Access to medical records and information

The practice is registered and complies with the Data Protection Act 2018. Any request for access to notes by a patient, patient’s representative or outside body will be dealt with in accordance with the Act.

Access to your Medical Records

In accordance with the General Data Protection Regulation, patients have the right to access their data and any supplementary information held by Oldwood Surgery; this is commonly known as a data subject access request (DSAR). Data subjects have a right to receive:

  • Confirmation that their data is being processed
  • Access to their personal data
  • Access to any other supplementary information held about them

Options for access

From 31st October 2023, all patients aged 16 and above will have access to their online medical records via the NHS App or their NHS Account. This will show prospective records i.e. after 31st October 2023. For details, see online services.

Patients can also request access to their retrospective records online (records prior to 31st October 2023). The GP is required to review your medical record before granting access and this can therefore take some time to complete. If you wish to have retrospective access, please complete our Online Access to Records Request Form and return it with two forms of ID.

Lastly, you can make a request to be provided with copies of your health record. To do so, you must submit a Subject Access Request (SAR) form. You will need to return the completed SAR form in person to the practice and bring photographic ID so we can verify your identity. Patients do not have to pay a fee for copies of their records.

Time frame

Once the SAR form is submitted, Oldwood Surgery will aim to process the request within one calendar month.

Emailing documents

The Information Commissioner’s Office (ISO) are in favour of electronic SARs and all documents will therefore be sent by email. You will be asked to provide your email address and give your consent on the SAR form. If you are unable to receive emails, please speak to the receptionist for further guidance. The email will be sent by NHSmail encrypted email to ensure data security.

Exemptions

There may be occasions when the Data Controller will withhold information kept in the health record, particularly if the disclosure of such information is likely to cause undue stress or harm to you or any other person.

Giving consent to third-parties

Sometimes we receive requests from people (such as relatives, partners, etc) who wish to deal with medical matters on behalf of the person who is our patient. Whilst these are almost universally motivated by good intentions and in the best interests of the patient concerned, they pose a medico-legal problem for us.

We are required by law (with only a few very specific exceptions) to maintain the confidentiality of our patient’s medical record. This can cause the people trying to act on behalf of the patient to think that we are being obstructive, but that is not the case.

The General Medical Council take seriously breaches of confidentiality and there are also potential legal sanctions for unjustified breaches of confidence. We therefore have to be certain that the patient gives their consent for us to interact with others on their behalf and we make no apology for ensuring that we have this consent before doing so, however urgent the other person might consider their request.

If you are the patient, you must give very serious consideration to the ramifications of giving your consent for someone else to interact with us on your behalf. There have been cases elsewhere when, for example, parents have discovered things about their adult child’s medical history which the son or daughter never wanted their parents to know. Obvious examples include sexually transmitted infections or contraceptive choices.

We therefore will only interact with people other than the patient concerned when we have a signed consent form from the patient.

If you wish to give consent for a third party to access your records or discuss your medical care with us, please complete, sign and return this Consent Form to us at the surgery.

Please note, we retain the right to reject any application to give consent to a third-party, where we consider it given wrongfully, under duress, or inappropriate in any other way. Please also note, this advice and the third-party consent form is NOT designed to be used for giving consent for matters such as reports, forms, insurance application data releases, etc. This advice relates specifically to giving consent for a third-party to act on your behalf.

Solicitor and Insurance Requests

We may also receive requests for access to your medical notes from solicitors and insurers acting upon your behalf. They will ask you to sign their consent form and we will contact you to check what information you are happy for us to provide.

Date published: 10th October, 2014
Date last updated: 25th March, 2024