Home
Publications
Progress Update Review - NHS Shetland

Progress Update Reviews Records and archives

Progress Update Review - NHS Shetland

Date published: 21 February 2025

Share this page

Click here to share this page on Facebook. Click here to share this page on LinkedIn. Click here to share this page on X (formerly known as Twitter).

Contents

Public Records (Scotland) Act 2011
Progress Update Review (PUR) Mechanism
Executive Summary
Authority Background
Assessment Process
Progress Update Review (PUR): NHS Shetland
The Public Records (Scotland) Act Assessment Team’s Summary
The Public Records (Scotland) Act Assessment Team’s Evaluation

1. Public Records (Scotland) Act 2011

The Public Records (Scotland) Act 2011 (the Act) received Royal Assent on 20 April 2011. It is the first new public records legislation in Scotland since 1937 and came into force on 1 January 2013. Its primary aim is to promote efficient and accountable record keeping by named Scottish public authorities.

The Act has its origins in The Historical Abuse Systemic Review: Residential Schools and Children’s Homes in Scotland 1950-1995 (The Shaw Report) published in 2007. The Shaw Report recorded how its investigations were hampered by poor recordkeeping and found that thousands of records had been created, but were then lost due to an inadequate legislative framework and poor records management. Crucially, it demonstrated how former residents of children’s homes were denied access to information about their formative years. The Shaw Report demonstrated that management of records in all formats (paper and electronic) is not just a bureaucratic process, but central to good governance and should not be ignored. A follow-up review of public records legislation by the Keeper of the Records of Scotland (the Keeper) found further evidence of poor records management across the public sector. This resulted in the passage of the Act by the Scottish Parliament in March 2011.

The Act requires a named authority to prepare and implement a records management plan (RMP) which must set out proper arrangements for the management of its records. A plan must clearly describe the way the authority cares for the records that it creates, in any format, whilst carrying out its business activities. The RMP must be agreed with the Keeper and regularly reviewed.

2. Progress Update Review (PUR) Mechanism

Under section 5(1) & (2) of the Act the Keeper may only require a review of an authority’s agreed RMP to be undertaken not earlier than five years after the date on which the authority’s RMP was last agreed. Regardless of whether an authority has successfully achieved its goals identified in its RMP or continues to work towards them, the minimum period of five years before the Keeper can require a review of a RMP does not allow for continuous progress to be captured and recognised.

The success of the Act to date is attributable to a large degree to meaningful communication between the Keeper, the Assessment Team, and named public authorities. Consultation with Key Contacts has highlighted the desirability of a mechanism to facilitate regular, constructive dialogue between stakeholders and the Assessment Team. Many authorities have themselves recognised that such regular communication is necessary to keep their agreed plans up to date following inevitable organisational change. Following meetings between authorities and the Assessment Team, a reporting mechanism through which progress and local initiatives can be acknowledged and reviewed by the Assessment Team was proposed. Key Contacts have expressed the hope that through submission of regular updates, the momentum generated by the Act can continue to be sustained at all levels within authorities.

The PUR self-assessment review mechanism was developed in collaboration with stakeholders and was formally announced in the Keeper’s Annual Report published on 12 August 2016. The completion of the PUR process enables authorities to be credited for the progress they are effecting and to receive constructive advice concerning on-going developments. Engaging with this mechanism will not only maintain the spirit of the Act by encouraging senior management to recognise the need for good records management practices, but will also help authorities comply with their statutory obligation under section 5(1)(a) of the Act to keep their RMP under review.

3. Executive Summary

This Report sets out the findings of the Public Records (Scotland) Act 2011 (the Act) Assessment Team’s consideration of the Progress Update template submitted for NHS Shetland. The outcome of the assessment and relevant feedback can be found under sections 6 – 8.

4. Authority Background

Shetland NHS Board is responsible for health care for a population of around 23,000. Local Hospital and Community Services are provided from the Gilbert Bain Hospital. In addition, visiting consultants from NHS Grampian provide out-patient clinics as well as in-patient and day-case surgery to supplement the service provided by locally-based Consultants in General Medicine, General Surgery, Anaesthetics and Psychiatry.

