Access to Medical Records

Right to Access

In accordance with the Access to Health Records Act 1990 individuals have the right to access health records held by a healthcare provider that has treated that individual, and/or to access a summary care record (SCR) created by the individual’s GP. The Data Protection Act (DPA 2018) gives individuals the right to ask for a copy of the information an organisation holds about them; this right is commonly known as a Data Subject Access Request (DSAR). In the case of health records, a request for information has to be made with the organisation that holds the individual’s health records, otherwise known as the data controller.

PRP has mechanisms in place to inform patients of their right to access the information held about them, and how long it will take for a DSAR process to be completed.

With effect from April 2016, NHS practices are, as part of their contractual obligation, to provide patients with access to coded information held within their health records. Such information includes:

• Demographics
• Allergies
• Immunisations
• Medication
• Results
• Procedures
• Values
• Problems/diagnoses
• Other (ethnicity, QOF, etc.)

NHS England have published an information leaflet Patient Online which provides further detailed information about this obligation and how patients can access their health record online.

There are occasions when a GP may firmly believe that it is not appropriate to share all the information contained in the individual’s record, particularly if there is potential for such information to cause harm or distress to individuals, or when the record has information relating to a third party.

Patients may request paper copies of health records and, regardless of the preferred method of access, patients and authorised third parties must initially complete a DSAR form.

Requests

Requests may be received from the following:

Competent patients may apply for access to their own records or authorise third-party access to their records.

Children and young people may also apply in the same manner as other competent patients and PRP will not automatically presume a child or young person has capacity under the age of 16. However, those aged 12 or over are expected to have the capacity to consent to medical information being disclosed.

Parents may apply to access their child’s health record so long as it is not in contradiction to the wishes of the competent child.

Individuals with a responsibility for adults who lack capacity are not automatically entitled to access the individual’s health records. PRP] will ensure that the patient’s capacity is judged in relation to particular decisions being made. Any considerations to nominate an authorised individual to make proxy decisions for an individual who lacks capacity will comply with the Mental Capacity Act in England and Wales and the Adults with Incapacity Act Scotland.

Next of kin have no rights of access to health records.

Police are not able to access health records without first obtaining a court order or warrant. However, health professionals at PRPmay disclose relevant information to the police if the patient has consented or if there is overriding public interest. For detailed information, see section 4.1.6 of footnote 1.

Solicitors and insurance companies in most cases will provide the patient’s signed consent to release information held in their health record. A standard consent form has been issued by the BMA and Law Society of England and Wales and PRP will request that third parties complete this form.PRP will ensure that patients are fully aware of the information being provided to the solicitor who is acting for that patient. In the case of a solicitor requesting information, the BMA has provided the following templates:

• Consent form to release information to solicitors in England & Wales
• Consent form to release information to solicitors in Scotland

The Information Commissioner’s Office (ICO) refers to the use of SARs to obtain medical information for insurance purposes as an abuse of access rights and the processing of full medical records by insurance companies risks breaching the GDPR.

Therefore, PRP will contact the patient to explain the extent of disclosure sought by the third party. The practice can then provide the patient with the medical record as opposed to the insurer. The patient is then given the opportunity to review their record and decide whether they are content to share the information with the insurance company.

PRP will advise insurers to use the Access to Medical Reports Act 1988 when requesting a GP report. The following fees are applicable:

• GP report for insurance applicants £104.00
• GP supplementary reports £27.00

Deceased patients retain the right of confidentiality. There are a number of considerations to be taken into account prior to disclosing the health record of a deceased patient. Such considerations are detailed in the Access to Health Records Act 1990.  Under the terms of this Act, PRP will only grant access if you are either:

• A personal representative (executor of the deceased person’s estate), or
• Someone who has a claim resulting from the death

The medical records of the deceased will be passed to Primary Care Support England (PCSE) for storage. PRP can advise you of who you need to contact in such instances. PCSE will retain the GP records of deceased patients for ten years, after which time they will be destroyed. PCSE have provided an application form which can be used to request copies of a deceased patient’s record.

In the cases of any third-party requests, PRP will ensure that the patient has consented to the disclosure of this information by means of a valid signature of the patient.

In accordance with the GDPR, patients are entitled to receive a response within the maximum given time frame of one calendar month from the date of submission of the DSAR. In order to ensure full compliance regarding DSARs, PRP will adhere to the guidance provided in the GDPR.    In the case of complex or multiple requests, the data controller may extend the response time by a period of two months. In such instances, the data subject must be informed and the reasons for the extension given.

Under The Data Protection (Subject Access Modification) (Health) Order 2000, PRP will ensure that an appropriate healthcare professional manages all access matters. At PRP there are a number of such professionals, and wherever possible the individual most recently involved in the care of the patient will review and deal with the request. If for some reason they are unable to manage the request, an appropriate professional will assume responsibility and manage the access request.

Furthermore, to maintain GDPR compliance,  the data controller at PRP will ensure that data is processed in accordance with Article 5 of the GDPR and will be able to demonstrate compliance with the regulation (see GDPR policy for detailed information). Data processors at PRP will ensure that the processing of personal data is lawful and at least one of the following applies:

• The data subject has given consent to the processing of his/her personal data for one or more specific purposes
• Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract
• Processing is necessary for compliance with a legal obligation to which the controller is subject
• Processing is necessary in order to protect the vital interests of the data subject or another natural person

For providing a copy of a deceased patient’s medical records, a fee not exceeding the cost of making the copy and postal costs may be charged; this fee must be reasonable and fully justifiable.

Application Form for Access to Medical Records

Application Form – please download and complete this form to request access to your Medical Records