HCSA clinical records policy template

1Purpose

1. 1.1This policy sets out how [Clinic name] creates, keeps, shares and disposes of clinical records, so that every record is accurate, complete, contemporaneous and secure.
2. 1.2It supports the standards HCSA applies to clinical records, set out in the mapping at the end of this document.

2Scope

1. 2.1This policy covers every clinical record made at [Clinic name], on paper or in software, including notes, letters, results, consent, images and messages with patients.
2. 2.2It applies to every clinician, member of the front desk team and contractor with access to a record.

3Responsibilities

1. 3.1[Name, role] owns this policy and the clinic's records system.
2. 3.2Each clinician is responsible for the records they make, and signs every note, letter and referral they write.
3. 3.3[Name, role] reviews access to records each month and acts on anything unexplained.

4Making a record

1. 4.1A clinical note is written on the day of the consultation, and signed and dated by the clinician who saw the patient.
2. 4.2Every record identifies the patient with at least two identifiers, such as full name and date of birth.
3. 4.3Allergies, current medicines and relevant history are recorded and checked at each visit.
4. 4.4A note drafted with software, including an AI scribe, is read, corrected where needed and signed by the clinician before it is relied on.
5. 4.5A correction after signing is added as a dated addendum, and the original entry stays readable.

5Access and security

1. 5.1Every person has a named account, and access is limited to what their role needs.
2. 5.2Every read and every change of a record is logged against the account that made it.
3. 5.3Records are kept on systems hosted in [country], under the law that applies to [Clinic name].
4. 5.4A suspected breach is reported to [Name, role] at once, and handled under the clinic's breach procedure.

6Sharing and retention

1. 6.1A record is shared only with the patient's consent or where the law requires it, and each disclosure is recorded.
2. 6.2A patient's request for a copy of their record is answered within [period set by law].
3. 6.3Keep outpatient records for at least 6 years, the period the licence conditions set.

7Audit

1. 7.1[Number] records per clinician are audited each [quarter] for completeness, signature and timeliness.
2. 7.2The results and the actions taken are minuted and kept as evidence for an HCSA inspection.

8Review

1. 8.1[Name, role] reviews this document every [12] months, and sooner after an incident, a complaint or a change in the regulator's requirements.
2. 8.2Each review is recorded with the date, the reviewer and what changed, and the previous version is kept.
3. 8.3Staff are told of each change, and their acknowledgement is recorded.

9Where this sits in the HCSA framework

• Patient health recordsRetention set by licence conditions, 6 years for outpatient records
  Health Information Act, enacted February 2026, not yet in force
  NEHR contribution, GP clinics by September 2027, specialists by September 2028