Board Objectives:

To continue to improve and protect the health of the people of Shetland
To provide quality, effective and safe services, delivered in the most appropriate setting for the patient
To redesign services where appropriate, in partnership, to ensure a modern sustainable local health service
To provide best value for resources and deliver financial balance
To ensure sufficient organisational capacity and resilience

https://www.shb.scot.nhs.uk/

5. Assessment Process

A PUR submission is evaluated by the Act’s Assessment Team. The self-assessment process invites authorities to complete a template and send it to the Assessment Team one year after the date of agreement of its RMP and every year thereafter. The self-assessment template highlights where an authority’s plan achieved agreement on an improvement basis and invites updates under those ‘Amber’ elements. However, it also provides an opportunity for authorities not simply to report on progress against improvements, but to comment on any new initiatives, highlight innovations, or record changes to existing arrangements under those elements that had attracted an initial ‘Green’ score in their original RMP submission.

The assessment report considers statements made by an authority under the elements of its agreed Plan that included improvement models. It reflects any changes and/or progress made towards achieving full compliance in those areas where agreement under improvement was made in the Keeper’s Assessment Report of their RMP. The PUR assessment report also considers statements of further progress made in elements already compliant under the Act.

Engagement with the PUR mechanism for assessment cannot alter the Keeper’s Assessment Report of an authority’s agreed RMP or any RAG assessment within it. Instead the PUR Final Report records the Assessment Team’s evaluation of the submission and its opinion on the progress being made by the authority since agreeing its RMP. The team’s assessment provides an informal indication of what marking an authority could expect should it submit a revised RMP to the Keeper under the Act, although such assessment is made without prejudice to the Keeper’s right to adopt a different marking at that stage.

Key

Green

The Assessment Team agrees this element of an authority’s plan.

Amber

The Assessment Team agrees this element of an authority’s progress update submission as an ‘improvement model’. This means that they are convinced of the authority’s commitment to closing a gap in provision. They will request that they are updated as work on this element progresses.

Red

There is a serious gap in provision for this element with no clear explanation of how this will be addressed. The Assessment Team may choose to notify the Keeper on this basis.

6. Progress Update Review (PUR): NHS Shetland

Element 1: Senior Officer

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

Update required on any change.

Self-assessment update - 3 July 2023

Show this section

With effect from 01 July 2023, the Executive Lead is now Brian Chittick, Chief Executive of NHS Shetland.

Progress review - 31 January 2024

Show this section

The Assessment Team thanks NHS Shetland for this update which has been noted.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No change.

Progress update review - 21 February 2025

Show this section

Thank you for confirming that there have been no changes to this Element. Update required on any future change.

Element 2: Records Manager

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

Update required on any change.

Self-assessment update - 3 July 2023

Show this section

NHS Shetland recognises it needs to recruit a qualified and experienced Corporate Records Manager (CRM).

The plan to recruit a CRM in 2023-24 was established in an agreed IG Department business case.

NB Recruitment in 23-24 is unlikely because of the continuing financial pressures faced by Boards.

Appendix 1 – Proposed Departmental Structure

Progress review - 31 January 2024

Show this section

Thank you for this update on Corporate Records Manager recruitment process. The Team acknowledges that NHS Shetland may not be able to push forward with this in the current financial year due to financial pressures, but hopes progress can be made in 2024-25. The Team’s Key Contact and the person responsible for day-to-day records management under Element 2 remains NHS Shetland’s Head of Information Governance / DPO.

The proposed restructure of the department is also noted with many thanks.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

The budget to recruit a substantive Corporate Records Manager / RM Lead has been approved for 2024-25.

Work is progress to establish the appropriate Agenda for Change salary scale for the post. Thereafter, recruitment will commence at the earliest opportunity.

Additional Update provided by the authority in February 2025: In NHS Shetland, operational responsibility for records management is shared between Dina Strati, Corporate Records Manager (corporate records) and Shreyansh Kayastha, Health Records & Clinical Coding Manager (health records). These colleagues are responsible for the provision of records management services for directly provided NHS Shetland services and oversee the Memorandum of Understanding with Shetland Archives.

Progress update review - 21 February 2025

Show this section

Thank you for this positive update on records management investment.

The most recent update given by NHS Shetland, provided in February 2025, has indicated that a Corporate Records Manager and RM Lead is now in post, and the Assessment Team has been provided with relevant contact details. This is great news.

Update require on any future change.

Element 3: Policy

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

Update required on any change.

Self-assessment update - 3 July 2023

Show this section

The RM Policy remains overdue for review.

