Assessment report - NHS National Services Scotland - National Records of Scotland (NRS)

Home
Publications
Assessment report - NHS National Services Scotland

Share this page

Click here to share this page on Facebook. Click here to share this page on LinkedIn. Click here to share this page on X (formerly known as Twitter).

Contents

Public Records (Scotland) Act 2011
Executive Summary
Authority Background
Assessment Process
Model Plan Elements: Checklist
Keeper’s Summary
Keeper’s Determination
Keeper's Endorsement

1. Public Records (Scotland) Act 2011

The Public Records (Scotland) Act 2011 (the Act) received Royal assent on 20 April 2011. It is the first new public records legislation in Scotland since 1937 and came fully into force on 1 January 2013. Its primary aim is to promote efficient and accountable record keeping by named Scottish public authorities.

The Act has its origins in The Historical Abuse Systemic Review: Residential Schools and Children’s Homes in Scotland 1950-1995 (The Shaw Report) published in 2007. The Shaw Report recorded how its investigations were hampered by poor record keeping and found that thousands of records had been created, but were then lost due to an inadequate legislative framework and poor records management. Crucially, it demonstrated how former residents of children’s homes were denied access to information about their formative years. The Shaw Report demonstrated that management of records in all formats (paper and electronic) is not just a bureaucratic process, but central to good governance and should not be ignored. A follow-up review of public records legislation by the Keeper of the Records of Scotland (the Keeper) found further evidence of poor records management across the public sector. This resulted in the passage of the Act by the Scottish Parliament in March 2011.

The Act requires a named authority to prepare and implement a records management plan (RMP) which must set out proper arrangements for the management of its records. A plan must clearly describe the way the authority cares for the records that it creates, in any format, whilst carrying out its business activities. The RMP must be agreed with the Keeper and regularly reviewed.

2. Executive Summary

This report sets out the findings of the Keeper’s assessment of the common Records Management Plan (RMP) of NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards by the Public Records (Scotland) Act 2011 Assessment Team following its submission to the Keeper on 12th February 2024.

The assessment considered whether the RMP of NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards was developed with proper regard to the 15 elements of the Keeper’s statutory Model Records Management Plan (the Model Plan) under section 8(3) of the Act, and whether in this respect it complies with it and the specific requirements of the Act.

The outcome of the assessment and the Keeper’s decision on whether the RMP of NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards complies with the Act can be found under section 7 of this report with relevant recommendations.

3. Authority Background

NHS National Services Scotland

NHS National Services Scotland (NSS) is a public body and national health board of NHSScotland. It’s mandate is to provide strategic support services and expert advice to Scotland’s health sector while maximising health impacts and cost savings. Accountable to the Scottish Government, NSS works with other organisations across Scotland’s health and care landscape. NSS began operations on 1 April 1974 as the Common Services Agency, following The National Health Service (Functions of the Common Services Agency) (Scotland) Order 1974. In 2013, the Public Services Reform (Functions of the Common Services Agency for the Scottish Health Service) (Scotland) Order 2013 extended the remit of NSS, enabling the provision of services to other bodies, including local authorities and government departments. The following year, the Public Bodies (Joint Working) Scotland Act 2014 reinforced this requirement to maximise health, financial, and environmental impacts by engaging with and offering services to the wider public sector in Scotland.

NSS Strategic Framework 2024 to 2026 | National Services Scotland

Scottish Advisory Committee on Distinction Awards (SACDA)

The Scottish Advisory Committee on Distinction Awards (SACDA) was set up in November 1998 to replace the Scottish Sub-Committee of the Advisory Committee on Distinction Awards (ACDA). SACDA, a non-departmental public body, acts on behalf of the Cabinet Secretary for Health and Sport in deciding which medical and dental consultants in the NHS in Scotland should receive distinction awards for outstanding professional work.

4. Keeper’s Assessment Process

The RMP was assessed by the Public Records (Scotland) Act Assessment Team on behalf of the Keeper. Assessors used the checklist elements listed in section 5, to establish whether Strathclyde Partnership for Transport’s RMP was developed with proper regard to the elements of the Model Plan and is compliant with the Act. The assessment also considered whether there was sufficient supporting evidence of such compliance.

Key

The Keeper agrees this element of an authority’s plan.

The Keeper agrees this element of an authority’s plan as an ‘improvement model’. This means that he is convinced of the authority’s commitment to closing a gap in provision. He will request that he is updated as work on this element progresses.

There is a serious gap in provision for this element with no clear explanation of how this will be addressed. The Keeper may choose to return the RMP on this basis.

