Anonymising Hospital Discharge Summaries for Clinical Audit – UK GDPR-compliant anonymisation per NHS Records Management Code of Practice 2021
A hospital discharge summary is a clinical episode record constituting special-category health data under UK GDPR Article 9(2)(h), documenting diagnoses, procedures, and follow-up instructions. The NHS Records Management Code of Practice 2023 (NHS RMC 2023) requires adult records to be retained for 8 years; maternity records for 25 years. anonym.legal pseudonymises patient and clinician identifiers, preserving ICD-10 codes and discharge medications for clinical audit.
When this applies
This task applies when discharge summaries are extracted for clinical audit, NHS National Clinical Audit submissions, or service improvement reviews where the reviewing team requires episode-level clinical data but not the identity of individual patients or named responsible clinicians. The Care Quality Commission, which registers over 41,000 active providers in England, may inspect discharge summary governance as part of its regulatory oversight.
How anonym.legal handles it
- Upload discharge summaries individually or in batch (PDF, DOCX, or HL7 CDA format).
- The engine detects patient name, NHS number, date of birth, ward location (where named after a patient or clinician), and the responsible consultant's name.
- Each patient and named clinician is pseudonymised consistently; admission and discharge dates, procedure codes, and medication names are preserved.
- ICD-10 diagnosis codes, OPCS-4 procedure codes, and SNOMED CT terms in structured fields are not altered.
- Discharge instructions and follow-up clinic references are preserved in clear text; any named specialist in follow-up referrals is pseudonymised.
- A mapping table is produced with UK data residency.
What you provide
- Hospital discharge summary documents (PDF, DOCX, or HL7 CDA)
- Patient encounter identifier list (to verify batch completeness)
Limitations & cautions
- The NHS Records Management Code of Practice 2023 sets retention periods of 8 years for adult health records and 25 years for maternity records; pseudonymised summaries used for audit must still be managed under the applicable retention schedule.
- Discharge summaries referencing rare surgical procedures or unusually complex multimorbidity may carry residual re-identification risk in small patient populations.
- The tool does not validate clinical coding accuracy — obtain clinical coding review separately. Breaches can attract fines of up to £17.5 million or 4% of annual global turnover under DPA 2018 s.157.
FAQ
Can pseudonymised discharge summaries be submitted to NHS national clinical audit programmes?
Pseudonymised summaries are suitable for internal pre-submission review and quality checking. Check the specific national audit programme's data specification; most require either identified or formally anonymised data rather than pseudonymised data for submission. According to the ICO's 2021–22 guidance, pseudonymised records remain personal data under UK GDPR.
Are procedure-specific complication rates and readmission flags preserved?
Yes. Clinical episode data — procedure outcomes, complication flags, and readmission indicators — are preserved; only identifiers are pseudonymised. The 8-year retention period under the NHS Records Management Code of Practice 2023 applies to the original identified record, not to pseudonymised audit extracts.
Does the engine handle batches of summaries from multiple wards or specialties?
Yes. Batch processing applies consistent pseudonyms across all summaries in the upload, so a patient admitted to two different wards receives the same pseudonym throughout the batch. The 8 Caldicott Principles (updated 2013, with Principle 8 added in 2020) require data minimisation and purpose limitation in all such sharing.