The published rules from booking a blood test to record keeping, in one map

The practice manager, registered manager or receptionist who runs bookings and results at a small independent clinic in England that takes blood and sends it to a laboratory.

Download the guide as Markdown

What is inside

• Which clinics the care regulator's rules reach: the blood-sample exception in Schedule 1, paragraph 7(4)(a), quoted, and CQC's plain-words reading of it
• Hand-off by hand-off, the rule text: consent records (regulation 11 and CQC's records guidance), working with the laboratory (regulation 12(2)(i)), the UN 3373 packing instruction P650 as the Department for Transport reads it, filing results (regulation 17(2)(c) and CQC's "results of diagnostic tests" line), the message to the patient, and retention
• The retention periods for the records a results desk holds, from Appendix II of the NHS England records code: adult health records, pathology reports, clinical diaries, telephony, subject access files, complaints, incidents, DPIAs, destruction certificates
• The rules that run across every hand-off: the 72-hour breach report, the one-month subject access clock and how the ICO says to count it, the health-data exemption that only a clinician can apply, the duty of candour's written records
• A finished hand-off table, 25 rows: hand-off, rule, what it says, nation, source
• A finished list of what to have written down for each hand-off, each item tied to the rule that makes the question come up
• What no published rule read for the map says, such as a time limit for telling a patient a result is ready

The published rules on the administration chain from booking to record keeping, from the bodies listed in Sources, by hand-off and quoted from source (England)

ER Blood · edition of 20 October 2026 · regulations, regulator guidance and the UKAS and GOV.UK pages read on 20 October 2026; the NHS England records code as published (Internet Archive copy of 22 April 2026) · next review 20 January 2027, kept current by ER Blood

Who this is for. The person who runs bookings and results administration at a small independent clinic in England that takes blood and sends it to a laboratory: the practice manager, the registered manager, the receptionist who books patients and sends results on. It covers the administrative chain only. Nothing in it is about what a result means, which blood test anyone should have, or what is normal.

What you will be able to do. Put each step of your results administration next to the published rule that touches it; see, for each of the five hand-offs, which regulator wrote the rule, what the words actually say and which nation they cover; and keep a finished list of the records each rule asks about, so that the answer to "where is that written down?" is already on file.

What is in it that a general answer is not. The rules quoted to the regulation, paragraph and sub-paragraph from the official text read on 20 October 2026, not paraphrased. The care regulator's own guidance lines that mention results, consent records and shared care. The retention periods from the NHS England schedule for the record types a results desk actually holds, including the ones people forget: telephone systems, subject access requests, complaints and incidents. The places where a rule is England-only, UK-wide, or written for NHS bodies and only borrowed by a private clinic. And the gaps: what no published rule we read says at all.

Contents

1. How to read this map
2. Which clinics the care regulator's rules reach
3. Hand-off 1: booking and the consent record
4. Hand-off 2: labelling the sample and sending it to the laboratory
5. Hand-off 3: receiving results
6. Hand-off 4: informing the patient or the referrer
7. Hand-off 5: record keeping and retention
8. The hand-off table
9. What to have written down, hand-off by hand-off
10. Rules that run across every hand-off
11. What this map does not cover

1. How to read this map

Each rule below is quoted from the issuing body's own page and dated. Four kinds of text appear, and they carry different weight:

Three habits make the map useful rather than alarming.

Read the words, not the summary. CQC says of its own scope guidance: "This is a guide to the regulations but is not a substitute for them." Where the regulation and the guidance are both quoted, the regulation is the law and the guidance is CQC's reading of it.

Check the nation. Scotland, Wales and Northern Ireland have their own care regulators. A rule from the CQC pages applies in England. A rule from the ICO applies across the UK. A clinic with a site outside England needs that nation's rules as well, and they are not in this map.

Look for "must" and "should". CQC's guidance uses both. In the regulation 17 guidance, records "must be kept and be fit for purpose", while audits "should be baselined against Regulations 4 to 20A". The map keeps each word as written.