5. Model Plan Elements: Checklist

NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards

For simplicity these two separate public authorities will be referred to as ‘NHS NSS’ in the assessment below

Element	Present	Evidence	Notes
1. Senior Officer	G	G	The Public Records (Scotland) Act 2011 (the Act) requires that an individual senior staff member is identified as holding corporate responsibility for records management in a public authority. NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards (NHS NSS) have identified Mary Morgan, Chief Executive Officer, as the individual with overall responsibility for records management in the organisation. The identification of the CEO to this role is supported by an e-mail from Ms Morgan (see under General Comments below), by the Records Management Policy (see element 3), for example at section 6 and by the Information Governance Policy (see also element 3) section 4. Although responsibility for records management in NHS NSS resides ultimately with the CEO this is delegated to the Senior Information Risk Owner (SIRO) and, through the SIRO, to the Corporate Records and Freedom of Information Organisational Lead (see element 2). The NSS Chief Executive has overall responsibility for managing information risk (Information Security Policy - see element 8 - section 6) The Chief Executive has overall accountability for NHS NSS’s compliance with data protection law (Data Protection Policy - see element 9 – section 7). NHS NSS have provided the Keeper with an organisational chart confirming the structure of information governance reporting in the organisation. It is clear that there is an established pathway in place that allows the CEO to understand the records management, information security and information compliance aspects of the RMP. SACDA is not permanently in session and appoints a chair only when necessary. However, the public records of SACDA must be managed even when the committee is not convened. The Chief Executive of NHS NSS accepts the responsibility for these records on the grounds SACDA is supported by NHS NSS in that the NSS Committee Services Team provide secretariat and that SACDA utilise the NSS IT infrastructure and follow all the NSS Corporate Records Management policies and procedures that are explained below. The Keeper agrees that NHS NSS have identified an appropriate individual to this role as required by the Act.
2. Records Manager	G	G	The Act requires that each authority identifies an individual staff member as holding operational responsibility for records management and that this staff member has appropriate corporate responsibility, access to resources and skills. NHS NSS have identified Roddy Mitchell, Corporate Records and Freedom of Information Organisational Lead, as the individual with day-to-day responsibility for implementing the RMP. The identification of the Corporate Records and Freedom of Information Organisational Lead to this role is supported by an e-mail from Mary Morgan, CEO (see element 1) and by the Records Management Policy, for example section 6 (see element 3). It is also supported by the Job Description for Corporate Records Organisational Lead document provided to the Keeper. This includes an objective to lead on “the development and effective implementation of a Records Management Plan, and associated five-year improvement plans, for NHS National Services Scotland (NSS), as specified by the Public Records (Scotland) Act 2011 and act as the first point of contact for records management issues for the Keeper of National Records of Scotland. Includes the undertaking of annual audits of compliance with the NSS Records Management Plan.” The Corporate Records and Freedom of Information Organisational Lead also has a responsibility for developing policies procedures and guidance to take forward records management best practice principles. To implement and maintain the Corporate Business Classification Scheme (see element 4). To deliver record management training (see element 12) and to “develop and implement quality standards, and audit mechanisms for corporate records management to demonstrate NSS’ ongoing compliance with records management requirements” (see element 13). In NHS NSS the Corporate Records and Freedom of Information Organisational Lead sits on the NSS Corporate Governance Leadership Team. The Corporate Records and Freedom of Information Organisational Lead is the author of the RMP. Mr Mitchell is also the author of the Records Management Policy; the Business Classification Change Control Procedure (see element 4); the Document Storage, Retention and Disposal Policy (see elements 4, 5 and 6); the Email Retention Guidelines (see element 5); the Transferring Records of Enduring Value to National Records of Scotland for Permanent Preservation guidance (see element 7); the Records Management Decommissioning of NHS NSS Premises guidance (see element 8); the Document Redaction Guidelines (see element 9) and the Document Version Control and Naming Conventions guidance document (see element 11). It is clear from the above that the identified individual has a detailed knowledge of the records management provision in the authority. The Keeper notes that the Corporate Records and Freedom of Information Organisational Lead is supported by a network of records management ‘champions’ throughout the organisation (see Local Records Management under General Comments below). The Keeper agrees that NHS NSS have identified an appropriate individual to this role as required by the Act.
