NHS Dorset

3. Mr H complains that NHS Dorset (the ICB) rescinded an offer to pay for digitisation and destruction of his daughters PHB records.

4. Mr H says as a result he has been left to cover a cost which he cannot afford. This was a cost he was informed the ICB would cover. He says the experience has caused him stress.

5. Mr H is seeking the ICB to agree to its initial offer.

6. On 12 June 2025 the ICB explained Mr H’s daughter’s PHB could be used to retain the documents digitally and then have them destroyed.

7. On 15 August the ICB explained he should not have been informed it would cover the cost of both. It explained as a gesture of goodwill it would cover the costs of the shredding and offered Mr H £200.

10. Mr H complains the ICB rescinded an offer to pay for digitisation and destruction of his daughters PHB records.

11. The ICB acknowledged it incorrectly informed Mr H he could use his daughters PHB to pay for the costs of digitising and securely destroying the records he had kept. It apologised for this. It said it is not the policy of the ICB to pay for the storage (digitisation) of documents or their destruction. It did offer to pay for the destruction as a gesture of goodwill.

12. The records show on 12 June the ICB informed Mr H he could use the PHB account to digitise the records he holds and then destroy them securely.

13. On 17 July Mr H sent the ICB an estimate of £3269.40 for the digitisation of the records. The second invoice of £150 for the secure shredding of the records.

14. Mr H was then informed this offer had been rescinded.

15. On 15 August the ICB explained he should not have been informed it would cover the cost of both. It explained as a gesture of goodwill it would cover the costs of the shredding and offered Mr H £200.

16. We recognise the ICB did say the costs for both the digitisation and shredding could be covered by the PHB. This is not in dispute. The ICB has rescinded this offer as it is not the policy of the ICB for it to cover these costs. Firstly, we will consider if the records do need to be kept.

17. We acknowledge there are laws on how long organisations must retain records for. As an example, The British Medical Association, ethics, retention of health records guidance explains GP must retain records for ten years after death. There is no guidance for patients or family members who have personal records.

18. The National Framework for NHS Continuing Healthcare or Guidance on direct payments for healthcare also does not set out an individual must keep their personal records for seven years following a death.

19. We asked Mr H under what law he feels the records need to be kept. Mr H told us the records need to be kept under GDPR law. Mr H clarified the documents he holds relate to the employment of the carers used. The documents are not medical records.

20. We have review the ICO (information commissioner’s office) website. It explains Principle (e): Storage limitation, What is the storage limitation principle? Article 5(1)(e) says:

“1. Personal data shall be: (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’)”

So, even if you collect and use personal data fairly and lawfully, you cannot keep it for longer than you actually need it.’

21. GDPR law explains an individual should not keep personal data for longer than someone should need it. We have not seen it states records should be kept for seven years. We consider GDRP guidance indicates records should be destroyed as soon as they are not needed. We have considered Mr H’s responsibility as an employer.

22. As noted above Mr H informed us the records he holds are employment documents. We have considered HMRC, A general guide to keeping records for your tax return. It says:

‘How long to keep your records Individuals (not carrying on a business): You have to keep your records for 22 months from the end of the tax year to which they relate. For example, if you file your 2011–12 tax return by the filing date, you should normally keep your records until 31 January 2014. You'll need to keep your records for longer if you file your tax return late, if we have started a check of your return, or if you're buying and selling assets.

Self-employed or in partnership: You have to keep your records for at least five years from 31 January following the tax year that the tax return relates to. For example, if you file your 2011 –12 tax return by 31 January 2013, you should normally keep your records until 31 January 2018. You'll need to keep your records for longer if you file your tax return late, if we have started a check of your return, or if you're buying and selling assets.

Companies: The records for an accounting period will normally have to be kept for six years from the end of that period. For example, if the accounting period ends on 31 December 2012, the records have to be kept until 31 December 2018.’

23. From the guidance above, HMRC recommends keeping records between a range of 22 months and six years depending on the individual’s circumstances. This is in relation to employment and tax issues. We can say the guidance indicates there is some requirement for Mr H to hold the records for an amount of time. Mr H should contact HMRC to clarify what exact time period this is.

24. Secondly, we will now consider if the requirement to keep the documents falls under the remit of the NHS.

25. It appears Mr H is retaining the documents due HMRC purposes. We have not seen any guidance which indicates the documents Mr H holds are the responsibility if the NHS. We do not consider it the responsibility of the NHS to pay for the digitisation of the employment documents. We cannot say the ICB’s to rescind the offer to digitise the records amounts to a failing.

26. We consider there is no obligation for the ICB to pay for the destruction. We are pleased to see it has made an offer to cover the costs of this in recognition of its error when it informed Mr H it would.

27. We understand the frustration the ICB’s communication caused. We cannot say the ICB got anything wrong when it informed Mr H it would not pay for the digitisation of the records. We will take no further action on this complaint.

1. We have carefully considered Mr H’s complaint about the ICB. We acknowledge the frustration it caused when the ICB rescinded its offer to pay for the storage of Mr H’s documents.

2. After carefully considering all the evidence, we have not seen the ICB got anything wrong in its decision making.