2. Which clinics the care regulator's rules reach

The rules in sections 3 to 7 that come from the 2014 Regulations bind a "registered person": a provider registered with CQC for a regulated activity. For a clinic that takes blood, the activity in question is "diagnostic and screening procedures", in paragraph 7 of Schedule 1.

What the paragraph says. Paragraph 7(1)(c) includes "the removal of tissues, cells or fluids from the body for the purposes of discovering the presence, cause or extent of disease, disorder or injury". Paragraph 7(4)(a) then excepts "the taking of blood samples where— (i) the procedure is carried out by means of a pin prick or from a vein, and (ii) it is not necessary to send such samples for analysis to a place which is established for the purposes of carrying out tests or research in relation to samples of bodily cells, tissues or fluids".

So the exception for taking blood is written around whether the sample goes to a laboratory. CQC's page on the activity, last updated 31 March 2026, puts it in plain words: the exception covers "Blood tests carried out using a pin prick test or removing blood from a vein where the sample is not sent to a laboratory to be analysed."

Three more lines from that CQC page matter at a results desk:

• The laboratory registers too. "If you remove the sample and also carry out the examination, then you can include both in a single registration for the activity. But if you use a remote contractor for diagnostic analysis, such as a laboratory company, that provider will also need to register in its own right."
• Blood taking inside another registration. "We will consider certain low-risk procedures as part of a provider's overall registration with us. So, if you are registered with us for any other regulated activity, you will not have to register for the activity of Diagnostic and screening procedures just because you carry out the following procedures: taking blood or urine samples".
• Registration is not optional where it applies. CQC's scope of registration page says: "It is an offence to carry on a regulated activity without being registered."

This map does not say whether any clinic needs to register, or for what. That depends on the clinic's whole service and is a question for CQC's own guidance, quoted above, and for the clinic's advisers.

3. Hand-off 1: booking and the consent record

The first hand-off is from the person who wants a blood test to the clinic's diary. It creates the first record about the patient, and it is where consent is first asked for.

Consent, in the regulation. Regulation 11(1): "Care and treatment of service users must only be provided with the consent of the relevant person." Regulation 11(3) covers a person of 16 or over who lacks capacity: "the registered person must act in accordance with the 2005 Act" (the Mental Capacity Act 2005).

Consent, in CQC's guidance on regulation 11 (page last updated 16 May 2025):

• "Consent must be treated as a process that continues throughout the duration of care and treatment, recognising that it may be withheld and/or withdrawn at any time."
• "Consent may be implied and include non-verbal communication such as sign language or by someone rolling up their sleeve to have their blood pressure taken".
• "Consent procedures must make sure that people are not pressured into giving consent and, where possible, plans must be made well in advance to allow time to respond to people's questions and provide adequate information."

Consent, in the records guidance. CQC's guidance on regulation 17(2)(c) says the record "includes consent records and advance decisions to refuse treatment. Consent records include when consent changes, why the person changed consent and alternatives offered." For an administrator, that sentence is the specification: a consent record has a date, and a change of consent is a new entry with its reason, not an overwrite.

Information before the appointment. Regulation 9(3)(g) lists among the things a registered person must do "providing relevant persons with the information they would reasonably need for the purposes of sub-paragraphs (c) to (f)", which are about understanding choices and taking part in decisions.

The booking itself can be health data. The ICO's page "What is special category data?" lists among examples of health data "information collected from the individual when they register for health services or access treatment" and "appointment details, reminders and invoices which tell you something about the health of the individual". It adds that "a GP or hospital appointment in isolation will not tell you anything about a person's health", while health data could be inferred "from an individual's list of appointments at an osteopath clinic". The practical reading for a booking desk: decide which of your booking fields reveal something about health, because those fields carry the special category rules in section 10.

Edge case: the booking form asks for more than the booking needs. On the health or social care condition for special category data, the ICO says: "you must not have more data than you need." A booking form that asks for symptoms or a reason for the blood test collects health data the diary may not need.

