Gloucestershire Health and Care- NHS Trust logo
with you, for you
Responses > Paper Medical Records

Freedom of Information request Paper Medical Records

Response published: 28 May 2025

FOI Request

I recently came across a published FOI response from another requester regarding the med recs EDM System. After reviewing the details, I'm seeking information about paper records instead and would like to raise an FOI. Given that medical records are important information assets containing Personally Identifiable Information (PII), some of which will be sensitive, I am particularly interested in how the Trust manages (or who manages!) and safeguards paper medical/health records. I've had a look at the NHSE ERIC data but can only see on-site and off-site spend. Nothing around the number of paper records etc. therefore could you have a look at the below request? Most of it should be in your info asset logs, registers and/or DPIAs so hopefully the request is not too much of an impact. Paper Medical Records Management How many paper medical records does the Trust have as a data controller? How many primary on-site record libraries are there? (Just looking for primary storage locations, not local departmental stores etc. as that would take a long time to repply to). How many off-site record libraries are there? Is records management outsourced for some paper medical records? Is records management outsourced for all paper medical records? How many records are Trust-managed and how many are outsourced to a records management provider? If some or all records management is outsourced, what is the records management provider(s) company name(s)? Is the company (if more than 1, please list) a Data Controller and/or a Data Processor for the Trust? How many records has the Trust authorised and had destruction undertaken for within the last two years (2022/23 & 2023/24)? Was destruction undertaken by a BS15713 provider? If yes, which of the following are they accredited to: BS15713:2009 or BS15713:2023? If records management is outsourced, does this include active records (records that have been in active circulation within the last three years)? If records management is outsourced, does this include dormant records (records that have been in active circulation in the last four to eight years)?

FOI Response

Freedom of Information Request – Ref: FOI 368-2025

Thank you for your recent Freedom of Information request. Please find our response below.

You asked:

1. How many paper medical records does the Trust have as a data controller?

Our response:

Not known

You asked:

2. How many primary on-site record libraries are there? (Just looking for primary storage locations, not local departmental stores etc. as that would take a long time to reply to).

Our response:

None

You asked:

3. How many off-site record libraries are there?

Our response:

None

You asked:

4. Is records management outsourced for some paper medical records?

Our response:

Yes

You asked:

5. Is records management outsourced for all paper medical records?

Our response:

No

You asked:

6. How many records are Trust-managed and how many are outsourced to a records management provider?

Our response:

Not known

You asked:

7. If some or all records management is outsourced, what is the records management provider(s) company name(s)?

Our response:

Crown Records Management

Iron Mountain

You asked:

8. Is the company (if more than 1, please list) a Data Controller and/or a Data Processor for the Trust?

Our response:

Crown Records Management – Processor

Iron Mountain – Processor

You asked:

9. How many records has the Trust authorised and had destruction undertaken for within the last two years (2022/23 & 2023/24)?

Our response:

2022/2023 = None

2023/2024 = None

You asked:

10. Was destruction undertaken by a BS15713 provider?

Our response:

No

You asked:

11. If yes, which of the following are they accredited to: BS15713:2009 or BS15713:2023?

Our response:

Not applicable

You asked:

12. If records management is outsourced, does this include active records (records that have been in active circulation within the last three years)?

Our response:

No

You asked:

13. If records management is outsourced, does this include dormant records (records that have been in active circulation in the last four to eight years)?

Our response:

No

You asked:

14. Can I have an OGL for this? Can you tell me how I go about doing that?

Our response:

The information provided can be used freely under OGL

Next steps:

Should you have any queries in relation to our response, please do not hesitate to contact us. If you are unhappy with the response you have received in relation to your request and wish to ask us to review our response, you should write to:

Louise Moss
Head of Legal Services / Associate Director of Corporate Governance
c/o Gloucestershire Health and Care NHS Foundation Trust
Edward Jenner Court
1010 Pioneer Avenue
Gloucester Business Park
Brockworth, GL3 4AW
E-mail: louise.moss@ghc.nhs.uk

If you are not content with the outcome of any review, you may apply directly to the Information Commissioner’s Office (ICO) for further advice/guidance. Generally, the ICO will not consider your case unless you have exhausted your enquiries with the Trust which should include considering the use of the Trust’s formal complaints procedure. The ICO can be contacted at: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.