AW-04 — Records Management, Retention, Disposal and Information Requests

1. Purpose

To ensure that every record IoL creates or receives is classified, stored in a known system, protected according to its classification, retained for the period the institution requires and no longer, disposed of only with authority and evidence, placed beyond disposal when a hold applies, and retrievable within a stated time for anyone entitled to it, including MoHESR under Appendix B, a learner under subject access, an auditor, an accreditor or a court.

2. Scope

Scope statement. This procedure manages IoL records from the point at which a procedure creates or receives a record, through classification, storage, access, retention and any hold, to authorised disposal or transfer to archive, and it manages every request for information held in those records from receipt to release or refusal.

Applies to. Records in every format produced by any AW or WF; superseded controlled documents from AW-03; evidence indexed in the WF-26 evidence register; records held for a partner under an agreement; requests from staff, learners, MBRU, Dubai Health, regulators, accreditors, the Ministry, courts and the public.

Does not apply to. The institutional retention schedule and records systems, which MBRU owns; clinical records of patients in Dubai Health facilities, which are never IoL records even where a learner or IoL staff member contributed to them; controlled documents in their current version (AW-03); breach management and security controls (AW-16); the substance of any evidence, which belongs to the producing procedure.

Applicable requirements. ISO 9001:2015 clauses 7.5.3.1 and 7.5.3.2; ISO 21001:2018 clause 7.5.3; MBRU retention schedule and information governance policy [IoL to confirm]; Dubai Health clinical records governance for the boundary in step 5; OBEF guide v11.5 Appendix B; UAE personal data protection law as applied by MBRU [IoL to confirm].

3. Trigger, boundary and endpoint

4. SIPOC

5. Accountability

Process owner. IoL Records and Information Officer, or the Operations Manager where no such role exists [IoL to confirm], with authority to refuse a disposal and to refuse a release.

Escalation.

6. Procedure

Part A. Classification and custody

1. Classify at creation. Every procedure names, in its records table, the class of each record it produces: Governance (minutes, registers, delegations, risk, management review); Learner (application, enrolment, attendance, progression, adjustments, complaints and appeals, certificates, placements); Staff (appointment, credentials, appraisal, leave, training, conduct); Financial (budgets, requisitions, receipts, claims, invoices, income); Research (ethics, registrations, agreements, outputs, impact); Partnership (MoUs, contracts, valuations); Event (approvals, attendance, feedback, vendors); Assessment (blueprints, papers, marking, moderation, scripts); Controlled document archive (superseded versions from AW-03). Each record also carries an AW-16 level: public, internal, confidential or restricted. [CONTROL] A record with no class and level is not filed; the creator's procedure is non-conformant.

2. File in the designated system. The retention register names one system of record per class [IoL to confirm each]: learner records system for Learner and Assessment, HR system for Staff, finance system for Financial, controlled repository for Governance and the document archive, IoL repository with restricted areas for the rest. A mailbox is never the system of record; physical records are listed with location and custodian. [CONTROL] Copies outside the system are working copies with no evidential status.

3. Capture minimum metadata. Title, class, level, creator, date, producing procedure, retention trigger event and, for evidence indexed by WF-26, the evidence register ID. [CONTROL] A record without a retention trigger date cannot be scheduled for disposal and is flagged monthly.

4. Apply access by classification. Public: any staff member. Internal: IoL staff. Confidential: the producing team and named roles. Restricted: named individuals with a logged business need. Learner records are readable by the programme team and AW-18; Staff by the line manager and HR; Financial by the budget holder and finance; Assessment scripts by the assessment team until results are ratified. Access is provisioned through AW-15 and reviewed at its quarterly access review. [CONTROL] No role holds write access to a record after the event it documents is closed, except the Records Officer for logged filing corrections.

5. Distinguish education records from clinical records. IoL teaches inside a health system; learners and faculty contribute to patient records in Dubai Health facilities. The rule is absolute: a patient's clinical record is a Dubai Health record and is never copied into, quoted in or attached to an IoL education record. An IoL record may state that a learner completed a placement, was assessed in a clinical setting or was involved in an incident, but it does not identify patients; where it must reference a clinical event it does so by Dubai Health reference number only. Simulation records using standardised patients or manikins are education records. [CONTROL] Any request received by IoL for clinical information is redirected to Dubai Health information governance the same day and logged as redirected; IoL never answers it.

Part B. Retention, hold and disposal

6. Maintain the retention register. A controlled register under AW-03 lists each record type, the system, the period, the trigger, the disposal action, the authoriser and the MBRU schedule reference, reviewed annually against MBRU's schedule and on any notified change. Default periods, all [IoL to confirm against MBRU schedule]:

