Medical records are integral in proving whether there has been clinical negligence and/or when assessing the severity of an injury.

Under the Data Protection Act (DPA) 2018 and General Data Protection Regulation (GDPR), individuals have a right to access their health records. This is often known as a Subject Access Request.

You will have a distinct set of records for each NHS service you attend, including your GP surgery, hospital, dentist and opticians. The right to access your health records includes private health records.

You therefore may have to make various and separate requests to each practice. Each practice should have details available on their website on how to make a Subject Access Request. You will be able to write a letter to the Practice Manager or Medical Records Department, however often the quickest method will be to email or complete an online form (if there is one).

Your request should include details of your name, address and date of birth so that the records holder can identify you and easily locate your records.

Timings

You should be provided with a copy of your medical records without delay, and within one calendar month of the date the records holder receives the request.

If the records holder asks for identity verification, the time limit will begin once they have received confirmation of this.

This time period can be extended up to an additional two months if the request is complex or if you have made multiple requests. The records holder should inform you of any delay and the reason for the delay within one month of receiving the request. 

Cost

Unless a request is considered to be ‘manifestly unfounded or excessive’, the organisation should provide your personal data free of charge. If you ask for multiple copies, the organisation can charge a reasonable fee.

What is ‘manifestly unfounded or excessive’?

Whether a request is ‘manifestly unfounded or excessive’ is fact dependent, there is no set definition. An example of where an organisation might consider a request to be ‘manifestly unfounded or excessive’ is if it is made with the intention to cause harassment or disruption, or the request overlaps with an ongoing previous request.

A third party can make a Subject Access Request on behalf of an individual if the third party is entitled to act on the individual’s behalf. A straight-forward example of this is a solicitor making a request on behalf of a client.

The rules governing parents’ access to children’s records are complicated. Generally, someone with parental responsibility can seek access to a child’s medical records. This is, however, subject to the child’s wishes (if they have capacity to refuse/consent to the disclosure of their records), or if the request is contrary to the child’s best interests.

You may not receive all the data you have requested if the organisation considers the request ‘manifestly unfounded or excessive’, if an exemption applies, or if the information requested is not covered by a Subject Access Request.

A records holder may refuse your request if the records could cause serious harm to your health, or if the records contain another person’s data. If the records holder does not comply with your request, they must respond with their reasons for refusal.

If you are unsatisfied with a response to a Subject Access Request, individuals have the right to make a complaint to the Information Commissioner’s Office (ICO) or seek a judicial remedy i.e. obtain an injunction for the specific disclosure.