Access to Medical Records
In accordance with Article 15 of the UK GDPR, individuals have the right to access their data and any supplementary information held by this organisation.
SARs are predominantly used for access to, and the provision of, copies of medical records. This type of request need not always be in writing (e.g., letter, e-mail). However, applicants should be offered the use of a SAR application form which allows for the explicit indication of the required information.
The reason for granting access to data subjects is to enable them to verify the lawfulness of the processing of data held about them. In addition, data subjects can authorise third party access, e.g., for solicitors and insurers, under the UK GDPR.
When a data subject (individual) wishes to access their data, they are to be encouraged to use the SAR form which can be found below.
To request a SAR, the requester must be:
- The data subject OR
- Have the written permission of the data subject OR
- Have legal responsibility for managing the subject’s affairs to access personal information about that person, such as a lasting power of attorney (LPA)
It is the requester’s responsibility to satisfy this organisation of their legal authority to act on behalf of the data subject. The organisation must be satisfied of the identity of the requester before they can provide any personal information.
Requests may be received from the following:
- Competent patients
May apply for access to their own records or authorise third party access to their records.
- Children and young people
May also apply in the same manner as other competent patients. This organisation will not automatically presume a child or young person has capacity under the age of 16. However, those aged 13 or over are expected to have the capacity to consent to medical information being disclosed.
- Parents
May apply to access their child’s health record providing this is not in contradiction of the wishes of the competent child.
- Individuals with a responsibility for adults who lack capacity
Are not automatically entitled to access the individual’s health records. This organisation will ensure that the patient’s capacity is judged in relation to the particular decisions being made.
Any consideration to nominate an authorised individual to make proxy decisions for an individual who lacks capacity will comply with the Mental Capacity Act 2005 in England and Wales and the Adults with Incapacity Act in Scotland.
- Next of kin
Have no rights of access to health records.
- Police
In all cases, the organisation can release confidential information if the patient has given his/her consent (preferably in writing) and understands the consequences of making that decision. There is, however, no legal obligation to disclose information to the police unless there is a court order or this is required under statutes (e.g., Road Traffic Act 2006).
Nevertheless, health professionals have a power under the Data Protection Act 2018 and the Crime Disorder Act 1998 to release confidential health records without consent for the purposes of the prevention or detection of crime or the apprehension or prosecution of offenders. The release of the information must be necessary for the administration of justice and is only lawful if this is necessary:
- To protect the patient or another person’s vital interests, or
- For the purposes of the prevention or detection of any unlawful act where seeking consent would prejudice those purposes and disclosure is in the substantial public interest (e.g., when the seriousness of the crime means there is a pressing social need for disclosure)
Only information that is strictly relevant to a specific police investigation should be considered for release and only then if the police investigation would be seriously prejudiced or delayed without it. The police should be asked to provide written reasons why this information is relevant and essential for them to conclude their investigations.
- Court representatives
A person appointed by the court to manage the affairs of a patient who is incapable of managing his or her own affairs may make an application. Access may be denied when the responsible clinician is of the opinion that the patient underwent relevant examinations or investigations in the expectation that the information would not be disclosed to the applicant.
- Patient representatives/solicitors
A patient can give written authorisation for a person (for example a solicitor or relative) to make an application on their behalf for copies of their medical records.
This organisation may withhold access if it is of the view that the patient authorising the access has not understood the meaning of the authorisation. It is important to stress to the patient that under a SAR, all health records are provided unless a specific time period is stated and patients should be mindful of giving access to this level of health data.
Solicitors who are acting in civil litigation cases for patients should obtain consent from the patient using the form that has been agreed with the BMA and the Law Society. If a consent form from the patient is not received with the application form then no information must be provided until this has been received.
- Requests for insurance medical reports
SARs are not appropriate should an insurance company require health data to assess a claim. The correct process for this at this organisation is for the insurer to use the Access to Medical Reports Act 1988 when requesting a GP report.
In most cases, the requester will provide the patient’s signed consent to release information held in their health record. The BMA have issued guidance on requests for medical information from insurers.