However, work is now underway to review, refresh and align all Records Management and IG policies.

The timescale for this work is set out in the updated Records Management Action Plan.

Progress is slow due to workload pressures and resource constraints.

Appendix 2 – RMP Action Plan v1.6

Progress review - 31 January 2024

Show this section

Thank you for this update. While NHS Shetland’s Records Management Policy re mains overdue for review, a formal records management policy or policy statement is in place.

The planned refresh, review and realignment of all RM and IG policies is a very positive step, even if slow progress is expected.

It is also good to hear that an Action Plan and an action tracker is in place to monitor progress. This has been received by the Assessment Team with thanks.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Appendix 1 – RMP Action Plan v1.8

It is our expectation that the recruitment of a Corporate Records Manager / RM Lead will provide the expertise and resource required for NHS Shetland to make timely progress across all areas of its RMP.

Progress update review - 21 February 2025

Show this section

Thank you for letting us know that there have been no significant changes under this Element, and that that the NHS Shetland Records Management Policy remains operational

Receipt of the High-Level Records Management Action plan is noted with thanks.

Element 4: Business Classification

Status:

8 March 2018 - agreed plan - Amber
31 January 2024 - review - Amber
21 February 2025 - review - Amber

Keeper's Report - 8 March 2018

Show this section

The work to develop the BCS is included in the Records Management Action Plan (evidence 012) and has an estimated completion date of October 2018. The Keeper requests that he is kept informed of the progress of this work. NHS Shetland has committed to using the Progress Update Review (PUR) mechanism to review progress and inform the Keeper.

The commitment to undertake the implementation of an EDRMS is confirmed by an extract from the 2017/18 eHealth Work Plan presented to the eHealth Informatics Support Group (evidence 017).

Self-assessment update - 3 July 2023

Show this section

As noted in our 2022 PUR, NHS Shetland plans to implement SharePoint as its EDRMS (via the national NHS Scotland rollout of M365).

The pace of the national rollout of M365 continues to present challenges for the organisation. NHS Shetland awaits details of the timetable that will support its implementation of SharePoint.

The national M365 Operational Delivery Group (ODG) conducted a feedback exercise in the spring of 2023.

A response to that feedback is due to be presented by the ODG in early August.

Early indications suggest that the concerns of Boards have been heard and that plans are being developed to address them.

Progress review - 31 January 2024

Show this section

Element 3 stipulates that the authority’s records are known and are identified within a structure, ideally founded on function.

As it evolves, the M365 implementation will very likely have an overarching impact on IAR Business Classification arrangement development. The Assessment Team thanks NHS Shetland for indicating that SharePoint (M365) will be implemented as the Board’s records management solution in line with the rest of NHS Scotland.

It is understood that this implementation will be gradual and take years to bed in properly. The Assessment Team appreciates that NHS Shetland is not yet able to provide a schedule for this implementation. It is good to hear, however, that it continues its engagement with the National M365 Operational Delivery Group, including a feedback exercise.

This Element will remain at Amber as the work continues. The Assessment Team looks forward to being updated on progress in this Element in subsequent PURs.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

As noted previously, NHS Shetland plans to implement SharePoint as its EDRMS (via the national NHS Scotland rollout of M365).

NHS Shetland is encouraged to note the recent refresh of the national M365 programme and the programme’s recognition of the importance of timely progress in the rollout of SharePoint.

Progress update review - 21 February 2025

Show this section

Element 4 focuses on Business Classification, and stipulates that records are both known and are identified within a structure, ideally founded on function. This can take the form of a business classification scheme, information asset register or similar.

The NHS Scotland-wide implementation of SharePoint as a records management solution is noted. It is understood that a schedule for this implementation for NHS Shetland is not yet in place, but is planned in concert with other NHS Boards.

This Element will remain at Amber while work continues. The Assessment Team looks forward to being updated on progress in this Element in subsequent PURs.

Element 5: Retention schedule

Status:

8 March 2018 - agreed plan - Amber
31 January 2024 - review - Amber
21 February 2025 - review - Amber

Keeper's Report - 8 March 2018

Show this section

The Records Management Procedure: non-clinical records The Procedure will undergo a full review prior to April 2018. The Keeper requests that he is sent the updated version once it becomes available.

