and detail which department will own the drive. New drives will be created using permission groups to aid the control of file plans and permissions.
G G G G The Plan states that staff Head of Health The authority has made a Head of Health Records The Keeper expects to see 12. Competency will be trained in Records Services significant contribution to Services evidence that Staff creating, or Framework information governance The Head of Health collaborative work. The The Board’s Strategic principles, whilst existing e- Records Services is a support that the authority Transformation Programme otherwise processing records, are learning modules will be Senior Manager within provides to enable its has been re-named ‘Caring for appropriately trained and supported. revised. The Keeper the Board with Head of Health Services Ayrshire’. The Electronic commends these responsibility to deliver to share expertise is an Patient Records There is abundant evidence that commitments and requests the personal health important and Implementation Group has NHS A&A take this aspect of their that he has sight of the records aspects of the commendable approach been stood down and a new updated training modules Boards Strategic to the professional group Digital Systems records management provision once available. Service development of this post. Operational Group has been seriously. Transformation Similarly, the support convened in its place. The Programme. The given to the Information Head of Health Records In the original submission the Head of Health Governance Manager is Services co-chairs this group authority committed itself to revamp Records Services excellent, enabling her to along with an Associate chairs the Electronic access appropriate Medical Director their training modules and the Patient Records training and to share her Assessment Team acknowledges Implementation Group expertise with both the Information Governance that this has been done (at least and sits on the Boards NHS records sector and Manager (Corporate once). Digital Steering Group. the wider records Records) (IGM) The Head of Health management profession. No change, the IGM continues Records Services is Her contribution to further to attend: The Assessment Team notes the examiner in Health development of Model A&A Learning@Lunch impressive uptake in records Records Practice for Records Management Management Sessions management training in the the Institute of Health Plan under the Public NRS Sessions authority. This applies to online and Records and Records (Scotland) Act is IRMS Events
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 14
Information valuable and very face-to-face training both of which Management and sits welcome. The IGM Chairs the NHS A&A appear to be well rolled-out to staff. on the Examination Corporate Records Board for Health The focus on Data Management Group and the Informatics Protection is practical and Ayrshire Records Management The learning opportunities afforded Examinations it is good to see timely Pan Ayrshire Group. the Information Governance [University of recognition of the Additionally they Co-Chair the Manager has also been noted and Manchester]. The changes that the Data NHS Scotland Records should be commended. It seems Head of Health Protection Act 2018 has Managers Forum. Records Service sits introduced. As an from this (and previous) on a number of authority that deals with All staff in NHS A&A submissions that the personal national groups to sensitive personal development of this officer is well provide subject matter records, this is to be Health Records supported. expertise in respect of expected but it is No change delivering personal nevertheless excellent health records and practice. Corporate Records information technology The Corporate Records improvement elements The extensive staff Management learnPro module related to out-patient training and awareness has been completed by services, specialty sessions are very approx. 1300 staff. The collaboratives and the positive. The additional completion of the module ‘role development of clinical training on records specific mandatory’ and staff applications. management for relevant are encouraged to complete it managers is welcome. . at face to face training and Information through directorate sub group Governance Manager action plans. (Corporate Records) (IGM) It was recognised that staff Since taking up post in would benefit from face to face March 2016, the IGM training sessions on naming has undertaken the conventions. A course was following external created and seven sessions training: were held in the organisation PDP Records which were well attended and Management 1&2 received positive feedback. Records Management with It was then recognised that SharePoint staff would also benefit from training on retention and In addition to disposal. It was therefore mandatory training, the decided to create a training following ‘inhouse’ course which would provide training has been staff with training on the undertaken: records life-cycle, principles, Presentation Skills implications, naming Coaching 4 conventions, retention and Change disposal. Fifteen sessions Personal have been held which have Assertiveness been attended by Learning@Lunch approximately 170 staff in Management total. Evaluations for the Sessions sessions are very positive and 12 session have been The IGM has also arranged in 2020. These participated in the sessions are targeted at all following: staff handling corporate NHSS RM Forum records and have been attended by staff at all levels. NRS Surgery
NRS PUR Session NRS IJB Surgery
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 15
IRMS Events The Information Governance ICO Webinars Team held ‘IG Week’ in ARMS Training November 2019 in order to Sessions raise the profile of the team and meet with staff. All staff in NHS A&A Information stands covering: The Safe Information - Data protection Handling eLearning is - Freedom of information a mandatory module - IT Security for all staff. It has - Health records recently been updated - Corporate records to reflect the were held on three separate introduction of the new full days at the three main General Data hospital sites. This provided Protection Regulation. staff with the opportunity to All staff are being find out about the services asked to re-complete provided. Postcards were this module. produced to outline 10 golden rules for good information Health Records governance. Throughout the In addition to the week 14 face to face sessions MAST Safe were held to remind staff of the Information Handling fundamental rules for good module, Health information governance. Records staff receive departmental based induction/ training covering operational procedures for management of personal health records.
Corporate Records The e-learning ‘learnPro’ module was revised and re- launched in February 2017. Approx 1000 staff have completed the module. The module has a three year time lapse and staff are encouraged to complete it at corporate induction as well as within departments (through Records Management Champions).
