Hi everyone, I would be grateful for your thoughts on the following scenario:

In house OH service has records on all employees currently employed.  These include Pre Employments, Management referrals & Health Surveillance to varying degrees.

Post holder is moving on & the service is likely to now transfer to an outside provider for what may be a very short period of time but most records will remain in location separate to the outside provider with admin staff holding keys, providing what is required to the external OH provider.  Nobody else has access to records.

Is it sufficient for the leaving post holder to write to the new provider (giving them a duplicate key) and a member of management in the employing company confirming these arrangements?  Is there a document anywhere which which gives guidance on this?  Am sure I have seen one in the past.

Regards