Document control in HTM: which records to keep and for how long

Clinical engineering is judged largely by records. A device may be maintained perfectly for a decade, but if the work orders, test results and parts history cannot be produced, the program is indistinguishable from one that did nothing. Document control is therefore not administration layered on top of maintenance. It is the mechanism that turns individual repairs into an auditable, transferable account of how equipment was kept safe.

Why records carry the program

Maintenance knowledge walks out of the door with the engineer who holds it. A record is what remains: what was tested, what was found, what was replaced and who signed. It supports the next repair, the next audit and the next investigation into an incident that happened months earlier.

Records also protect the organization. When a device is linked to a patient injury, the first questions concern its service history, its modifications and its software state at the time of use. An incomplete record turns a defensible position into an uncomfortable one.

Which records to keep

The list should follow the device through its life rather than follow the department's filing habits. Anything that changes the device's condition, its configuration or the justification for keeping it in service belongs in the file.

• Acceptance testing and commissioning results, including baseline measurements.
• Preventive maintenance work orders with recorded values, not only tick marks.
• Corrective repairs, parts used, firmware versions applied and post-repair verification.
• Safety testing and electrical measurements where the device class requires them.
• Recall and field safety notices with the action taken and its closure.
• Incident reports, investigations and any resulting modification.
• Training and competency records for staff who operate or maintain the device.
• Decommissioning, disposal or transfer documentation.

Deciding a retention period

Retention is usually set by the longest of several obligations rather than by a single rule. Manufacturer instructions, accreditation requirements, national device regulations and the organization's own legal advice each impose a floor, and the device's life often exceeds all of them.

A practical approach keeps records for the life of the device plus a defined period after it leaves service, so that late-arising safety questions can still be answered. The reasoning behind the chosen period should be written down, because an unexplained retention rule is the first thing an auditor asks about.

Retention also has to survive format change. Paper files get boxed, systems get replaced and vendors discontinue support. A retention policy that depends on one application remaining available is a policy with an expiration date nobody has recorded.

Tying a record to a device and a task

A record is only findable if it carries the right identifiers. The unique device identifier anchors the device, the work order number anchors the task, and the timestamp anchors both to a moment in time. Asset numbers drift when devices are swapped between departments, while the device identifier does not.

Version control, signatures and corrections

Procedures change, and a record means little without the version of the procedure that was followed. Reference the revision in the work order, keep superseded versions available, and make clear which devices were maintained under which revision.

Corrections need the same discipline. An entry should never be erased or overwritten in a way that hides the original. A dated correction, an explanation and an identifier for the person making it preserve both accuracy and credibility. Electronic systems should be configured to enforce this rather than to allow silent edits.

Signatures matter most where responsibility is transferred: acceptance, return to service after a critical repair, and decommissioning. A signature that records a name, a role and a time is evidence. A shared login is not, and auditors know the difference.

What an auditor actually follows

Auditors rarely sample records at random. They pick a device, then follow the trail: the inventory entry, the maintenance schedule, the completed work orders, the parts and software changes, the safety tests and any incident history. A break anywhere in that chain becomes the finding.

They also work in reverse. Given an incident date, they ask what the device's condition was at that moment and who last touched it. Producing an answer within minutes is a sign of a controlled system. Producing it after a week of searching is a finding in itself, whatever the records eventually show.

Most of this is easier when the record lives in the same system that schedules the work. That is the practical argument for a CMMS over a folder of scanned paperwork, and the reason migration between systems deserves care rather than a bulk export.

Records at replacement and disposal

The end of a device's life generates records that are easy to skip and expensive to lose. Removal from the inventory, data sanitization, destruction or resale, and the final safety status all need documenting, particularly where storage media held patient data.

A closed record also answers a question that arrives years later: was this device still in service when a safety notice was issued, and was the notice applied? Without a clean end date, that question cannot be answered.

Good documentation is unglamorous and quickly becomes invisible when it works. Its value shows up in the audit that finds nothing, the investigation that concludes quickly and the replacement decision that rests on evidence rather than memory. Sterile processing records follow the same logic, which is why monitoring sterilization quality depends on traceable load data as much as on the tests themselves.