Therefore, this organisation will contact the patient to explain the extent of disclosure sought by the third party. The organisation can then provide the patient with the medical record as opposed to the insurer. The patient is then given the opportunity to review their record and decide whether they are content to share the information with the insurance company.
It is the responsibility of the data controller to verify all requests from data subjects using reasonable measures. The use of the organisation’s SAR form supports the data controller in verifying the request. In addition, the data controller is permitted to ask for evidence to identify the data subject, usually by using photographic identification, i.e., driving licence or passport.
FEES
With regard to the UK GDPR, SARs are generally free of charge. Only if the SAR is ‘manifestly unfounded’ or ‘excessive’ can a ‘reasonable’ fee be charged although the circumstances when a fee can be charged are rare and should be on a case-by-case basis.
The ICO has advised that a request could be deemed as ‘excessive’ if an individual was to receive information via a SAR and then request a copy of the same information within a short period of time. In this scenario, the organisation could charge a reasonable fee or refuse the request. Postage costs for SARs should not be charged for unless they are ‘unfounded or excessive’.
If you would like to access your Medical Records or those of someone else in accordance with the above, please click here – Subject Access Request (SAR)
Access to a deceased patient's health record and information form
Part A: Information
At Tavyside Health Centre, we appreciate that this is likely to be a distressing time for you and we wish to make the application process to access the health record as stress free as possible.
It is requested that you please complete the relevant sections of this form to enable us to facilitate your request.
Rights of access
Requests for access to health records of patients who are deceased are dealt with through the Access to Health Records Act 1990 (AHRA). There are certain individuals who have rights of access to the health records of a deceased person.
These are:
- The patient’s personal representative
A personal representative is the executor or administrator of the deceased person’s estate. An example of when we can confirm that the applicant is a personal representative of the patient is when the applicant is, or has been, the executor of the will and they have sent us copies of documents as evidence of this relationship.
- Any person who may have a claim arising out of the patient’s death
If the application is in respect of a claim arising from a patient’s death, access cannot be given to information that is obviously not relevant to the claim.
The law requires us to ask you for information to determine your right to access the health record. If you are applying to see a deceased relative’s record, we will need to see one of the following:
- Grant of probate
- Letter of administration
- Last will and testament
If you do not have any of these, we need proof of your entitlement to access the record, such as the deceased’s
- Birth certificate
- Marriage certificate
- Death certificate
Proof of identity
It will be necessary to confirm the identity of all parties included on this form. Please supply a photocopy of one document from sections A and B.
A Confirmation of name
- Full driving licence
- Passport
- Birth certificate
- Marriage certificate
- Health and Social Care Information Centre identity badge
B Confirmation of address
- Utility bill
- Bank statement
- Credit card statement
- Benefit book
- Pension book
Limitations to accessing the record or part of the record
This organisation follows the standard health records retention schedule whereby records are no longer held for patients who passed away more than 10 years ago. We are required to check that any disclosure is subject to the recorded wishes of the deceased person.
We will ensure there is nothing in the record that could harm a third person (such as information about the health of another person) if the record is to be released. If the health record, or part of the health record, is being withheld, we will advise you why but we will not be able to give you specific details.
It should be noted that under the Access to Health Records Act 1990, there is no obligation for us to provide records prior to 1991 unless a doctor feels this will help in understanding any records created after this date.
If the records that you are requesting relate to a period before 1991, we will have to consider the reasons why you are making this request. Therefore, please clearly specify why you require these records.
About the request
Access will not be given where a request is non-specific, e.g., you have a concern about treatment or care. You will need to outline specific concerns related to the care leading to a potential claim.
Only information directly relevant to a request will be disclosed.
Access for other reasons not specified
If any request does not fall under the categories of people entitled to request the records, then access to a deceased person’s records will be decided on a case-by-case basis.
The person requesting the records would need to write to the organisation demonstrating the following:
- They have a valid reason for requesting the records
- They have a legitimate relationship to the deceased
- Access to the records is in the public interest
Our fees as set out by the Access to Health Records Act 1990 and Data Protection Act 2018
Under the Data Protection Act 2018, the organisation will respond to any application within a month and this service will be provided free of charge unless the request is deemed excessive or repetitive, in which case an administration fee may be charged.