Shredding Patient Records: A Guide for Welsh Health Practices

Reception is dealing with a queue, the printer has just produced a duplicate set of notes, and the tray beside it is full of paper that carries patients' names, addresses, dates of birth and clinical detail. In a GP surgery, dental practice, pharmacy or clinic, the everyday paper is the sensitive paper. That changes what your disposal arrangements need to look like.

Why health records sit in a category of their own

Under the UK GDPR, information about someone's health is special category data. It requires an Article 9 condition in addition to an Article 6 lawful basis, together with safeguards appropriate to the risk, and the consequences of getting disposal wrong are correspondingly serious: not just regulatory action, but the kind of local reputational damage a practice never really shakes off. Patients forgive a lot. They don't forgive their notes turning up somewhere they shouldn't.

The ICO's audit guidance recommends secure storage before destruction, suitable methods such as cross-cut shredding or incineration, appropriate third-party contracts and assurance such as audit checks or destruction certificates. These are recognised ways to demonstrate appropriate security rather than separate statutory rules prescribing one method in every case.

The retention question, which isn't ours to answer

Here's where we stop and hand over. For NHS Wales bodies and services to which it applies, retention is governed by the Records Management Code of Practice for Health and Social Care. Independent and private practices must identify the legislation, contracts and professional standards applicable to their own service, and the periods vary enormously by record type, by patient age and by circumstance. Some run for decades.

We're shredders, not clinicians or information governance officers, and we'd be doing you real harm if we published a table of retention periods and you relied on it. Your practice's retention schedule should come from the Code and your professional body. What we can do is destroy what your schedule says is due, when it's due, and give you the evidence.

Two categories, two different arrangements

Daily paper. Duplicate printouts, appointment lists, prescription slips, correspondence, handwritten notes. This needs a locked console within reach of where it's generated, especially at reception and in consulting rooms, plus a collection rhythm that means it never sits around. If the secure bin is further away than the ordinary bin, the ordinary bin wins.

The archive. Deceased patients' notes, records that have passed their retention date, files from a merged or closed list. This is periodic bulk destruction against your schedule, with a certificate per consignment for your information governance file.

The bits that get forgotten

X-ray and imaging film may require a specialist recovery and destruction stream rather than paper shredding. Old appointment diaries, prescription stationery and staff records also need suitable secure disposal. Computers and backup drives require secure erasure or physical destruction and may need separate WEEE or hazardous-waste documentation. Confirm the provider's authorisations, process and evidence for each material type.

More on how the service works is on our confidential waste destruction page, and our healthcare and care homes page covers how we work with clinical settings.

Get in touch

Want consoles where your staff actually need them and certificates for the file? Get in touch and we'll set it up around your practice.