Health Records Manager

Health records managers work within NHS trusts, GP practices, and independent healthcare providers to manage the full lifecycle of patient health records — from registration and creation through to active management, tracking, archiving, and ultimately destruction in accordance with the NHS Records Management Code of Practice. The role operates at the intersection of clinical administration, information governance, and records management professional practice.

Core duties include managing the physical and digital health records library (in trusts still handling paper Lloyd George envelopes or inpatient notes), co-ordinating the retrieval and return of records for clinical appointments and emergency access, managing Subject Access Requests (SARs) under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and responding to Data Subject Access Requests from patients, solicitors, and insurance companies. Managers ensure that records retention schedules are applied correctly — the NHS Records Management Code of Practice 2023 specifies minimum retention periods for different record types — and manage the secure destruction of records that have reached the end of their retention period.

Information governance (IG) compliance is a major strand of the role: completing the NHS Data Security and Protection Toolkit submission, managing IG incidents and breaches, supporting staff IG training, and liaising with the Data Protection Officer. In larger trusts, health records managers lead teams of records clerks, scanning operators, and outpatient booking staff.

Professional development routes include the Information and Records Management Society (IRMS) membership — IRMS is the primary professional body for health records and information management — and the Health Education England (now NHS England) Coding and Information qualifications. The British Computer Society and CILIP (Chartered Institute of Library and Information Professionals) also offer relevant qualifications.

Health records management is a statutory obligation: the NHS Records Management Code of Practice, UK GDPR, the Data Protection Act 2018, and the Access to Health Records Act 1990 all impose legal duties on NHS organisations that require professional records management staff. Every NHS trust must maintain patient records throughout their retention period, respond to Subject Access Requests within statutory timescales, and evidence GDPR compliance — functions that require dedicated professional resource.

The NHS Long Term Plan's commitment to digitising health records (the move to fully electronic patient records) does not eliminate the need for health records professionals — it transforms and extends it, creating demand for migration, indexing, quality assurance, and governance expertise. The growing volume of Subject Access Requests (driven by legal proceedings, insurance claims, and patient rights awareness) is increasing workload. IRMS and NHS England are investing in professionalisation of the health records workforce through formal qualification frameworks.

Morning: reviewing the overnight SAR inbox — four new requests received, two from solicitors for clinical negligence claims and two direct from patients. You register each in the SAR tracking system, identify the relevant records held (inpatient notes, outpatient letters, imaging reports), and set the 30-day response clock. Afternoon: IG incident review — a member of staff reported accidentally sending a patient discharge summary to the wrong GP. You assess the incident against the NHS Data Security and Protection Toolkit serious incident criteria, complete the incident log, notify the DPO, and draft the breach notification letter to the patient. Late afternoon: records management audit of the outpatient notes library — sampling 50 records for correct filing, retention label, and tracking log completion.