Information management
The third foundational element covers how health information is managed across its life, including the records that show the system was safe, effective and secure.
What the public record carries
Not stated in the public record beyond the element title. The public introduction describes the four parts. The text of 5.2.4 is not public.
Basis. The public contents name the element. The four parts are not public.
Why it matters in a health estate
Two kinds of information meet in this element: the patient information the system processes, and the programme's own records. The first carries clinical and privacy risk; the second carries the burden of proof. Organisations often manage the first carefully and the second casually, then cannot show what was decided when a system was configured or a supplier was accepted.
What to do now
Map both kinds of information. For patient information, record the flow, the lawful basis and the retention. For programme records, record what is kept, where, for how long and who can retrieve it. Test retrieval on a record from three years ago.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Information map | Patient information and programme records, each with flow, location and retention |
| Retention schedule | How long each record is kept and what triggers destruction |
| Retrieval test | A dated test that a record from three years ago can be produced |
| Access list | Who can read and change each record set |
What a reviewer will ask
A reviewer will ask for a decision made years ago. A programme that cannot retrieve its own record has no evidence, whatever it did at the time.
Common gaps
- The programme's decisions live in email and shared drives with no retention rule
- Patient information is mapped in the clinical system but not in the reporting copies
- A record is kept but cannot be retrieved because the system that held it was replaced
- Access to the programme record is wider than the roles that need it
Before the draft publishes
Ask for one decision record from three years ago and time how long it takes to produce. That number is the finding.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The data protection lead, the records manager and the CISO, because this element covers the information the system holds and the records the programme keeps.