In excess of 50 awareness sessions have been held throughout the organisation to highlight the programme of work and inform staff what action is required.
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 16
Some of these session have been delivered jointly with colleagues and covered GDPR and IT Security.
A slot has been secured on the organisation’s Line Managers Training Programme to highlight managers’ responsibilities with regards to the management of corporate records.
It has been recognised that clinical areas/managers require support with records management therefore training is in the process of being produced for administration assistants working within these areas to enable them to guide the Senior Charge Nurses.
G G G G NHS Ayrshire and Arran Due to the introduction This update is noted with No change It is a requirement of the Public 13. Assessment have committed to of the self-assessment thanks. The Public Records (Scotland) Act 2011 that and Review undertaking a review of their progress update report Records (Scotland) Act NHS A&A will continue to use RMP in May 2017 and (PUR), the decisions requires authorities to the progress update review “An authority must— (a) keep its annually thereafter. There was taken locally not keep their Records (PUR), to annually review its records management plan under are also scheduled dates for to carry out an Management Plan under status against the Records review” (PRSA Part 1 5.1.a.) the review of several additional review of the review. While the PUR Management Plan. specific policies such as the RMP and use the PUR tool is not the only method In their original submission NHS Information Governance tool to review progress of doing this, it is very The local records management Framework and for instead. encouraging to see it improvement plan is regularly Ayrshire and Arran set a review arrangements including the being used. reviewed/updated and date on the Plan of May 2017 and auditing of compliance with Following the approval The authority shows a continues to be submitted with annually thereafter. The the procedures for recording of NHS A&A’s RMP a commendable approach an accompanying paper to all Assessment Team is pleased to the destruction of corporate detailed Records to identifying issues and Information Governance acknowledge that this is being records. Management planning future progress. Committee meetings. Improvement Plan was It is clear from the work done. Compliance with the Plan created to monitor described in other and these accompanying progress towards the Elements that the The authority’s participation in the policies and provisions will actions required. This authority is using its PUR process in 2018 and 2020 be assessed by the plan is regularly internal monitoring to demonstrates a commitment to Information Governance updated and is develop and make Manager and Records submitted to every progress on required reviewing its RMP. Management Group in Information actions. collaboration with internal Governance auditors and local service Committee meeting areas. The Keeper along with a written welcomes this approach update on progress and asks that he is informed since the last meeting.
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 17
of the findings of these self- assessments and audits, Within the IG particularly if they result in department all policies, changes to records procedures, guidance management and frameworks have arrangements. been updated recently. With the exception of As the eHealth Disaster the Document Recovery Plan and Scanning Guidance accompanying procedures which is undergoing a were due to be reviewed review. during the period of this assessment, the Keeper Compliance with the asks that he receives any plan and new version of these accompanying documents as soon as documents has not yet possible. been audited however this remains the intention.
G G G G Update required on any No change No immediate action No change No immediate action required. 14. Shared change required. Update required NHS A&A continues to share Update required on any future Information on any future change information in line with Data change. Protection Legislation. Information Sharing Protocols remain in place with partner agencies. All sharing of information is subject to the appropriate level of risk assessment.
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 18
7. The Public Records (Scotland) Act Assessment Team’s Summary
Version
The progress update submission which has been assessed is the one received by the Assessment Team on 8th January 2020. The progress update was submitted by Natali Higgins, Information Governance Manager (Corporate Records).
The progress update submission makes it clear that it is a submission for NHS Ayrshire and Arran.
PRSA Assessment Team’s Summary
The Assessment Team has reviewed NHS Ayrshire and Arran’s Progress Update submission and agrees that the proper record management arrangements outlined by the fourteen elements in the authority’s plan continue to be properly considered. The Assessment Team commends this authority’s efforts to keep its Records Management Plan under review.
General Comments
NHS Ayrshire and Arran continues to take its records management obligations seriously and is working to bring all elements into full compliance.
Section 5(2) of the Public Records (Scotland) Act 2011 provides the Keeper of the Records of Scotland (the Keeper) with authority to revisit an agreed plan only after five years has elapsed since the date of agreement. Section 5(6) allows authorities to revise their agreed plan at any time and resubmit this for the Keeper’s agreement. The Act does not require authorities to provide regular updates against progress. The Keeper, however, encourages such updates.
The Keeper cannot change the status of elements formally agreed under a voluntary submission, but he can use such submissions to indicate how he might now regard this status should the authority choose to resubmit its plan under section (5)(6) of the Act.
8. The Public Records (Scotland) Act Assessment Team’s Evaluation
Based on the progress update assessment the Assessment Team considers that NHS Ayrshire and Arran continue to take their statutory obligations seriously and are working hard to bring all the elements of their records management arrangements into full compliance with the Act and fulfil the Keeper’s expectations.
The Assessment Team recommends authorities consider publishing PUR assessment reports on their websites as an example of continued good practice both within individual authorities and across the sector.
This report follows the Public Records (Scotland) Act Assessment Team’s review carried out by,
………………………………
Pete Wadley Public Records Officer
A29348745 - NRS - Public Records (Scotland) Act (PRSA) - NHS Ayrshire and Arran - Progress Update Review (PUR) - 2019 Final Report 19