3. Policy	G	G	The Act requires an authority to have an appropriate policy statement on records management. NHS NSS have an overarching Information Governance Policy which has been provided to the Keeper. This is version 4.5 dated 06 May 2021. This document satisfies the requirements of the Act. However, at an operational level, the aspirations of the Information Governance Policy are supported in more detail by a Corporate Records Management Policy which has also been provided. This is version 4.2. The Keeper understands that, at time of submission, the Records Management Policy was under review. If a finalised version is now available, please attach it to your response to this Interim Report in order that the NHS NSS case file may be kept up-to-date. The Keeper has been provided with a screen-shot showing that staff can access records management policy documents through a link on the NHS NSS intranet to ‘Policies, procedures & guidelines’. Both the Information Governance Policy and the Records Management Policy specifically mention compliance with the Public Records (Scotland) Act 2011. The Keeper agrees that the RMP supports the objectives of the Information Governance Policy and the Records Management Policy. The Keeper agrees that NHS NSS has a formal records management policy statement as required by the Act.
4. Business Classification	A	G	The Keeper expects that the public records of an authority are known and are identified within a structure. Identification of the public records of the authority NHS NSS have adopted the NHS Scotland Business Classification Scheme which has been supplied to the Keeper (version 3.2). The Keeper acknowledges that the NHS NSS Corporate Records and FOI Organisational Lead (see element 2) has been involved, with other health boards, in the development of this Scotland-wide business classification scheme. The Business Classification Scheme is set out in a function/activity/record type format. This must be a business decision for the authority, but a functional scheme, as shown here, is currently considered best-practice. The functions and activities are shown in a separate Business Classification Scheme Functions and Activities document which has also been supplied. The Business Classification Scheme has been expanded to incorporate retention periods against each record type (see element 5). The combination of a business classification scheme and retention schedule into a single ‘one-stop’ business tool is commended. The Keeper has been provided with a screen-shot showing that staff can access these documents through a link on the NHS NSS intranet to ‘Business Classification Scheme’. The Keeper has been provided with training slides and guidance documents introducing the principles of maintaining a business classification scheme to staff. Records-Keeping Structure NHS NSS operate a hybrid system: Public records are held digitally on the Microsoft 365 cloud platform although, at time of submission, the full roll-out of this was incomplete. They also manage public records on line-of-business systems and in hard-copy format both in-house and in a third-party record store. Digital Records: "Currently NSS has a project team in place to create SharePoint architecture using the NHSScotland BCS whilst mapping current record types to those record types listed in the NHSScotland BCS so that an automatic retention period can be applied during migration of records to SharePoint" (RMP page 13) The Keeper agrees that M365, appropriately implemented, is a suitable system for the management of public records in digital format and is, particularly in a larger authority, a measurable improvement on the use of shared-drives. At several points in the RMP and evidence package it is clear that this is a work in progress. For example “NSS have decided to migrate 3 months’ worth of recent records to SharePoint whilst leaving records preceding this time within current Microsoft shared server environments as “Read Only” (RMP page 14) and “Within NSS a single test area has been migrated to SharePoint with plans to migrate another 2 areas before the end of December 2023.” (RMP page 15). The Keeper notes that NSS will impose M365 sensitivity labels to add security classifications of ‘Personal’, ‘Official’, and ‘Official Sensitive’ to records as they are migrated to the new system. The Keeper has been provided with several evidential documents showing the mechanism being used in the M365 roll-out. These include training session slides, sensitivity labelling guides and data-migration instructions. The roll-out of M365 is bound to be incremental and take several years to bed-in properly. The Keeper acknowledges that NHS NSS have correctly identified the importance of appropriate polices, governance and staff training in making this major project a success. NHS NSS have committed to future actions around this project which include that they will: “Continue to work with internal Directorates and the other Health Boards to further develop the NHSScotland BCS and replicate any improvements into the NSS SharePoint BCS. Create SharePoint specific records management guidance for staff around naming conventions, version controlling, records labelling/tagging and retention periods. Ensure that applying record types to documents automatically apply retention periods.” (NSS & SACDA Records Management Improvement Plan RMP page 44). This element is allocated an Amber ‘improvement model’ agreement during this roll-out phase. However, the Keeper would like to acknowledge that NHS NSS have provided her with a substantial update on progress since the RMP was submitted in the spring of 2024. This update shows the implementation of M365 as a records management solution throughout the authority and includes a step-by-step (and Directorate-by-Directorate) timetable. The Keeper has also been provided with statements explaining standardised M365 architecture, security/access design and roles, responsibilities and reporting structures. The identification of potential risks in the M365 roll-out project has also been explained in detail. Line-of-Business Systems: NHS NSS operate line-of-business systems. The Keeper can accept these systems have records management functionality. NHS NSS should be aware that, in the case of a further resubmission, the Keeper will be investigating the use of legacy line-of-business systems in more detail than in this assessment. These are systems that will sit outside the main records management structure and may not be compliant with the authority’s own Information Governance Policy. For the purposes of this assessment it is not required that the Board provides any further statement on this issue. Physical: As noted above, NHS NSS manage some records in hard-copy format and they also have arrangements in place for public records to be