Access to Health Records Under General Data Protection Regulations (2018)
The General Data Protection Regulation (2018) gives every living person the right to apply for access to their health records or have factual errors corrected. Any request for access to health records must be made in writing on the relevant form obtained from the practice and sent to the Practice Manager.
An individual who makes a Subject Access Request (S.A.R.) has the right to:
- Be told by the practice whether any personal data is held about them, and
- Be supplied with a copy of the information that forms any such personal data,
- Obtain a copy of the record in permanent form, and
- View a record without obtaining a copy
- To have information explained where necessary e.g. medical abbreviations.
No reason needs to be given for an application (unless the application is for the records of a deceased patient). The application must confirm and prove that they are legitimately entitled to access the personal data requested.
Applicants must meet one of the following criteria:
- The applicant is the patient,
- The applicant has been asked by the patient to apply and attaches their written consent.
- The applicant is acting in loco parentis and the patient is under the age of 16. If it is in the child's best interests and not contrary to a competent child's wishes.
- The applicant has been appointed by a court when the patient is incapable of managing his own affairs.
- When a patient has died, an application for access to the medical records can only be accepted with the written permission of the patients personal representative. That person will either be an executor of the estate or, if the person died intestate, the administrator of the estate.
Under the General Data Protection Regulations (2018) there are certain circumstances in which the practice may withhold information. There are specific reasons why access to personal data may be denied, or limited including:
- where the information might cause serious harm to the physical or mental health or condition of the patient, or any other person.
- where it would involve disclosing information relating to or provided by a third person who had not consented to the disclosure.
- where the health professional in charge of a patient's care assesses that a patient under the age of 16 cannot understand the implications of accessing their records.
- Where the patient has expressly stated that information must not be disclosed.
- Where information relates to, or has been given by, anyone except a clinician involved in the patients care, unless their consent has been given.
The Pulteney Practice must be prepared to justify decisions to withhold information.
Under the General Data Protection Regulations (2018), there is no obligation to comply with an access request unless the practice has enough information to identify the applicant and locate the information. You will therefore be asked to complete an application form. If you would like to Access your Health Records we request that you complete the Subject Access Application for (SAR1) following the link below -:
Subject Access Request Form
When coming to the surgery to view or collect a copy of the records you will be asked to provide a form of photographic identification such as a passport or photo driving licence.
Once the practice has all the relevant information and fee where relevant, we will comply with the request promptly, within 21 days and by no later than 30 days after the request has been made. In exceptional circumstances if it is not possible to comply within the 30 day period you will be informed. A senior member of the practice staff will be present when you view the records to assist you in understanding the information in the records.