4. Hand-off 2: labelling the sample and sending it to the laboratory

The second hand-off moves the sample, and a request, out of the clinic. Two bodies of rules meet here: the care rules on sharing responsibility with another provider, and the transport rules for the parcel.

Working with the laboratory. Regulation 12(2)(i) includes "where responsibility for the care and treatment of service users is shared with, or transferred to, other persons, working with such other persons, service users and other appropriate persons to ensure that timely care planning takes place to ensure the health, safety and welfare of the service users." CQC's guidance on regulation 12 adds: "When care is shared between two or more providers or where there are integrated services, there should be appropriate arrangements to share relevant information promptly and in line with current legislation and guidance, and to plan and deliver care in partnership."

The laboratory's own accreditation. UKAS describes ISO 15189 as the standard for medical laboratory accreditation and says it "underpins confidence in the quality of medical laboratories through a process that verifies their integrity, impartiality and competence." UKAS's answer to "how do I confirm that an organisation's accreditation is still valid?" is: "The presence of a schedule of accreditation on our website, confirms that accreditation for that organisation is current and valid. Absence of a schedule on the UKAS website indicates that the accreditation is no longer in force; where accreditation is temporarily suspended this is also noted." The companion guide, "ISO 15189 accredited medical laboratories in England", lists the current schedules whose main address is in England, read on 20 October 2026. No rule quoted in this map says a clinic must use an accredited laboratory; UKAS's statement is what accreditation shows.

The parcel. The GOV.UK page "Packaging and transport requirements for patient samples – UN3373" sets out the UK government's interpretation of packing instruction P650 of ADR, the agreement on carriage of dangerous goods by road. It was published for COVID-19 specimens, but it quotes the packing instruction that applies to UN 3373 in general. Its key lines:

• "The requirements for the road transport of UN 3373 are specified in Packing Instruction 650 of ADR".
• "It is not intended as a guide to classification of patient samples, which remains the responsibility of the consignor."
• P650(2): "The packaging shall consist of at least 3 components: (a) a primary receptacle; (b) a secondary packaging; and (c) an outer packaging of which either the secondary or the outer packaging shall be rigid."
• P650(4): the diamond-shaped mark, "minimum dimensions of 50 mm by 50 mm", with the proper shipping name "BIOLOGICAL SUBSTANCE, CATEGORY B" in letters at least 6 mm high next to it.
• P650(5): "At least one surface of the outer packaging shall have a minimum dimension of 100 mm x 100 mm."
• P650(7)(d) for liquids: absorbent material "in quantity sufficient to absorb the entire contents of the primary receptacle(s)".
• P650(11): packages packed and marked under the instruction "are not subject to any other requirement in ADR", which the Department for Transport reads as meaning that "requirements such as requiring a ADR qualified driver or a placarded vehicle et al., do not apply."
• P650(12), with the Department's reading: instructions on filling and closing the package "should be fulfilled by the packaging supplier/manufacturer when all packaging components come from the same supplier or can be an in-house instruction where packaging is supplied as individual components."

GOV.UK's "Moving dangerous goods" page lists class 6.2 as "Infectious substances" and says that air transport follows the IATA Dangerous Goods Regulations, a separate set of rules.

Labels on the tube. No regulation or regulator page read for this map sets a format for the label on a sample or for the request form. Those requirements come from the laboratory you send to. Ask it for its sample acceptance requirements in writing and keep the copy with the records in section 9.

5. Hand-off 3: receiving results

The third hand-off brings the report back into the clinic. The care rules speak to the record, not to the speed of delivery.

The record, in the regulation. Regulation 17(2)(c): the clinic's systems must enable it to "maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided".

Results, in CQC's guidance on that paragraph. Records must "Be complete, legible, indelible, accurate and up to date, with no undue delays in adding and filing information, as far as is reasonable. This includes results of diagnostic tests, correspondence and changes to care plans following medical advice." That is the only line in the CQC guidance read for this map that names diagnostic results as a record to file, and it ties filing to "no undue delays".

