Retention schedule
Aligned to the NHS Records Management Code of Practice (2023). Pseudonymisation runs at discharge; full purge runs annually.
| Data category | Retention period | Basis |
|---|---|---|
| Patient identifiers (name, hospital no., NHS no.) | Discharge + 8 years | NHS RMCoP 2023 — Adult health record |
| Pseudonymised therapy minutes & assessment scores | Discharge + 8 years | Clinical audit / SSNAP |
| Audit log entries | 6 years | DSP Toolkit — security & audit |
| Staff account (email, role) | Until leaver date + 6 months | HR / access control |
| Sign-in / session logs | 90 days rolling | Security monitoring |