This document outlines MedMost’s internal Standard Operating Procedure (SOP) and client guidance for receiving confidential medical records securely. All staff must adhere to this policy to ensure compliance with data protection and legal confidentiality requirements.

1. Purpose & Scope
The purpose of this SOP is to define the process by which MedMost receives, stores, and manages confidential medical records on behalf of clients. The procedure applies to all staff members involved in receiving and handling electronic medical data.

2. Secure File Transfer Workflow
MedMost uses a customised, end-to-end encrypted, upload method for all clients. All customer data stored by us is encrypted with one or more AES 256-bit keys. Every step of this encryption process is FIPS 140-2 Level 2 validated. 

**Daily Procedure:**
1. Our staff send the client a secure File Request link.
2. The client uploads medical records via the encrypted upload form. They have no acces to any files other than their own.
3. Admin receives notification of upload.
4. Confirmation of receipt is emailed to the client.

3. Data Retention and Security
• Files are ony ever created, edited or stored within our secure, ecnrypted platform.
• Your files are never downloaded to any other device or platform, our own platform does not permit this.
• No internal copies are ever created, downloaded or stored on insecure devices or platforms.
• No file is retained for longer than necessary for report preparation.
• All copies of your files are securely deleted after completion of the report.
• Monthly audits are conducted to review access logs and compliance.

4. Breach & Escalation Protocol
In the event of a suspected data breach, the following steps must be taken immediately:
1. Notify the Data Protection Officer (DPO) within one hour.
2. Preserve all relevant evidence and system logs.
3. Report incident to management and IT security.
4. If confirmed, notify affected clients and the ICO (if applicable) within 72 hours.