managed through a third-party storage supplier. These arrangements are explained in the Document Storage, Retention & Disposal Policy (for example at section 3 ‘Storage Areas’). The Keeper has been supplied with multiple evidential documents showing how physical records created in NHS NSS business areas are manged through the outstore and staff guidance on transmission and retrieval for this store. These include Management of Retention at Store, Records Going to Store, a sample Store Monthly Management Report and the Store Contract Award (showing that the arrangements described in the RMP are operational). The Keeper notes that NHS NSS have a forward action plan to "Review and consolidate the NSS off-site holdings so that all retention reach records can be destroyed and reducing the number of records/boxes alongside our carbon footprint." (NSS & SACDA Records Management Improvement Plan RMP page 44). NHS NSS have provided the Keeper with a statement about the creation (very limited), storage and tracking of paper files within NHS NSS which includes how paper is dealt with on a day-to-day practical basis in-house. E-Mail: NHS NSS has specific e-mail guidance which has been provided to the Keeper. This is NHS National Services Scotland Email Retention Guidelines version 2.1, authored by the Corporate Records and Freedom of Information Organisational Lead (see element 2), dated February 2022. This guidance makes it clear to staff that e-mail may be classed as a corporate record, depending on content, and should be managed under the same systems implemented for the controlled management of digital records described above. In 2013 the Keeper fully agreed this element of the NHS NSS Records Management Plan. It is important to note that the current ‘amber’ grading does not indicate a concern around the record management provision in the authority. It simply signifies that, at time of this submission, the authority was in a transition period. In fact, the Keeper judges that, if appropriately implemented, the M365 transition may represent an improvement in record keeping in NHS NSS.
5. Retention schedule	G	G	The Keeper expects an authority to have allocated retention periods to its public records and for those records to be retained and disposed of in accordance with a Retention Schedule. The Records Management Policy (see element 3) states that the aims and objectives of Corporate Records Management is to ensure that: “Records are retained and disposed of appropriately (see also element 6) using consistent and documented retention and disposal procedures, which include provision for appraisal and the permanent preservation of records with archival value (see element 7).” (Records Management Policy - section 5.1). The NHS NSS Business Classification Scheme (see element 4) identifies retention decisions against each record type. These are supported in Appendix A of the authority’s Document Storage, Retention & Disposal Policy which has been provided to the Keeper. This is version 8.0 dated June 2023. Retention decisions are adopted from the NHS Scotland Records Management Code of Conduct. The Keeper acknowledges that NHS NSS were involved in the creation of that national code. The Keeper has been provided with a screen-shot showing that staff can access the Document Storage, Retention & Disposal Policy through a link on the NHS NSS intranet at ‘How long we should keep our records for’. The Keeper agrees that NHS NSS has a schedule providing retention decisions for the record types created while pursuing its functions.
6. Destruction Arrangements	G	G	The Keeper expects an authority to have allocated retention periods to its public records and for those records to be retained and disposed of in accordance with a Retention Schedule. The Records Management Policy (see element 3) states that the aims and objectives of Corporate Records Management is to ensure that: “Records are retained and disposed of appropriately (see also element 6) using consistent and documented retention and disposal procedures, which include provision for appraisal and the permanent preservation of records with archival value (see element 7).” (Records Management Policy - section 5.1). The NHS NSS Business Classification Scheme (see element 4) identifies retention decisions against each record type. These are supported in Appendix A of the authority’s Document Storage, Retention & Disposal Policy which has been provided to the Keeper. This is version 8.0 dated June 2023. Retention decisions are adopted from the NHS Scotland Records Management Code of Conduct. The Keeper acknowledges that NHS NSS were involved in the creation of that national code. The Keeper has been provided with a screen-shot showing that staff can access the Document Storage, Retention & Disposal Policy through a link on the NHS NSS intranet at ‘How long we should keep our records for’. The Keeper agrees that NHS NSS has a schedule providing retention decisions for the record types created while pursuing its functions.
7. Archiving and Transfer	A	G	The Act requires that all Scottish public authorities identify a suitable repository for the permanent preservation of any records considered suitable for archiving. A formal arrangement for transfer to that repository must be in place. NHS NSS have identified the National Records of Scotland (NRS) as the proper repository for the small selection of their public records suitable for permanent preservation. Some of the public records of NHS NSS will therefore become part of the national collection. NRS is an accredited archive and fully adheres to the Keeper’s Supplementary Guidance on Proper Arrangements for Archiving Public Records. Archive transfer arrangements will operate under the terms of a formal transfer agreement going forward. This supports a commitment in the Records Management Policy (see element 3) section 5: " Records are retained and disposed of appropriately (see also element 6) using consistent and documented retention and disposal procedures, which include provision for appraisal and the permanent preservation of records with archival value." However, this agreement is not fully embedded by both parties. On this