Access, inside and outside the clinic. The same guidance says records must "Be accessible to authorised people as necessary in order to deliver people's care and treatment in a way that meets their needs and keeps them safe. This applies both internally and externally to other organisations."

Where the report lives. NHS England's records code, Appendix III, on specimens and samples: "although the individual pathology departments may retain pathology reports, a copy must always be included on the patient record." Its retention schedule entry for "Pathology reports, information about samples" adds: "Reports should be stored on the patient file."

Edge case: a corrected or amended report. No rule read for this map uses the words "corrected report". What the rules do say is that the record must be "accurate, complete and contemporaneous" (regulation 17(2)(c)) and that consent changes are recorded with when and why. The same logic, applied by the clinic to a corrected report, keeps both versions and the date each arrived, rather than replacing one with the other. That is a reading of the regulation's words, not a quoted requirement.

Edge case: the inbox is the record. CQC's guidance says: "Both paper and electronic records can be held securely providing they meet the requirements of the Data Protection Act 2018." A results inbox shared by several staff is part of the record system, and section 10's security and breach rules apply to it.

6. Hand-off 4: informing the patient or the referrer

The fourth hand-off is the message: a result is ready, a sample must be taken again, a report is late. It is the hand-off with the least specific published text.

What the rules say.

• Regulation 9(3)(g): providing relevant persons with "the information they would reasonably need" to understand choices and take part in decisions.
• Regulation 12(2)(i) and CQC's guidance on it, quoted in section 4, where responsibility is shared with another provider, such as a referring doctor.
• Regulation 17(2)(c), as guided by CQC: records "accessible to authorised people ... both internally and externally to other organisations."
• The ICO on health data: test results are health data ("medical examination data, test results"), so every channel that carries a result, email, text message, letter or portal, carries special category data.

What no rule read for this map says. None sets a time within which a result must reach a patient, a format for a result message, or which channel to use. Those are the clinic's own decisions, made under the general duties above. Writing them down is what section 9 is for.

Edge case: the message goes to the wrong person. The ICO defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data", and adds: "This includes breaches that are the result of both accidental and deliberate causes." Its own example: "A hospital suffers a breach that results in accidental disclosure of patient records. There is likely to be a significant impact on the affected individuals because of the sensitivity of the data". Whether a given misdirected message must be reported is the risk assessment the ICO describes in section 10, made by the clinic.

Edge case: a harm question. The duty of candour in regulation 20 turns on a "notifiable safety incident", and for a registered person that is not a health service body the definition in regulation 20(9) applies only where something has happened "in the reasonable opinion of a health care professional". An administrator records and escalates; the judgement is not an administrative one. Section 10 quotes the records the regulation requires once it applies.

7. Hand-off 5: record keeping and retention

The fifth hand-off is to the archive: how long each record is kept, and how it is destroyed.

The rule from CQC. CQC's guidance on regulation 17(2)(c): records must "Be created, amended, stored and destroyed in line with current legislation and nationally recognised guidance" and "Be kept secure at all times and only accessed, amended, or securely destroyed by authorised people." On staff and management records: "Providers must observe data protection legislation about the retention of confidential personal information." Management records "may include governance arrangements such as policies and procedures, service and maintenance records, audits and reviews, purchasing, action plans in response to risk and incidents."

The rule from the ICO. On storage limitation: "You must not keep personal data for longer than you need it." "You need a policy setting standard retention periods wherever possible, to comply with documentation requirements." "You should also periodically review the data you hold, and erase or anonymise it when you no longer need it." And for small organisations: "If you are a small organisation undertaking occasional low-risk processing, you may not need a documented retention policy. However, if you don't have a retention policy (or if it doesn't cover all of the personal data you hold), you must still regularly review the data you hold, and delete or anonymise anything you no longer need." The ICO also says of industry guidelines: "they do not guarantee compliance. You must still be able to explain why those periods are justified, and keep them under review."

