A request by a patient, or a request by a third party who has been authorised by the patient, for access to copies of medical records under the GDPR (and DPA 2018) is called a Subject Access Request (SAR). If you want to see all/part of your health records, please  contact the Practice and we will provide you with our request form. You don’t have to give a reason for wanting to see your records and there is no charge for this service. You willl however be required to produce proof of identity when you request access. The Practice has an obligation under the GDPR and DPA2018 to ensure that any information provided for the patient can be verified.

The Practice has up to 30 days to respond to your request. If additional information is needed before copies can be supplied, the 30-day time limit will begin as soon as the additional information has been received.

The 30 day time limit can be extended for two months for complex or numerous requests where the data controller (usually your Practice) needs more time to collate and supply the data. You will be informed about this within 30 days and provided with an explanation of why the extension is necessary.

When submitting a request, you should specify if you:

• want all or just part of your record (if just part of the record is required please be specific re date range)
• would like your records to be given to you in a specific format that meets your needs, and we will endeavour to accommodate your request

Please note we never send original medical records because of the potential detriment to patient care should these be lost

Who may apply for access?

Patients with capacity

Patients with capacity have a right to access their own health records via a SAR. You may also authorise a third party to do so on your behalf. Competent young people may also seek access to their own records. It is not necessary for them to give reasons as to why they wish to access their records.

Children and young people under 18

Where a child is competent, they are entitled to make or consent to a SAR to access their record.

Children aged over 16 years are presumed to be competent. Children under 16 in England, Wales and Northern Ireland must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR. However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records. Where, in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR. Where a child is considered capable of making decisions about access to his or her medical record, the consent of the child must be sought before a parent or other third party can be given access via a SAR.

Solicitors

You can authorise a Solicitor acting on your behalf to make a SAR. We must have your written consent before releasing your medical records to your acting Solicitors. The consent must cover the nature and extent of the information to be disclosed under the SAR (for example, past medical history).

Information that should not be disclosed

The GDPR and Data Protection Act 2018 provides for a number of exemptions in respect of information falling within the scope of a SAR. If we are unable to disclose information to you, we will inform you and discuss this with you.