   Class and record type	Trigger	Default period	Disposal
   Governance: minutes, decision registers, terms of reference	Meeting or withdrawal	Permanent	MBRU archive
   Governance: action registers, risk history, delegations	Closure or supersession	7 years	Destroy
   Learner: enrolment, progression, awards, transcripts	Leaving or graduation	Permanent (transcript, award); 10 years (supporting)	Archive; destroy
   Learner: attendance, feedback, adjustments, placements	End of academic year	7 years	Destroy
   Learner: complaints and appeals	Closure	10 years	Destroy
   Staff: appointment, credentials, appraisal, training	End of employment	7 years; credentials while they support a published claim	Destroy
   Financial: all transaction records	End of financial year	7 years, or MBRU's period if longer	Destroy
   Research: ethics, registrations, agreements, data management	Project closure	10 years, or the funder's period if longer	Per funder
   Partnership: agreements and valuations	Expiry or termination	10 years	Archive summary; destroy working files
   Event: approvals, attendance, feedback	Event date	7 years	Destroy
   Assessment: blueprints, papers, marking, moderation	Ratification of results	7 years	Destroy
   Assessment: scripts and recordings	Ratification and expiry of appeal window	2 years, or until any appeal closes	Destroy
   Controlled document archive	Supersession	While records made under the document are retained	Destroy
   OBEF evidence indexed by WF-26	Submission year	7 years minimum, per the OBEF Pipeline pack	Destroy after WF-26 confirms
   Request logs and disposal certificates	Closure or disposal	Permanent	Archive

   [CONTROL] No period is shorter than MBRU's schedule or any applicable regulator, funder or agreement requirement; where they differ, the longest applies.

7. Apply a legal hold. On notice from MBRU legal or records, a regulator, a court, or the Senior Director, IoL, in anticipation of a dispute, investigation or audit, the Records Officer records the hold (scope, date, authority, contact), flags the affected records in each system and notifies each custodian. [CONTROL] A record under hold is excluded from disposal regardless of its period; every disposal run checks the hold register first. A hold is lifted only by the authority that imposed it, in writing.

8. Review at retention expiry. Quarterly, the Records Officer lists expired records, checks each against the hold register, confirms with the creator that no live matter depends on it, and prepares a disposal schedule. [CONTROL] The AW-16 lead reviews the schedule for personal data and the Senior Director, IoL, approves it; no disposal proceeds on the Records Officer's authority alone.

9. Dispose and certify. Destruction is executed by the system administrator (AW-15) or, for physical records, by MBRU's approved confidential destruction route. The Records Officer issues a certificate listing what was destroyed, when, by whom, under whose authority and by what method, filed permanently; archive transfers are receipted. [CONTROL] The executor and the certifying Records Officer are different people.

10. Archive superseded controlled documents. On handover from AW-03 the Records Officer files the superseded version with its control history, read-only, indexed by document ID and version, for as long as records made under it are retained.

Part C. Information requests

11. Log and triage. Every request is logged on receipt with requester, date, what is sought, type and deadline. Types and default deadlines [IoL to confirm each]: internal (5 working days); learner subject-access (own personal data, under AW-16 and MBRU's process; MBRU's timescale, assumed 30 calendar days); learner record service (transcript, letter, verification; routed to AW-18); regulator or accreditor (the body's deadline); Ministry Appendix B evidence request (15 working days or a dated plan within 15, per WF-26); court or law enforcement (through MBRU legal only); public or media (through AW-22); clinical (redirected per step 5). [CONTROL] No request is answered before it is logged.

12. Verify entitlement. Identity and the right to the record are confirmed: a learner to their own data; a regulator or Ministry through the MBRU function that receives such requests; an auditor through the AW-24 programme; a third party only with the data subject's written consent or a legal basis confirmed by MBRU legal. [CONTROL] Personal data is not released to anyone, internal requesters included, whose entitlement has not been recorded.

13. Retrieve. The Records Officer retrieves from the register and system indexes and records the time taken. For an Appendix B request, retrieval starts from the WF-26 evidence register: each KPI flag or value in the request is matched to its evidence register ID, and each ID to its record location here. [CONTROL] The bundle contains the record as held; a record that has to be created for the request is labelled as created on that date and reported to WF-26 as an evidence gap.

14. Review and redact. The Records Officer, with the AW-16 lead where personal data is involved, reviews for third-party personal data, clinical content, privileged material and material outside scope, and redacts with a redaction log. Decision point. Release in full, with redactions, in part with reasons, or refuse with reasons and the route of appeal.

15. Approve and release. The AW-16 lead approves any release of personal data; the Senior Director, IoL, approves any release to a regulator, Ministry, court or external body, and every Appendix B bundle before it goes to the WF-26 Pilot Lead for submission through MBRU's institutional process. The log records what was sent, to whom, when, how and under whose approval. [CONTROL] Every external release involves a preparer and a different approver.

16. Close and learn. The request is closed with outcome and elapsed time. A request that missed the standard, found a record missing or required reconstruction generates an AW-24 CAPA entry and, for Appendix B requests, a note to WF-26.

7. Information handled and interfaces

No flow in this table carries patient-identifiable clinical information. Any such content found in an IoL record is treated as an AW-16 incident and removed under Dubai Health guidance.

8. Controls

9. Exceptions and escalation

This procedure must never: file a record without a class and level; hold a patient-identifiable clinical record or answer a clinical information request; dispose of a record under hold; dispose of any record without an approved schedule and a certificate; release personal data without recorded entitlement; release externally with only one person involved; present a reconstructed record as contemporaneous; or shorten a retention period below MBRU's schedule.

10. Service standards

11. Records and retention

12. Risks and controls

13. Performance measures

14. Change control