The nationally recognised schedule. The Records Management Code of Practice for Health and Social Care (NHS England; first published 4 August 2021, updated 7 August 2023, read from the as published; Internet Archive copy of 22 April 2026) says it "is relevant to organisations working within, or under contract to, the NHS in England" and applies "to adult social care and public health functions commissioned or delivered by local authorities". It names "independent care providers providing an element of NHS or nursing care" among the smaller providers it applies to. For a clinic that does no NHS work, it is the kind of "nationally recognised guidance" CQC's regulation 17 guidance refers to, not a code written for it. It says: "The retention periods given in Appendix II are the minimum periods for which records must be retained for health and care purposes."

The schedule entries a results desk holds, as written in Appendix II:

Edge case: public inquiries. The code says that "at the time of writing there are a number of on-going public inquiries including the Infected Blood Public Inquiry (IBI) and the UK COVID-19 Inquiry. This means that records must not be destroyed until guidance is issued by the inquiry." Check Appendix I of the current code before a destruction run.

Edge case: the code itself moves. The code says of itself that it "will be reviewed and updated as necessary". This edition quotes it as published, from the Internet Archive copy of 22 April 2026.

8. The hand-off table

One row per rule, in hand-off order. "Nation" is the nation the issuing body's text covers.

9. What to have written down, hand-off by hand-off

This is the list of documents and records that answer the question each rule above asks. It does not say that a clinic without one of them is in breach of anything. It names, for each item, the rule that makes the question come up.

Hand-off 1: booking and consent

• The booking fields your system holds, with the ones that reveal health marked (ICO health data examples).
• How consent is asked for and recorded, including what happens when a person withdraws or changes consent: date, reason, alternatives offered (CQC guidance on regulation 17(2)(c)).
• The route for a patient aged 16 or over who may lack capacity (regulation 11(3), the Mental Capacity Act 2005).
• The information given to patients before the appointment (regulation 9(3)(g)).
• Your Article 6 lawful basis and Article 9 condition for health data. The ICO: "you must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9."

Hand-off 2: sample and dispatch

• The name of each laboratory you send to, its UKAS accreditation number, and the date you last checked its schedule on the UKAS site (UKAS: presence of the schedule confirms current accreditation).
• The laboratory's written sample acceptance and request-form requirements, as supplied by it.
• How information is shared with the laboratory and who at the clinic owns that link (regulation 12(2)(i) and CQC's guidance on it).
• The packaging used, its supplier's filling and closing instructions, and the evidence that the package is capable of passing the P650 drop test. The Department for Transport's interpretation cites VCA guidance "to either perform an in-house test keeping a record of what was done or to compile an evidence folder", which "could include records of previous shipments".
• The courier or carriage arrangement and whether any leg goes by air (IATA rules, per GOV.UK).

Hand-off 3: receiving results

• Where each report is filed and how quickly, given CQC's "no undue delays in adding and filing information" (guidance on regulation 17(2)(c)).
• Who may open the results inbox or portal (CQC: "only accessed, amended, or securely destroyed by authorised people").
• What happens to a corrected or amended report: both versions kept, each dated (a reading of regulation 17(2)(c), stated as such in section 5).
• How a report is matched to the right patient record (CQC: records "accurate, complete").

Hand-off 4: informing the patient or referrer

• Which channels carry results, and for each one how the recipient is confirmed (ICO: test results are health data).
• Who sends what: result ready, repeat sample needed, delay. The clinical content of any message is decided by the clinician, not the desk.
• How a misdirected message is handled, from discovery to the breach assessment, and who decides (ICO breach guide).
• How a request to send a result to someone else, such as a referring doctor, is recorded (regulation 12(2)(i); CQC "externally to other organisations").

Hand-off 5: records and retention

• A retention schedule listing each record type above, its period and its source (ICO: "standard retention periods for different categories of information"; NHS England Appendix II).
• The date of the last review of held data and what was erased or anonymised (ICO: "periodically review").
• Destruction records, kept for the period in the schedule (Appendix II: 20 years for destruction certificates).
• A note of any public inquiry hold on destruction (records code, Appendix I).