issue NHS NSS state (RMP page 22) “"NSS have been regularly liaising with [the] Inspecting Officer at NRS in this area since April 2018 in order to update this MoU in line with current legislative requirements. This updated version has now been returned to NSS with comments from the NRS responding to a number of Central Legal Office queries for review and consideration within NSS”. In February 2025, NHS NSS have confirmed to the Keeper that this process is still progressing through their legal office. The Keeper has been provided with Transferring Records of Enduring Value to National Records of Scotland for Permanent Preservation staff guidance document. The Keeper has also been provided with a screen-shot showing that staff can access records management policy documents through a link on the NHS NSS intranet to ‘Preserve records with the National Records of Scotland’. NHS NSS has an agreement in place for the website to be regularly accessioned: NHS NSS Archive Timeline The Keeper can agree this element of the NHS NSS RMP under improvement model terms while the archiving agreement progresses. It is clear that the authority has selected a suitable archive and has made a commitment to ensure that a formal transfer agreement is in place.
8. Information Security	G	G	The Act requires that public records are held in accordance with information security compliance requirements. The Records Management Policy (see element 3) states that “The aims and objectives of Corporate Records Management is to ensure that: Records are secure – from unauthorised or inadvertent alteration or erasure, that access and disclosure are properly controlled and audit trails will track all use and changes. To ensure that records are held in a robust format which remains readable for as long as records are required” (Records Management Policy section 5.1) With this in mind NHS NSS have an Information Security Policy which has been supplied to the Keeper in evidence. This is version 1.5a approved by the authority's Staff Governance Committee on 1st April 2020. The Information Security Policy “sets out the policy on Information Security that NHS National Services Scotland (NSS) will implement to preserve the confidentiality, integrity and availability of the information on which its operations depend." (Information Security Policy Section 1) The Information Security Policy forms part of ‘NSS Information Security Management System’ which comprise a suite of policy, procedure and guidance documents many of which have been provided to the Keeper in evidence. For example the Keeper acknowledges that they have seen a Mobile Device Policy, a Clear Desk Policy, an Internet Policy and an Encryption Policy (there are several others). The Keeper has been provided with a screen-shot showing staff can access policy and guidance documents through the NHS NSS intranet. There are also links to relevant supporting documents in the Information Security Policy itself. The Information Security Policy clearly applies to records in all formats (section 4) including physical. NSS have a mandatory training course called “Staying Safe Online: Top Tips for Staff” The Keeper has been provided with a screen-shot showing how staff access this training. NHS NSS have developed a cyber security awareness training and guidance package which staff access through a 'cyber security awareness repository'. the Keeper has been provided with some examples from this repository such as ‘Simple Steps to Combat Spam’ and ‘Top 10 Tips on Information Security’. The Keeper agrees that NHS NSS have procedures in place to appropriately ensure the security of their records as required by the Act.
9. Data Protection	G	G	The Keeper expects a Scottish public authority to manage records involving personal data in compliance with data protection law. NHS National Services Scotland is registered as a data controller with the Information Commissioner’s Office (ICO): Information Commissioner's Office - Register of data protection fee payers - Entry details The Scottish Advisory Committee on Distinction Awards is separately registered: Information Commissioner's Office - Register of data protection fee payers - Entry details NHS NSS have a Data Protection Policy. The Keeper has been provided with a copy of this Policy. This is version 2.4 approved by the Staff Governance Committee on the 24 March 2022. The Data Protection Policy explains the 6 principles of data protection (section 5). The Policy also provides staff instruction that they must report data protection breaches, actual or potential (for example at section 7). Members of the public are made aware of their rights and how they can make a subject access request at: Practitioner Services Directorate and Primary Care Contractor Finance Data Protection Notice \| National Services Scotland (‘Your Rights’ section). The Keeper has been provided with a copy of the staff guidance and subject access request template form to show how such requests are processed in NHS NSS. As required by data protection legislation, NHS NSS have identified a Data Protection Officer. At time of submission this role was held on a temporary basis (RMP page 25). If this situation has changed in 2024 please inform the Assessment Team in response to this Interim Report. Either way could you please provide an indication of the staff grade (substantive job title?) of the DPO. NHS NSS have committed to carrying out data protection impact assessments before they begin any processing of personal data which is likely to result in a high risk to individuals The Keeper has been provided with DPIA template, staff guidance and training documentation to show this is operational. NHS NSS have committed, in their RMP (page 42), to maintaining a Record of Processing Activities (ROPA). This is also a commitment in the Information Security Policy - see element 8 - section 5. A sample of the ROPA has been provided to the Keeper as evidence that this commitment is operational. Furthermore, NHS NSS have other supporting guidance for staff, such as Data Protection Guidance, email-handling and good information governance guidance and a Data Protection Staff Awareness Leaflet These have also been shared with the Keeper. The Keeper has been provided with a screen-shot of the dedicated Data Protection page on the NSS intranet. The Records Management Policy (see element 3) and Information Security Policy (see element 8) specifically indicate support for the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Data protection arrangements are specifically supported by other evidence provided to the Keeper, for example the Data Sharing Guide (see element 14) section 2 and the Information Governance Policy (see element 3) section 3. The Keeper agrees that NHS NSS have arrangements in place that should allow them to properly comply with data protection legislation.
