- Published
- Updated
Some systems hide a deleted record by changing its status rather than physically removing it. A record absent from the user screen can still matter when reconstructing a study process, correction or decision.
Preserve the meaning of data
Define the meanings of deletion, cancellation and invalidation. Accidentally removing an authorised record differs from withdrawing an incorrectly created record from use. Explain which statuses users can see and which records audit trails and exports include. Do not confuse a retention decision with the visibility of a record in a particular screen or report.
Worked example
For example, a duplicate visit is cancelled and disappears from the standard report, while a query attached to it remains open. The team retrieves the inactive record, linked query and cancellation reason through an authorised review route. It tests whether the intended reporting population and the historical action trail remain understandable together.
Review checks
- Review attachments and queries linked to cancelled records.
- Explain coverage differences between standard and audit-focused reports.
- Control unauthorised restoration or silent reactivation of records.
Acceptance and boundaries
Acceptance means the status, reason and relationships of an inactive record can be explained when needed. This is not a recommendation to retain every item indefinitely; applicable retention and deletion duties need separate assessment. Failure to find a record on screen also does not demonstrate secure destruction. System-exit planning should preserve the meaning of these different states.
Frequently asked questions
- Must a deleted record appear in every report?
- It depends on report purpose. Make exclusions understandable while retaining authorised access to necessary historical evidence.
- Is soft deletion equivalent to privacy erasure?
- Not automatically. A technical status change and satisfaction of an applicable erasure requirement are separate questions.