Preserve the evidence needed to understand the event
When investigating a concern, assemble the relevant consultation record, patient communications, clinical decisions, and operational events. Keep the timeline understandable. A delivery timestamp, for example, does not establish when a patient read instructions or when a clinician reviewed a message.
Give investigators access according to their role. The ICO special-category rules require an appropriate lawful basis and condition for processing health information. A complaint does not justify sharing the entire medical record with everyone involved in customer support. ICO: special category data rules
Retain corrections transparently. If a staff member adds a late note, the record should distinguish the later explanation from contemporaneous information. Do not rewrite the original history to make an unsuccessful episode look complete.
Use safe test data to inspect audit trails and exports. Check whether the company can reconstruct an episode if an employee leaves or a supplier changes. The investigation needs reliable evidence of what happened, while the patient needs an understandable explanation that respects other people's confidentiality.