Clinical governance & patient data disposal for healthcare organisations.
NHS trusts, clinical commissioning groups, private hospitals, clinics and integrated care boards all hold vast quantities of special category health data. The NHS Records Management Code, UK GDPR Article 9 and the National Data Guardian's standards all require that this data is destroyed securely and with documented evidence when retention periods are met.
Sets minimum retention periods and requires documented destruction at end of each record's period.
Patient health data requires the highest level of security including at the point of disposal.
Confidentiality obligations extend to secure disposal with documented evidence of destruction.
Inspectors expect documented procedures and certificates of destruction as evidence.
Why healthcare organisations face the strictest data disposal requirements.
Healthcare organisations process special category personal data on a scale unmatched by any other sector. Patient health records, clinical notes, investigation results, referral correspondence, consent forms and end-of-life documentation all carry the maximum level of data protection obligation under UK GDPR Article 9 — and this obligation extends to the moment of destruction.
The ICO has historically issued its largest healthcare sector fines for breaches arising from inadequate document disposal — patient records found in public spaces, clinical documents placed in general waste, insufficient shredding procedures and lack of documented evidence of destruction. The common factor in all these cases was a failure to treat physical document disposal as part of clinical governance rather than as a routine office management task.
The NHS Records Management Code of Practice specifically requires that destruction of records is documented, with a certificate of destruction from the shredding provider retained as evidence. This certificate becomes part of the organisation's information governance records and demonstrates compliance during CQC inspections, NHS England reviews and ICO investigations.
The Code specifically requires that records destruction is documented and that a certificate of destruction is obtained from the provider as evidence of compliant disposal.
Patient health data is special category data requiring the highest security at every lifecycle stage. Inadequate disposal is a significant GDPR breach with potential for substantial ICO fines.
The NDG's confidentiality standards require that patient information is protected throughout its lifecycle. This explicitly includes secure disposal with documented evidence.
The ICO has issued significant fines to NHS organisations for data breaches arising from insecure document disposal. A documented shredding service is the most straightforward mitigation.
NHS and private healthcare across the region.
Large volume patient records, clinical notes, correspondence and administrative documents requiring regular scheduled destruction with full documentation.
Commissioning records, performance data, provider correspondence and patient pathway documentation at end of retention period.
Private and NHS clinical settings generating patient records, consent forms, treatment documentation and referral correspondence.
Mental health records carry extended retention periods and require particularly careful handling at disposal due to their highly sensitive nature.
Community health records, children's health files, health visitor records and school nursing documentation at end of retention.
Private hospitals, cosmetic clinics, diagnostics centres and specialist treatment providers with the same clinical governance obligations as NHS organisations.
All clinical and administrative records accepted.
Clinical notes, medical histories, consultation records and all patient-identifiable documentation at end of retention.
Blood test results, pathology reports, diagnostic imaging reports and investigation correspondence.
Treatment consent, procedure consent, research participation consent and information sharing consent documentation.
Referral letters, discharge summaries, GP correspondence and inter-departmental clinical communications.
Prescription records, medication administration charts, drug chart documentation and pharmacy correspondence.
Mental health assessments, care programme approach documents, tribunal correspondence and section papers.
Employee records, professional registration documents, DBS certificates, appraisal records and HR correspondence.
Procurement records, budget documents, invoices and administrative correspondence at end of retention period.
Clinical audit documents, incident investigation records, complaint files and governance correspondence.
Key retention periods under the NHS Records Management Code.
These are minimum retention periods set by the NHS Records Management Code of Practice. Once met, secure destruction with a certificate of destruction is required.
| Record type | Minimum retention | Basis |
|---|---|---|
| Adult patient health records | 8 years After last contact or death | NHS Records Management Code |
| Children's health records | Until 25th birthday Or 26th if last seen at 17 | NHS Records Management Code |
| Mental health records | 20 years After last contact or 8 years after death | NHS Records Management Code |
| Maternity records | 25 years After last entry | NHS Records Management Code |
| Cancer records | 8 years After last contact (30 years if still active) | NHS Records Management Code |
| Accident & emergency records | 8 years After last attendance | NHS Records Management Code |
| Staff health records | 8 years After employment ends | NHS Records Management Code |
| Incident investigation records | 10 years After closure | NHS Records Management Code |
This table provides indicative periods. Always refer to the NHS Records Management Code of Practice for the full retention schedule applicable to your organisation.
Fixed prices. Published upfront.
All plans include free sacks or lockable bin and a certificate of destruction after every collection. Multi-site pricing for larger organisations.
Serving healthcare organisations across three counties.
Trusted by healthcare organisations across the region.
"Professional and completely reliable. The certificate of destruction is exactly what our clinical governance team needs for our compliance records. Collections are always on time."
"Switched to Clearcut for our healthcare organisation. Consistent service, transparent pricing and the NHS Records Code compliant documentation is always right. Highly recommend."
Healthcare shredding FAQs
Get a quote for your healthcare organisation.
We work with NHS and private healthcare organisations across Dorset, Hampshire and Wiltshire. Tell us your requirements and we'll confirm a price the same day.
89 Commercial Road, Bournemouth, England, BH2 5RR
Office@Clearcutconfidentialwaste.co.uk
01202 022409
© 2026 Clearcut Confidential Waste