Caldicott Guardian

Postgraduate and Undergraduate (not MBChB) Student Medical School Caldicott Guardian Approval

The Medical School at Dundee University has now established a Caldicott Guardian approval system for Postgraduate and Undergraduate students within the School of Medicine. 

This system does not apply to students on the MBChB course, who have their own process.
This system does not apply to students from the School of Dentistry or the School of Nursing and Midwifery.

Applications will only be considered if the following criteria are met:

  • The student is registered, and matriculated, on a course of study within the Medical School
  • The supervisor is a member of staff within the Medical School (This includes employees of the University of Dundee, or those with appropriate honorary appointments or accreditation. All employees of NHS Tayside at Registrar grade or above are considered eligible to supervise students.  This may not apply to employees of other Health Boards).
  • The supervisor holds a current certificate of Good Clinical Practice

In addition, you will be required to agree to the following standard conditions:

  • You will be expected to adhere to the University’s policy on Data Protection.  The student will be required to undertake the University’s online Data Protection Act Tutorial (, and include a signed declaration (click HERE to download) in their final project report.
    • You will not obtain data from live databases used for patient care. You may use archived or offline versions. Alternatively, an authorised user may extract the data for you.
    • All data will be stored anonymously and securely.
    • You will not use identifiable patient data in your project write-up
    • Only data essential to the project is collected

The obligations of Medical School Caldicott Guardianship

The Medical School has been given special permission by the Health Board to run its own Caldicott Guardianship system for medical students and postgraduate students. This permission is given subject to strict requirements. If we do not fully comply with these requirements we will lose this permission and students will have to apply through the Health Board scheme. It may sometimes seem that the Caldicott Guardian is being unduly bureaucratic, but this will only be to comply with external requirements.

A particularly onerous regulation is that the Caldicott Guardian is required to submit an annual report of all permissions requested. For this reason we need to:

  • Keep records of all applications and their subsequent outcomes
  • Be able to demonstrate that we have complied fully with the regulations

How to apply for Postgraduate Medical Student Caldicott Guardian Approval

The process of applying for Caldicott approval is relatively straightforward. The steps are:

  1. Download the Caldicott Application form.  Make sure you save it onto a USB stick or a computer, then open it in Adobe Reader. DO NOT try to complete the form in your browser window, or the text will not save, and will not be visible when you send it in.  Once you have completed the form:
  2. Print out the form
  3. Sign the declarations
  4. Scan the printed form as a PDF
  5. Email the PDF as an attachment to, with the single word "PGCaldicott" in the subject line

Professor Iain Crombie will deal with the application. If you need to contact him, Prof Crombie’s office is in the Mackenzie Building, Kirsty Semple Way, Dundee DD2 4BF.

 A submitted form will be dealt with as speedily as possible. However on occasion there may be slight delays. Please submit the form at least 2 weeks before you wish to begin data collection. If you have not received a response within 2 weeks, please contact Professor Crombie.

NB You must not begin data collection until you have obtained all the necessary permissions.

How to complete the form

Part A

Part A of the form should give concise information about your project, in particular the background, aims, objectives and methods, and the patient group to be studied.

Part B

Part B requires you to list the data sources you will be using. Possible entries here include case notes, databases of clinical data such as records of surgical interventions, admissions to wards etc, or laboratory databases, such as pathology or haematology records. If you are accessing a specific database, please give the name and location. You must not access live databases used for patient care to obtain data. You may use archived or offline versions. Alternatively, your supervisor or another authorised user, may extract the data for you. 

The application for approval should describe all the data items, which are to be abstracted from recorded patient data. This should be accompanied by a justification for the items to be abstracted. The regulations state that only those items essential to the project should be abstracted. 

Part C

Part C asks you to identify the Health Board jurisdiction where the study will take place. Tayside Health Board area covers Ninewells, but also Perth Royal Infirmary and Stracathro. If you intend to access data from other Health Board areas, you are required to apply for separate Caldicott approval from the Guardian in that area. This may delay the start of your project, so think carefully about whether this is really necessary to the success of the project.

Part D

Part D consists of a set of 5 screening questions. The principle behind these questions is that the data you collect must not be able to identify individual patients.

  1. There are no names, addresses or CHI numbers on the data extraction form
  2. Data will be stored securely in accordance with the University’s Data Protection policy
  3. Age will only be recorded in years, as inclusion of a date of birth might allow an individual to be recognised
  4. Postcodes may be used but no more than sector level (eg. DD1 4, not DD1 4AS
  5. All data used comes from routine sources (eg. case notes, labs, database)

You MUST be able to answer “yes” to them all. If you cannot do so, it is most likely that Caldicott Guardian approval will not be granted. If you decide, with your supervisor, that you cannot answer “yes” to all 4 questions, you should consider whether you can change the methodology of the proposed project so that you can do so.

Part E

Part E requires that you declare whether or not ethical opinion is required. You must not survey or interview patients or healthcare staff. You may seek an opinion from the East of Scotland Research Ethics committee (EoSRES) on whether ethical opinion is required. They will also advise on the process of submitting the application, if needed, via the IRAS application system.  If you do not require ethical review, you can say so. If you do require it, you should normally wait until you have received the go-ahead from the ethics committee before applying for Caldicott Guardian approval. Once you have received a favourable ethical opinion, fill in the reference number given in the letter from the committee. If you are in any doubt, consult with your supervisor. 

Duration of Caldicott Approval

Caldicott approval is awarded for a fixed period of 15 months from the date of award. At the end of that period, approval automatically lapses. Approval may be extended by the submission of a second application, stating the reasons for extension.

Access to databases

Students are not allowed access to live databases, such as Central Vision, which are used for direct patient care. The concern is that some items in the patient’s record may inadvertently be changed, with the potential to influence management decisions. All instances of access to a live database are automatically logged, and the record of this is regularly audited. Thus unauthorized access to live systems will have serious consequences. You may use archived or offline versions. Alternatively, your supervisor or another authorised user may extract the data for you

Description of data to be abstracted

The application for approval should describe all the data items, which are to be abstracted from recorded patient data. This should be accompanied by a justification for the items to be abstracted. The regulations state that only those items essential to the project should be abstracted. 


Students sometimes have to make amendments to their application form to comply with the requirements for Caldicott approval. If you do this and reapply for approval, you must indicate that you are making a reapplication in a covering e-mail. We have to be able to identify the outcome of all applications

Discontinued projects

If you apply for approval and subsequently decide not to continue with the project, you must let us know. We have to be able to identify the outcome of all applications. 


 Before you access medical records you must take your Caldicott Guardian application and the approval letter to the Clinical Records Manager in Medical Records. You may be asked to sign a confidentiality agreement. It is important that you keep this safe; it should be included in your dissertation as an appendix.