10. Rules that run across every hand-off

Personal data breaches (ICO, UK). "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it. If you take longer than this, you must give reasons for the delay." "If a breach is likely to result in a high risk to the rights and freedoms of individuals, the UK GDPR says you must inform those concerned directly and without undue delay." The ICO's checklist line: "We document all breaches, even if they don't all need to be reported." And on a processor, such as a laboratory or software supplier acting for the clinic: "under Article 33(2) it must inform you without undue delay as soon as it becomes aware." Article 33(4) "allows you to provide the required information in phases".

Subject access (ICO, UK). "There are no formal requirements for a valid request. A person can make a SAR verbally or in writing, including by social media. They can make it to any part of your organisation, and they do not have to direct it to a specific person or contact point." A request to the receptionist counts. Time: "You must comply with a SAR without undue delay and at the latest within one month of receipt of the request". To count the month, "start from the actual date you receive the request ... and count forward to the end of the same date in the following month." The ICO adds that a fixed figure may be used: "you could adopt a 28-day period to ensure that you always comply within a calendar month." An extension "by a further two months" is possible where "the request is complex" or several requests come from the same person. Fees: "In most cases, you cannot charge a fee to comply with a SAR."

Health records carry a special exemption, and it is not an administrative call. The ICO: "You are exempt from complying with a SAR for health information to the extent that complying with the right of access would likely cause serious harm to the physical or mental health of any person." Where the clinic is not a health professional, it needs an opinion from "the appropriate health professional", obtained "within the last six months". The desk's job is to route the request in time; the clinician decides any withholding.

Lawful basis for health data (ICO, UK). Article 9(2)(h) covers processing "necessary for the purposes of preventive or occupational medicine, ... medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services". Article 9(3), as the ICO explains it, means "you can only rely on this condition if the personal data is being processed by (or under the responsibility of) a professional who is subject to an obligation of professional secrecy", which the Data Protection Act 2018 section 11 extends to "another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law." The ICO's care home example applies the same reasoning to staff who are not healthcare professionals but have "a duty of confidence".

Duty of candour (regulation 20, England). CQC: "It applies to every health and social care provider that CQC regulates." Once a notifiable safety incident has occurred, the notification must, under regulation 20(3), "be given in person by one or more representatives of the registered person", include "an account, which to the best of the registered person's knowledge is true, of all the facts", "include an apology", and "be recorded in a written record which is kept securely by the registered person." Regulation 20(4) requires a written follow-up. Regulation 20(5)(b): where the person cannot be contacted or declines, "a written record is to be kept of attempts to contact or to speak to the relevant person." Regulation 20(6): "The registered person must keep a copy of all correspondence with the relevant person under paragraph (4)." CQC's guidance adds: "Apologising is not an admission of liability."

Governance (regulation 17(1), England). "Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part." Regulation 17(3) says the registered person must send CQC, "when requested to do so and by no later than 28 days beginning on the day after receipt of the request", a written report on how the requirements of 17(2)(a) and (b) are being met and "any plans ... for improving the standard of the services". The written-down list in section 9 is the raw material of that report.

NHS data and systems (DSPT, England). The Data Security and Protection Toolkit describes itself as "an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian's 10 data security standards", and says: "All organisations that have access to NHS patient data and systems must use this toolkit". On 20 October 2026 its home page listed the 2026-27 version 9 of the toolkit's outcomes, assertions and evidence items, dated 2 October 2026. A clinic with no access to NHS patient data or systems falls outside that sentence's words; one that has access falls inside them.

The guidance is moving. The ICO's special category and storage limitation pages each carry the line: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change." The ICO's breach page records that on 20 August 2025 the Data (Use and Access) Act changed the PECR breach reporting timescale "from 24 hours to 72 hours". Recheck these pages at each review.

11. What this map does not cover

• Anything clinical: what a result means, which blood test to order, reference ranges, or when a result needs a clinician's action.
• Whether any clinic meets any rule. The map quotes rules; it gives no verdicts.
• Scotland, Wales and Northern Ireland care rules.
• Professional regulators' own duties (the GMC, NMC and others). CQC notes that the professional duty of candour "is overseen by regulators of specific healthcare professions".
• Medical device and in-vitro diagnostic rules (MHRA), which govern products rather than the administrative chain described here.
• Employment and staff records beyond the CQC lines quoted in section 7.