10. Business Continuity and Vital Records	G	G	The Keeper expects that record recovery, prioritising vital records, is an integral part of the authority’s business continuity planning. In NHS NSS, all business areas (see Local Records Management under General Comments below) must complete a Business Impact Analysis that must identify “What documentation/records are essential to carry out your critical activities?” (RMP page 30). The Keeper has been provided with a template of the Business Impact Analysis form that must be completed. These impact forms are used to populate the organisation-wide Resilience Management Plan which has also been provided to the Keeper (this is version 3.4 dated 2022). The Keeper agrees that the Resilience Management Plan includes record recovery processes, for example at section 1.3. NHS NSS has a suite of awareness, training and guidance documents around business continuity. The Keeper has been provided with an Information Asset Register (IAR) Vital Records, Awareness Training, Roles and Responsibilities (see Local Records Management under General Comments below) document. The Keeper acknowledges that NHS NSS have provided a screen-shot showing staff access to the Managing Information home page on their intranet. The Keeper agrees that NHS NSS have an approved and operational business continuity process and that information management and records recovery properly feature in the authority’s plans.
11. Audit trail	A	G	The Keeper expects an authority to have processes in place to track public records in such a way that their location is known and changes recorded. The Records Management Policy (see element 3) states that “The aims and objectives of Corporate Records Management is to ensure that: Records can be accessed – records and the information within them can be located and displayed in a way consistent with its initial use, and that the current version is identified where multiple versions exist” (Records Management Policy - section 5.1) Digital Records: The Keeper agrees that the introduction of M365 as a record keeping system, rather than the shared servers used at the time of the 2013 agreement, should address the issue of providing an audit trail for the public records of an authority that are held digitally. The M365 system will automatically apply version control to public records as they are created or amended. However, to best use the powerful e-discovery tool consistent naming convention should be applied. NHS NSS have a staff guidance document, NSS Document Version Control and Naming Conventions, which has been provided to the Keeper. The Keeper agrees that this gives clear and appropriate instructions to staff to ensure that records are named in such a way as will allow efficient tracking. However, the text of the compliance statements in the RMP shows that the full implementation of M365 was, at time of submission, still a work in progress. NHS NSS list as future developments: “Create SharePoint specific records management guidance for staff around naming conventions, version controlling, records labelling/tagging” (NSS & SACDA Records Management Improvement Plan RMP page 44). In this case the Keeper is content to agree this element at an Amber RAG status. The Keeper makes this agreement on the grounds that a suitable solution to a recognised problem has been put in place, but has not yet been finalised. The Keeper requires NHS NSS to provide updates, perhaps through the Progress Update Review mechanism (see element 13). Please note that From January 2025, we will be reviewing the Progress Update Review process towards a more light-touch approach. Physical In-House: See comment against element 4 regarding physical records held in house. Physical External Records Store: The Keeper has been provided with several evidence documents detailing the transfer of records to the external third-party storage contactor including how they are catalogued and tracked. The Keeper agrees this element of the NHS NSS’s records management plan under improvement model terms while the M365 roll-out is underway.
12. Competency Framework for records management staff	G	G	The Keeper expects staff creating, or otherwise processing records, to be appropriately trained and supported. The Records Management Policy (see element 3) states that The aims and objectives of Corporate Records Management is to ensure that: Staff are trained so that all staff are made aware of their responsibilities for record-keeping and record management. (Records Management Policy - section 5.1) The Corporate Records and Freedom of Information Organisational Lead (see element 2) holds a professional practitioner certification in Scottish public sector records management (certificate provided). He also has considerable practical experience in records management over several years. The Corporate Records and Freedom of Information Organisational Lead has annual Continual Professional Development and Personal Development Plans which specifically include records management objectives “so that their professional knowledge can be improved upon whilst benefitting the organisation.” The Keeper has been provided with this individual’s personal objectives for 2022 and 2023 and thanks them for this submission. The Keeper agrees that they are entirely appropriate for the individual responsible for the day-to-day implementation of the RMP. The Keeper also acknowledges that they contain suitable training opportunities. The Corporate Records and Freedom of Information