Procedure for the Retention and Destruction of Personal Health Records The Procedure is currently under review and it advises that staff should contact their local records management representative for up-to-date advice. The Keeper requests that he is sent the updated version once it becomes available.

The RMP states that retention rules are not currently being applied to electronic records held on shared drive networks, emails or some business systems. This will be addressed under Action 5.2 of the Records Management Action Plan (evidence 012) which has an estimated completion date of December 2020.

The ‘Improvement Action’ section of this Element states that NHS Shetland intends to develop a detailed Information Asset Register (IAR) and a comprehensive BCS as part of the implementation of an EDRMS. This work will allow the consistent application of retention schedules. The development of the IAR is due for completion in October 2019. Work has already commenced on populating the IAR and NHS Shetland intends to produce a completed draft IAR by the end of March 2018.
The Keeper can agree this Element on an ‘Improvement Model’ basis. This means that the authority has identified a gap in provision (the lack of consistent application of retention schedules) and has identified how it intends to close this gap. This agreement is conditional on the Keeper being kept up-to-date on the progress of work to close this gap.

Self-assessment update - 3 July 2023

Show this section

Work on reviewing all paper and digital records to achieve, and maintain, compliance with established retention and disposal schedules is in progress, however this is still slow.

The previously reported work to remediate the emergency rollout of many new electronic assets and ad-hoc records storage locations is ongoing.

In recognition of the challenges we face in this area, we have proposed a more realistic target date of 31/03/2027 in the updated RMP Action Plan (Appendix 2).

On a more positive note, NHS Shetland has successfully digitised an extensive collection of acetate x-ray film. This has improved access to the records, created additional space in the estate and reduced a significant fire risk.

Progress review - 31 January 2024

Show this section

Thank you for letting us know that progress is being made, albeit slowly. While established retention and disposal schedules are being followed manually in the current hybrid system with paper records and digital records held on shared drives, it is clear that the implementation of SharePoint and M365 will have a significant impact on this area.

The Team notes that the target date has been revised to 31/03/2027.

It is excellent to hear of recent success in digitising acetate x-ray film in order to keep the informational content accessible whilst recognising the significant fire risk posed by the original format.

This Element will remain at Amber while work continues. Subsequent PURs may give NHS Shetland a convenient opportunity to update the Keeper on continuing progress.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Thank you for letting the Assessment Team know that there have been no major changes to Retention Schedules. It is reassuring to know that this Element will be progressed by the new Corporate Records Manager alongside the M365 implementation.

This Element will remain at Amber while work continues. The Assessment Team looks forward to being updated on progress in this Element in subsequent PURs.

Element 6: Destruction arrangements

Status:

8 March 2018 - agreed plan - Amber
31 January 2024 - review - Amber
21 February 2025 - review - Amber

Keeper's Report - 8 March 2018

Show this section

The RMP (under Element 5) states that at present NHS Shetland does not actively apply retention rules to electronic records stored on shared network drives, emails or some line-of-business systems. It is anticipated that the development of an EDRMS based on a detailed BCS will greatly improve the capability to systematically delete electronic records in accordance with the retention schedules. It is anticipated that the implementation of the EDRMS will be completed by June 2021. NHS Shetland has committed to update the Keeper on progress by using the PUR mechanism.
The RMP also states that NHS Shetland intends to develop a disposal register to record the fact that records scheduled for destruction have been securely disposed of.

This action is built in to the Records Management Action Plan (evidence 012) and has an estimated completion date of October 2019. The Keeper requests that he is sent a sample of the register once it has been developed.
The Keeper can agree this Element on an ‘Improvement Model’ basis. This would mean that the authority has identified a gap in provision (the lack of audit trail provision for the destruction of paper records and the lack of ability to delete electronic records in accordance with retention schedules) and has identified how it intends to close this gap. This agreement is dependent upon the Keeper being updated as the work to close the gap progresses.

Self-assessment update - 3 July 2023

Show this section

The rollout of the web-based Disposal Register for Corporate Records is scheduled to take place this year with support from a refreshed and renamed Information Management Working Group (IMWG).

IMWG is currently being reconstituted and renamed the Information Governance Guidance Group (IG3). It will meet via an MS Teams channel and provide a fresh focal point for RM and IG support and communication.