What ER Blood does with this

ER Blood works on the administrative side of the chain this map describes: bookings, the sample leaving, the report coming back, the message going out, and the record of each. Nothing clinical, and no patient records.

The next step is free and needs nothing from you but an email. ER Blood's page at erblood.com shows the fields for an administrative exception log: time, action, responsible role and receipt, with identity holds and corrected reports kept apart from ordinary delays. Write to hello@erblood.com for those fields by email. No patient records, medical results or description of your whole operation is needed.

Sources

Legislation, read on 20 October 2026 on legislation.gov.uk (revised text):

• Health and Social Care Act 2008, section 8: https://www.legislation.gov.uk/ukpga/2008/14/section/8
• The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, regulation 1: https://www.legislation.gov.uk/uksi/2014/2936/regulation/1
• Regulation 9, person-centred care: https://www.legislation.gov.uk/uksi/2014/2936/regulation/9
• Regulation 11, need for consent: https://www.legislation.gov.uk/uksi/2014/2936/regulation/11
• Regulation 12, safe care and treatment: https://www.legislation.gov.uk/uksi/2014/2936/regulation/12
• Regulation 17, good governance: https://www.legislation.gov.uk/uksi/2014/2936/regulation/17
• Regulation 20, duty of candour: https://www.legislation.gov.uk/uksi/2014/2936/regulation/20
• Schedule 1, paragraph 7, diagnostic and screening procedures: https://www.legislation.gov.uk/uksi/2014/2936/schedule/1/paragraph/7

Care Quality Commission pages, read on 20 October 2026:

• Regulation 11: Need for consent (page last updated 16 May 2025): https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-11
• Regulation 12: Safe care and treatment (last updated 16 May 2025): https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-12
• Regulation 17: Good governance (last updated 16 May 2025): https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-17
• Regulation 20: Duty of candour (last updated 16 May 2025): https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-20
• Scope of registration: https://www.cqc.org.uk/guidance-regulation/providers/registration/scope-registration
• Scope of registration, diagnostic and screening procedures (last updated 31 March 2026): https://www.cqc.org.uk/guidance-regulation/providers/registration/scope-registration/regulated-activities/diagnostic-and-screening-procedures

Information Commissioner's Office guidance, read on 20 October 2026:

• What is special category data?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/
• What are the rules on special category data?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-rules-on-special-category-data/
• What are the conditions for processing?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/
• Principle (e): storage limitation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/
• Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
• Right of access, how do we recognise a SAR?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-recognise-a-subject-access-request-sar/
• Right of access, what should we consider when responding?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/
• Right of access, health information: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/health-information/

NHS England records code as published, read on 20 October 2026 (Internet Archive copy of 22 April 2026; the code first published 4 August 2021, updated 7 August 2023):

• Records Management Code of Practice, including Appendix II retention schedule and Appendix III: https://web.archive.org/web/20260422171749/https://transform.england.nhs.uk/information-governance/guidance/records-management-code/records-management-code-of-practice/

Toolkits, accreditation and transport, read on 20 October 2026:

• Data Security and Protection Toolkit, home page: https://www.dsptoolkit.nhs.uk/
• UKAS, ISO 15189 medical laboratory accreditation: https://www.ukas.com/accreditation/standards/medical-laboratory-accreditation/
• UKAS, FAQs (checking accreditation and validity): https://www.ukas.com/faqs/
• GOV.UK, Packaging and transport requirements for patient samples – UN3373 (published 26 March 2020): https://www.gov.uk/government/publications/packaging-and-transport-requirements-for-patient-samples-un3373/packaging-and-transport-requirements-for-patient-samples-un3373
• GOV.UK, Moving dangerous goods: https://www.gov.uk/moving-dangerous-goods