Organisational Lead is responsible for to developing records management training to staff of all levels as required. All employees are mandatorily required to undertake Information Governance e-learning (RMP page 39). This is a commitment from the Records Management Policy (section 9) the Information Security Policy (section 5) and the Data Protection Policy (for example page 10). The Keeper has been provided with a screen-shot of the mandatory training home page on their intranet. New-starts must undertake information governance training at induction. The Keeper has been provided with the NHS NSS Induction Week 1 Records Management Overview statement and Information Governance Induction Quiz as evidence that this commitment is operational. The Keeper agrees that the individual identified at element 2 has the appropriate responsibilities, resources and skills to implement the records management plan. Furthermore, he agrees that NHS NSS consider information governance training for staff as required.
13. Assessment and Review	G	G	Section 1(5)(i)(a) of the Act says that an authority must keep its records management plan under review. The Keeper has noted that there is a future action listed in the RMP (section 5) to "Ensure the annual reviews are completed and build in resilience so that the business can cope with resource issues.” The RMP is reviewed annually by local business areas (see Local Records Management under General Comments below). The review is carried out using a records management improvement plan exercise. The results of this exercise are used to populate a Consolidated Assessment and Improvement Plan. The Keeper has been provided with the documentation that informs the local exercises, including detailed staff completion guidance, and with the Consolidated Assessment and Improvement Plan that was used to develop this RMP resubmission. NHS NSS commit to using the Keeper’s Progress Update Review (PUR) reporting methodology going forward (RMP page 41). Progress Update Reviews - National Records of Scotland (NRS) This commitment is welcome and the Keeper’s Assessment Team acknowledge that this was used by NHS NSS in 2021. It should be noted that PUR is a way of collating the results of a review not a review methodology in itself. The review will be pursued under self-assessment exercise mentioned above. From January 2025, we will be reviewing the Progress Update Review process towards a more light-touch approach. NHS NSS have provided the following explanation of the reporting process: “Once Directors have signed off their individual Records Management Improvement Plans (RMIP) they are consolidated into a single NSS RMIP that is reviewed by the Associate Director, Corporate Governance & Board Services (NSS Board Secretary). Once reviewed/approved the consolidated RMIP progresses to the NSS Corporate Governance Oversight Group (CGOG) for review and approvals. The Director of FCGLS is chair of the CGOG. Once reviewed/approved by CGOG the RMIP progresses to the NSS Audit & Risk Committee (ARC) for final reviews and approvals. Once approved the individual RMIPs are then monitored by their respective Directorate’s senior management teams to review and record progress in preparation of the next RMIP exercise to restart the RMIP cycle.” Each policy relating to information or records management created by NHS NSS will generally be reviewed on an biennial basis to ensure they remain up-to-date. this is confirmed by the review sections of the various evidence documents. Some of these review dates may have elapsed since the RMP/evidence package was submitted to the Keeper. It is not necessary for the Keeper’s agreement, but she would be happy to have the newest versions of any evidence for the purposes of keeping the NHS NSS case file up-to-date. The Keeper agrees that NHS NSS has made a firm commitment to review their RMP as required by the Act and have explained who will carry out this review and by what methodology. Furthermore they agree that supporting policy and guidance documents have appropriate review periods allocated.
14. Shared Information	G	G	The Keeper expects a Scottish public authority to ensure that information sharing, both within the Authority and with other bodies or individuals, is necessary, lawful and controlled. NHS NSS share information using the NHS Data Sharing ‘Toolkit’. The Keeper is familiar with the ‘toolkit’ and agrees that it provides a secure and controlled information sharing methodology for NHS boards. NHS NSS have created a Data Sharing Guide and Information Sharing Toolkit Introduction document both of which have been shared with the Keeper. The Guide is v1.1 dated 2016. The Keeper notes that this document therefore predates GDPR and refers to the Data Protection Act 1998. However, the Keeper is content that the principles are valid and that other evidence documents provided properly support the compliance statements in the RMP (pages 42 and 43). However, it is recommended that the Data Sharing Guide is updated as soon as is practical. Active Information Sharing Agreements are registered in the NHS NSS Register of Data Sharing Agreements which has been provided to the Keeper. This shows, for example information sharing agreements between NHS NSS and the Crown Office. NHS NSS have also provided a sample of one of these agreements (between NHS NSS, Public Health Scotland and Local Authorities). The Keeper is therefore satisfied that the arrangements explained in the RMP are operational. The Keeper agrees that NHS NSS properly considers records governance when undertaking information sharing programmes.
15. Public records created or held by third parties	N/A	N/A	The Public Records (Scotland) Act 2011 (PRSA) makes it clear that records created by third parties when carrying out the functions of a scheduled authority should be considered ‘public records’ - PRSA Part 1 3 (1)(b). NHS NSS are quite clear in their Records Management Plan (page 43) that “After discussions with the NSS National Procurement Directorate it has been confirmed that NSS does not sub-contract out our statutory functions.” And the Keeper can, therefore, agree this element does not apply to this authority.