This online 'community of practice' will be a more effective way of sharing RM/IG information and training and provide more timely mutual support than the previous monthly 'in person' meetings could achieve. There were limitations on the number of staff who could attend/participate in the ‘in person’ meetings because of our remote and rural setting. The new IG3 community will also help with implementation of our recent ICO Audit recommendations which called for increased support for Information Asset Administrators (IAAs).

Progress review - 31 January 2024

Show this section

The Corporate Records Disposal Register rollout is noted with thanks. The Assessment Team looks forward to further updates on its implementation, especially taking into account the upcoming M365 rollout.

Thank you for the update regarding the reconstituted IM Working Group, now called Information Guidance Group (IG3). It looks like the changes implemented will result in a more fit-for-purpose set up, and it is good to see communities of practice evolving according to need.

This Element will remain at Amber while work continues. Subsequent PURs may give NHS Shetland a convenient opportunity to update the Keeper on continuing progress.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Section 1(2)(b)(iii) of the Act specifically requires a RMP to include provision about the archiving and destruction, or other disposal, of an authority’s public records. An authority’s RMP must demonstrate that proper destruction arrangements are in place.

Thank you for letting the Assessment Team know that there have been no major changes on records destruction arrangements. It is noted this will be progressed by the new Corporate Records Manager.

This Element will remain at Amber while work continues.

Element 7: Archiving and transfer

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

The ‘Improvement Action’ section of this Element states that NHS Shetland will work with NHS archivists and Shetland Archives to develop a selection policy for paper and electronic records created by NHS Shetland.

The Keeper requests that he is sent a copy of the selection policy once it has been finalised and approved.

Self-assessment update - 3 July 2023

Show this section

The selection policy document will be developed as part of the policy refresh and alignment described in the Element 3 update. As requested, The Keeper will be sent a copy of the approved policy once it is available.

Progress review - 31 January 2024

Show this section

Thank you for this update on progress with regard to ongoing selection policy development. The Team looks forward to receiving this policy on behalf of the Keeper when it becomes available.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Update required on any future change.

Element 8: Information security

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

All NHS Shetland records management/information governance policies and procedures are being reviewed and updated.

Self-assessment update - 3 July 2023

Show this section

This area remains under regular review and the Board has recently restructured its governance arrangements (June 2023) to increase its understanding and oversight of this increasingly important feature of healthcare delivery.

Progress review - 31 January 2024

Show this section

The Assessment Team thanks you for this update on governance restructure. It is good to hear that focus on robust information security arrangements is being maintained.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Update required on any future change.

Element 9: Data protection and element 14: Shared information

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

All NHS Shetland records management/information governance policies and procedures are being reviewed and updated as part of the RMP Action Plan. The Keeper requests that he is sent the Policy once it has been updated in order to keep the submission up-to-date.

Self-assessment update - 3 July 2023

Show this section

The Board has updated its public website and information about access to records is now available at: https://www.nhsshetland.scot/rights/accessing-information

Progress review - 31 January 2024

Show this section

Thank you for highlighting that guidance on records access continues to be made available on NHS Shetland’s website.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Update required on any future change.

Element 10: Business continuity and vital records

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

Update required on any change.

Self-assessment update - 3 July 2023

Show this section

This work is ongoing and the staff have participated in further ‘table top’ training exercises.

Appendix 3 - Cyber Attack Exercise

Progress review - 31 January 2024

Show this section

Element 10 stipulates that record recovery, prioritising vital records, is an integral part of the authority’s business continuity planning.

Thank you for indicating that work on maintaining and improving performance under this Element continues. The Assessment Team also notes the receipt of email detailing a recent cyber security exercise with thanks.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Update required on any future change.

Element 11: Audit trail

Status:

8 March 2018 - agreed plan - Amber
31 January 2024 - review - Amber
21 February 2025 - review - Amber

Keeper's Report - 8 March 2018

Show this section

NHS Shetland has explained that it is seeking to reduce its reliance on paper records by scanning both clinical and corporate records.

A photograph of the scanning equipment has been provided (evidence 056).
To improve the tracking of paper corporate records NHS Shetland will implement a tracking system based on one in operation at the University of Edinburgh (evidence 057). The Keeper looks forward to receiving updates on the progress of this work as part of the PUR process.

NHS Shetland has in place a Policy for the Transportation of Health Records The Keeper requests that he is sent the updated version once it becomes available. All NHS Shetland records management/information governance policies and procedures are being reviewed and updated as part of the RMP Action Plan.

