Retaining TB Laboratory Quality Records Across Paper And Digital Systems

A clear record-retention policy gives a tuberculosis laboratory a reliable memory. It shows what was tested, who performed each step, which equipment was used, what result was issued, and how problems were corrected. When records are kept in both electronic and paper forms, the policy must remove uncertainty about the official copy, access rights, storage periods, disposal, and recovery after an incident.

For Australian laboratories, the policy should fit the local operating environment rather than assume a single model. A metropolitan public laboratory may have a laboratory information system, networked instruments, and a records team, while a small service in the Northern Territory, regional Queensland, Western Australia, or Tasmania may rely on intermittent connectivity and carefully controlled paper files. The aim is a workable quality management system that protects traceability in every setting.

Define the records covered by the policy

Begin with a plain-language definition of a quality record. In a TB service, this can include accession and specimen registers, request forms, chain-of-custody details, microscopy worksheets, culture and molecular test records, validation files, quality control charts, temperature logs, equipment maintenance reports, incident forms, corrective action evidence, staff competency assessments, and internal audit reports. Supplier certificates, training attendance, and waste decontamination records may also be quality records when they demonstrate that a controlled process was followed.

Separate records from documents that explain how work should be done. A current standard operating procedure is a controlled document; a completed worksheet proving that the procedure was followed is a record. The policy should state whether drafts, superseded versions, emails, instrument exports, photographs, and scanned attachments form part of the record set. This prevents staff from saving vital evidence in personal inboxes or local computer folders.

A record register makes the policy practical. For each record type, list its owner, format, location, retention period, confidentiality level, backup method, and authorised disposal process. Link the register to the laboratory’s Quality Systems Essentials and the relevant phase of the GLI Quality Tool, so the retention arrangements support assessment, documentation, equipment control, personnel management, and continual improvement.

Set retention periods and legal responsibilities

Retention periods should be approved by the laboratory director or quality manager after checking applicable Australian requirements. The Privacy Act 1988, state and territory health-records rules, public-sector archives obligations, employment requirements, and NATA accreditation expectations may all influence how long information is kept. Requirements can differ between a NSW public pathology service, a Victorian hospital laboratory, and a private provider operating under a national network, so a generic “seven years for everything” rule may be unsafe.

Use a retention schedule with a clear trigger. The period might begin when a result is authorised, a project closes, an instrument is retired, a staff member leaves, or an incident is resolved. State the longest applicable period where several rules overlap, and identify records that must be preserved because of litigation, an investigation, an unresolved complaint, or a public health response. A legal hold should suspend routine destruction until the responsible authority releases it.

Retention is also about availability during the working life of a record. A result needed for contact tracing, a proficiency-testing review, or a NATA assessment must be retrievable within a defined timeframe. In remote Australian services, include arrangements for delayed courier runs, power interruptions, limited bandwidth, and records held temporarily at a satellite site. The policy should name who can approve an exception and how that decision is documented.

Control paper records from creation to disposal

Paper records need the same discipline as electronic data. Use standard forms with a unique document number, version, date, patient or specimen identifier, initials or signature fields, and enough space for amendments. Entries should be legible, made in permanent ink, and corrected with a single line, the author’s initials, the date, and a reason where required. Erasers, correction fluid, unapproved shorthand, and untraceable alterations should be prohibited.

Designate secure filing areas with protection from water, pests, heat, unauthorised access, and accidental removal. A locked cabinet may suit an active bench file, while an off-site archive may hold closed records. A sign-out register should record who removes a file, when it leaves, and when it returns. For laboratories developing a paper workflow, the practical paper filing guide can help translate these principles into a usable arrangement.

Scanning can improve access, but it does not automatically make the paper copy disposable. The policy should specify the scanning resolution, file format, naming convention, indexing fields, quality check, and authorised person who confirms that every page is readable and complete. If the digital image becomes the official record, document the conversion process and destruction approval. Otherwise, retain the original paper according to the schedule.

Make electronic records trustworthy and retrievable

Electronic records require controls over identity, access, change history, and preservation. Individual user accounts are preferable to shared logins, with permissions based on job role. A scientist may enter or review results, while a quality manager may approve a corrective action and an IT administrator may manage the system without changing scientific content. Access should be removed promptly when staff transfer, finish a contract, or leave the organisation.

The policy should identify the laboratory information system, shared drives, instrument middleware, secure cloud services, databases, email repositories, and removable media that may contain quality records. It should require meaningful file names, consistent metadata, read-only status after approval, and audit trails that show who created, amended, reviewed, or deleted an entry. Electronic signatures must be attributable and protected from reuse. Exported records should remain readable if a system is replaced.

Backups need a defined frequency, location, retention period, and restoration test. Keep at least one copy separated from the primary environment, with safeguards against ransomware and accidental synchronisation of deleted files. Australian laboratories should confirm where cloud data is hosted, who can access it, and how privacy and cross-border disclosure are managed. A recovery exercise should test a realistic failure, such as a server outage during a busy morning run.

Reconcile paper and electronic versions

When the same activity appears in two formats, the policy must establish which one is authoritative. For example, a signed bench worksheet may support a result entered into the laboratory information system, while the authorised electronic result is the official report. State whether the paper source remains part of the permanent record, how discrepancies are resolved, and who verifies that transcription is accurate.

Use a reconciliation check for high-risk information such as specimen identifiers, test dates, culture status, drug susceptibility results, and amended reports. A second trained person may review a manual entry, or the system may use barcode scanning and validation rules. If a result is corrected, the original value should remain visible through an audit trail rather than being overwritten. Any paper annotation made after electronic authorisation should be dated, signed, and linked to the digital record.

The procedure should cover outages. During a network failure, staff may use numbered downtime forms and later enter the information into the system after a documented verification step. The policy should state where completed downtime forms are stored, how duplicate entries are prevented, and how the outage is recorded as an incident. This is especially important for small regional laboratories that may need to keep testing moving while technical support is travelling from a larger centre.

Protect confidentiality and review the system

TB records contain sensitive health information, and some services work closely with Aboriginal and Torres Strait Islander communities where trust, respectful communication, and careful handling of identifiers are essential. Access should be limited to legitimate duties, with private workspaces for paper files and screen-locking for electronic systems. Staff training should cover privacy, secure printing, misdirected emails, verbal discussions, and the risks of photographing records on personal devices.

Disposal must be authorised, recorded, and proportionate to the format. Use secure destruction for paper, such as cross-cut shredding or an approved confidential-waste contractor, and obtain a destruction certificate where appropriate. Electronic disposal should address live systems, backups, cached files, synchronised folders, and portable media. Records under a legal hold or public health investigation must never enter routine destruction.

Review the retention policy at least annually and after a major incident, system change, audit finding, or legislative update. Sample files to check retrieval time, completeness, legibility, access logs, backup restoration, and consistency between paper and electronic copies. If waste records form part of the evidence trail, align the retention process with a controlled autoclave waste protocol, including the responsible staff member and required verification.

Adopt the policy through the laboratory’s document-control process, brief every affected worker, and place the retention schedule where staff can use it during routine work. Assign owners for paper archives, electronic systems, backups, legal holds, and disposal approvals. A policy that is tested in a metropolitan lab and a remote service, then refined through audits and incident reviews, will protect evidence, support patient care, and make quality improvement easier to prove.