Essential controls and accountable owners
Healthcare document management compliance controls need both configured safeguards and accountable owners. Access permissions, audit activity, encryption, retention, and deployment responsibilities work together to protect confidentiality, integrity, and availability.
Consider a referral viewed inside a controlled repository, then downloaded to a laptop. Repository permissions govern the first interaction; the extracted copy needs its own handling controls. Responsibility continues after access.
Our healthcare document management supports patient documentation and medical-record management. Our document-management capabilities include access permissions, activity history, configurable document-store encryption, and retention policies . Your organisation remains responsible for lawful processing, approved roles, configuration, and evidence that those controls work.
HIPAA and UK GDPR scope
HIPAA and UK GDPR obligations depend on the organisation, processing purpose, information, and deployment involved. A healthcare use case alone does not establish the applicable requirements.
In the United States, the HIPAA Security Rule applies to covered entities and business associates handling electronic protected health information (ePHI). Requirements include unique user identification, emergency-access procedures, audit controls, and regular activity review.
The rule treats encryption specifications as addressable. HHS explains that addressable does not mean optional: organisations must implement encryption when reasonable and appropriate. Otherwise, they must document their risk-based determination and implement an equivalent alternative where reasonable and appropriate.
HHS cloud guidance requires a business associate agreement (BAA) where applicable, even when a provider cannot decrypt the ePHI it maintains. A GDPR processing agreement alone does not establish BAA coverage.
For health information, the UK General Data Protection Regulation (UK GDPR) requires an Article 6 lawful basis and an applicable Article 9 condition. The Information Commissioner’s Office (ICO) distinguishes qualifying health or social-care purposes from general healthcare-related processing. Permissions cannot establish that legal basis.
Healthcare document management control matrix
A healthcare document management control matrix should separate software capabilities from customer obligations and identify the evidence needed for the chosen deployment.
| Control | LogicalDOC capability | Customer obligation and deployment boundary |
|---|---|---|
| Access permissions | User and group permissions distinguish Preview, Download, and folder Export. Document-specific policies replace inherited folder policies. | Approve roles, remove obsolete access, and review administrators, whose group has full permissions. Test document-level exceptions separately from folder access. |
| Audit events and exports | Document History captures timestamps, event descriptions, session information, and request origins. History settings govern recording and event retention. | Assign reviewers and retention periods. Specify audit-evidence retrieval and format separately from document-content exports, including folder ZIP exports. |
| Encryption | Document-store encryption is configurable. LogicalDOC commitments specify TLS 1.2+ in transit and AES-256 at rest. | Assess transport, databases, indexes, backups, and extracted copies separately. Apply Cloud commitments within their service scope; retain configuration evidence for customer-managed environments. |
| Retention | Date-based retention policies support Archive, Unpublish, and Delete actions. | Map triggers and periods to approved records schedules. Authorise disposal and accommodate preservation requirements. A publication date is not automatically an end-of-treatment date. |
| Deployment responsibilities | Cloud processing follows documented instructions. On-premises deployment uses customer servers; hybrid synchronises selected content between local and cloud installations. | Assign patching, identity administration, backup, recovery, incident-handling, and service-exit owners. Hybrid responsibilities cover both environments and replicated copies. |
Matrix references: our Access Control, Document Security, Document History, Parameters, Repositories, Architecture, Retention Policies, Cloud Data Processing Agreement, On-premises DMS, and Hybrid Cloud documentation; ICO processor-contract guidance .
Testing effective access permissions
For access testing, give a referral-review role Preview permission, then test Download and folder Export independently. Inspect the referral’s own security policy as well as its parent folder. Approving the department folder alone will not establish the effective permissions of a document with an overriding policy.
Activity history and review evidence
Version history and activity history answer different questions. A view or download need not create a document revision. Enable event recording with history.enabled, configure the relevant event-retention settings, and give reviewers access to history and session details. Retain reviewer findings alongside the events they examined.
Encryption coverage and storage architecture
Encryption coverage follows the storage architecture . We store document binaries separately from metadata held in a relational database. A document-store encryption setting therefore describes one protection area. Record how the deployment protects metadata, backups, and copies downloaded to endpoints rather than extending that setting to every component.
Deployment ownership and service exit
Deployment ownership also needs an exit plan. For on-premises installations, internal IT typically operates infrastructure, maintenance, security, and backups. Hybrid adds a cloud installation and replicated content to the responsibility map. Record who returns or deletes information at service end, how completion is evidenced, and which protections continue while retained copies remain.
Retention periods and authorised disposal
Healthcare retention periods must follow the record category and applicable obligations, with separate schedules for patient documents, activity histories, and backups.
HIPAA’s six-year requirement concerns Security Rule documentation, measured from creation or when the documentation last applied, whichever is later. It is not a universal patient-record or audit-event retention period. HHS medical-record retention guidance explains that the Privacy Rule does not prescribe medical-record retention periods; applicable state requirements must be considered.
ICO storage-limitation guidance requires justified retention rather than one fixed period for all personal data. Document the purpose and applicable legal or professional requirements behind each schedule.
For organisations within its scope, the NHS England Records Management Code provides record-category guidance. Use its live webpages rather than the outdated PDF. England-specific guidance does not establish one schedule for every UK nation.
Our Cloud backup policy distinguishes daily and weekly backup retention; applicable customer terms determine operational arrangements. Recovery copies do not replace a clinical-record retention schedule.
NHS England disposal guidance calls for evidence of what was disposed of, when, how, and who authorised and performed disposal. A configured Delete action executes a lifecycle step; organisational approval, preservation checks, and completion evidence remain necessary.
Validate one referral workflow
A referral-workflow test should establish who could access each copy, what activity was recorded, and which information supported approval.
For integrated viewing systems, NHS England’s records guidance calls for enough historical context to establish what information was available when a decision was made. Keeping the corrected referral alone may leave that question unanswered. Surrounding records can matter as much as the referral’s own revisions.
Build an evidence pack using a synthetic referral:
-
Record approved roles and test Preview, Download, folder Export, and document-specific exceptions.
-
Capture activity records and reviewer findings, then reconstruct the versions and surrounding records available at approval.
-
Document encryption coverage, retention rationale, disposal approval, and named recovery and service-exit owners.
Schedule a review of that evidence pack with clinical, information-governance, IT, and compliance owners before applying the configuration to live patient documents.