The Keeper requests that he is sent the Policy once it has been updated in order to keep the submission up-to-date.

Framework for Document Development The Keeper requests that he is sent the updated version once it becomes available. All NHS Shetland records management /information governance policies and procedures are being reviewed and updated as part of the RMP Action Plan. The Keeper requests that he is sent the Framework once it has been updated in order to keep the submission up-to-date. The RMP also states that there is limited audit trail provision for records managed on shared drives.

The project to develop and implement an EDRMS is intended to significantly improve the level of provision in this area. This work is built in to the Records Management Action Plan (evidence 012) and has an estimated completion date of June 2021. The Keeper requests that he is kept informed of the progress of this work.

The Keeper can agree this Element on an ‘Improvement Model’ basis. This means that the authority has identified gaps in provision (the lack of audit trail capabilities in NHS Shetland’s shared drives and paper records) and has identified how it intends to close these gaps. This agreement would be dependent upon the Keeper being kept informed of progress.

Self-assessment update - 3 July 2023

Show this section

As noted in the updates to Elements 4, 5 & 6, progress in this area is linked to the development of the IAR/EDRM systems and the challenges faced with M365 deployment.

Despite the above noted challenges, NHS Shetland has made progress in this area with the recent deployment of Microsoft Purview. When required, the organisation can now conduct an audit of any documents within the NHS Shetland M365 tenancy.

To ensure there is robust governance surrounding the use of this powerful audit tool, NHS Shetland has developed an access authorisation procedure. A copy of the procedure is provided in provided as evidence.

Appendix 4 - Account Access Authorisation Form 1.0

Progress review - 31 January 2024

Show this section

Element 11 focuses on the tracking and version control of public records. The location of records should be known, and any changes to the records recorded.

Thank you for this update on audit trail arrangements. As NHS Shetland has identified, when set up properly in line with a robust Information Asset Register or similar, the M365 implementation will have a significant impact on the automation of retention, disposal and audit trail capabilities. It is good to hear that some benefits from this challenging process have materialised in the form of improved audit capabilities relying on Microsoft Purview. That an access authorisation process has been developed to accompany this change is excellent news, and The Assessment Team notes the receipt of this document with thanks.

This Element will remain at Amber while work on the M365 implementation continues. Subsequent PURs may offer a convenient opportunity to update the Keeper on continuing progress.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Thank you for letting the Assessment Team know that there have been no major changes on audit trail arrangements at NHS Shetland. Paper records and records on shared drives both need to addressed, especially as NHS Shetland is going to embark on a more thorough M365 implementation which allows for automated audit trail tracking functionality when appropriately implemented.

It is reassuring to know that this Element will be progressed by the new Records Manager.

This Element will remain at Amber while work continues.

Element 12: Competency framework

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

Update required on any change.

Self-assessment update - 3 July 2023

Show this section

NHS Scotland is continuing its work on developing a set of competencies for records management and information governance that align with its overarching Digital Health and Care Strategy.

In the meantime, NHS Shetland has adopted the Records Management Competency Framework (RMCF) developed by the NHS Scotland Records Management Forum. The RMCF is being used to inform NHS Shetland’s training and recruitment decisions.

Appendix 5 – Extract from the November 2022 Minute of IGSG.

Progress review - 31 January 2024

Show this section

The Assessment Team thanks you for this update on records management and information governance competencies, developed to align with the Digital Health and Care Strategy. This sounds very appropriate. It is great to hear that NHS Shetland is also implementing shorter-term goals based on collaborative work done within the NHS Scotland Records Management Forum, which is very commendable.

The Assessment Team thanks NHS Shetland for providing an extract of IGSG minutes. These have been received with thanks.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No significant change.

Progress update review - 21 February 2025

Show this section

Thank you for letting us know that there have been no major changes on staff training and records management competencies.

Element 13: Assessment and review

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Amber
21 February 2025 - review - Amber

Keeper's Report - 8 March 2018

Show this section

Update required on any change.

Self-assessment update - 3 July 2023

Show this section

[No update provided.]

Additional update provided 30/01/2024: NHS Shetland has not undertaken a full and formal review of its RMP since its agreement in 2019, however the RMP Action Plan is reviewed /updated monthly at the Information Governance Group and is reviewed on an annual basis by the Finance and Performance Committee, a standing Committee of NHS Shetland Board.