General Notes on submission

This assessment is on the Records Management Plan (RMP) submitted by NHS National Services Scotland, for the Keeper of the Records of Scotland’s (the Keeper) agreement, on 30th January 2024. This is RMP 2023 version 1, approved by Mary Morgan, Chief Executive Officer (see element 1) on 29th January 2024. The RMP is a common plan between NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards (SACDA) who are separately scheduled under the Public Records (Scotland) Act 2011. The Keeper agrees that the records management provision of SACDA is entirely set within the systems of NHS National Services Scotland and therefore a common plan is, in this case, appropriate.

The RMP is signed by the Chief Executive.

The RMP submission was supported by a suitable evidence package and by a copy of an e-mail from the Chief Executive (see element 1), dated September 2023, in which she endorses the identification of the Corporate Records and Freedom of Information Organisational Lead (see element 2) as the individual with day-to-day responsibility for implementing the plan.

This is the second common RMP from NSS and SACDA assessed by the Keeper. Their first RMP was agreed by the then Keeper on 29th November 2013: NHS NSS Keeper's Report

The RMP mentions compliance with the Public Records (Scotland) Act 2011 and is set out in the structure of the Keeper’s 15 element Model Plan: Model Records Management Plan - National Records of Scotland (NRS)

The NHS NSS Records Management Policy (see element 3) states:

“NHS National Services Scotland is committed to a systematic and planned approach to the Corporate Management of Records within the organisation, from their creation to their ultimate disposal. This will ensure that NSS can control both the quality and quantity and security of the information that it generates; it can maintain that information in an effective manner whilst ensuring compliance with the recommendations of the appropriate authorities”. (Records Management Policy section 4.1)

The Keeper fully agrees this statement.

NHS NSS recognise public records as a business asset that must be appropriately managed (for example at RMP page 42 or Records Management Policy section 3.5). This is an important recognition and the Keeper welcomes it.

Local Records Management

There is ample evidence in the RMP that NHS NSS have designed their records management provision with close engagement with local business areas in mind.

Each business area has an Information asset owner (IAO). This role is usually at director or associate director level. As IAOs, directors are responsible for ensuring that their business areas implement relevant information policies and are responsible for the day-to-day management of information risks.

The Keeper has been provided with an Information Asset Owners NHS NSS Roles and Responsibilities document (Published: 2022 ‘owner’: Corporate Records and Freedom of Information Organisational Lead – see element 2). It explains that the IAOs in NHS NSS are to:

“understand and address risks to the asset; report any data breaches when they occur and manage them appropriately;
provide assurance to the SIRO annually that their IAs are up to date and risks managed;
lead and foster a culture that values, protects and uses information for the public good that is underpinned by data principles
know what information the asset holds, and processes in place to manage what is transferred in or out of it;
know who has access to the asset and why and ensure the asset is monitored;
Ensure the asset is fully used for the public good including responding to access requests.”

NSS IAOs are identified in an Information Asset Register.

IAOs undertake specific training on their responsibilities when assuming the role. The Keeper has been provided with a copy of the training slides.

IAOs are supported by Local Records Managers (Records Management Policy section 6.8) or ‘champions’ who are “responsible for advising and supporting operational staff in line with corporate records management policies, procedures, and guidance” (RMP page 8). They act as a point of liaison between the business area and the Corporate Records and Freedom of Information Organisational Lead and as such allow him to understand how the RMP is being implemented in practice. Champions are also “responsible for ensuring new starts are aware of any local records management requirements through more specialised training relating to their individual roles.” (RMP page 38)

6. Keeper’s Summary

Elements 1-15 that the Keeper considers should be in a public authority records management plan have been properly considered by NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards. Policies and governance structures are in place to implement the actions required by the plan.

Elements that require development by NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards are as follows:

4. Business Classification
7. Archiving and Transfer
11. Audit trail

7. Keeper’s Determination

Based on the assessment process detailed above, the Keeper agrees the RMP of NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards.

The Keeper recommends that NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards should publish its agreed RMP as an example of good practice within the authority and the sector.

This report follows the Keeper’s assessment carried out by:

Pete Wadley
Public Records Officer

Liz Course
Public Records Officer

8. Endorsement of Report by the Keeper of the Records of Scotland

The report has been examined and is endorsed under the signature of the Keeper of the Records of Scotland as proof of compliance under section 1 of the Public Records (Scotland) Act 2011, and confirms formal agreement by the Keeper of the RMP as submitted by NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards. In agreeing this RMP, the Keeper expects NHS National Services Scotland and the Scottish Advisory Committee on Distinction Awards to fully implement the agreed RMP and meet its obligations under the Act.

Laura Mitchell
Deputy Keeper of the Records of Scotland
Direct Email: RG-Keeper@nrscotland.gov.uk

File downloads

Assessment Report NHS National Services Scotland March 2025

File type: PDF,
File size: 378.13 KB

Was this page helpful? *

Yes

Yes, but

Your comments