Progress review - 31 January 2024

Show this section

In 2022, it was noted that there was a lapse in the scheduled review of Records Management Plan and key policies (including Records Management Policy, reported to be overdue for review under Element 3). NHS Shetland was urged to address this matter as soon as practicable. The Assessment Team would like to enquire whether the RMP has undergone a review since its agreement in 2019.

NHS Shetland should be commended for its regular participation in the PUR process.

Comments on the additional update 30/01/2024: Thank you for letting us know that RMP Action Plan is regularly reviewed. While this does ensure that the Action Plan remains fit for purpose, a regular scheduled review of the Records Management Plan is required for full compliance under Element 13.

This Element will remain at Amber until a formal review schedule is implemented on the RMP. We look forward to future updates on this in future PURs.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

NHS Shetland acknowledges the need to conduct regular scheduled reviews of its RMP and that a review is overdue.

A formal review of the RMP will be the primary focus the new Corporate Records Manager / RM Lead, who will provide the expertise and resource required for this task.

Progress update review - 21 February 2025

Show this section

The Assessment Team confirms that NHS Shetland is working on pursuing a formal review of their Records Management Plan, especially now as the new Records Manager is in place.

This Element will remain at Amber, but the Team acknowledges that NHS Shetland has a plan in place to address this requirement. We look forward to further updates on subsequent PURs.

Element 14: Shared information

Status:

8 March 2018 - agreed plan - Green
31 January 2024 - review - Green
21 February 2025 - review - Green

Keeper's Report - 8 March 2018

Show this section

Update required on any change.

Self-assessment update - 3 July 2023

Show this section

No Change.

NHS Shetland continues to develop and refine its information sharing processes in accordance with its obligations under DPA 2018 and UK GDPR.

Progress review - 31 January 2024

Show this section

The Assessment Team thanks NHS Shetland for providing an extract of IGSG minutes. These have been received with thanks.

Self-assessment Update as submitted by the Authority since 3 July 2023

Show this section

No change.

Progress update review - 21 February 2025

Show this section

Update required on any future change.

7. The Public Records (Scotland) Act Assessment Team’s Summary

Version

The progress update submission which has been assessed is the one received by the Assessment Team on 13th August 2024. The progress update was submitted by David Morgan, Head of Information Governance, FOI Lead & DPO.

The progress update submission makes it clear that it is a submission for NHS Shetland.

The Assessment Team has reviewed NHS Shetland’s Progress Update submission and agrees that the proper record management arrangements outlined by the various elements in the authority’s plan continue to be properly considered. The Assessment Team commends this authority’s efforts to keep its Records Management Plan under review.

General Comments

NHS Shetland continues to take its records management obligations seriously and is working to bring all elements into full compliance.

Section 5(2) of the Public Records (Scotland) Act 2011 provides the Keeper of the Records of Scotland (the Keeper) with authority to revisit an agreed plan only after five years has elapsed since the date of agreement. Section 5(6) allows authorities to revise their agreed plan at any time and resubmit this for the Keeper’s agreement. The Act does not require authorities to provide regular updates against progress. The Keeper, however, encourages such updates.

The Keeper cannot change the status of elements formally agreed under a voluntary submission, but he can use such submissions to indicate how he might now regard this status should the authority choose to resubmit its plan under section (5)(6) of the Act.

8. The Public Records (Scotland) Act Assessment Team’s Evaluation

Based on the progress update assessment the Assessment Team considers that NHS Shetland continue to take their statutory obligations seriously and are working hard to bring all the elements of their records management arrangements into full compliance with the Act and fulfil the Keeper’s expectations.

The Assessment Team recommends authorities consider publishing PUR assessment reports on their websites as an example of continued good practice both within individual authorities and across the sector.

This report follows the Public Records (Scotland) Act Assessment Team’s review carried out by

Iida Saarinen
Public Records Officer

File downloads

Document cover image

NRS Public Records (Scotland) Act (PRSA) NHS Shetland Progress Update Review (PUR) 2024 Final Report Web Version 21 February 2025

File type: PDF,
File size: 291.62 KB

Contact details

Was this page helpful? *

Yes

Yes, but

Choose a reason for your feedback *

Your comments Your feedback helps us to improve our services.
Do not give any personal information.