The General Data Protection Regulation 2016 (GDPR) and Data Protection Act 2018 gives every living person, or an authorised representative, the right to apply for access to health records. A request should be made to the data controller at the NHS organisation where your records are held. Under GDPR, there is NO fee to view your health records or to be provided with a copy of them.
We are not obliged to comply with your access request:
- Unless we have sufficient information to identify you and to locate the information held about you
- If your request is deemed to be repetitive
- It is excessive in nature - for excessive requests we may pass on our administrative costs
Once we have all the required information, where relevant, your request will be dealt with within one month. In exceptional circumstances, where it is not possible to comply with this timeframe, you will be informed of the delay and given a timescale of no longer than a further two months from the date of request for when your request is likely to be met. If you choose to share your information with anyone else, this will be at your own risk.
In some circumstances, the legislation permits us to withhold information held in your health records. These rare cases are:
- Where it has been judged that supplying you with the information is likely to cause serious harm to your physical and/or mental health and/or condition, or that of another person;
- Where providing you with access would disclose information relating to or provided by a third person who had not consented to the disclosure. This exemption does not apply where that third person is a health professional involved in your care
When making your request for access, it would be helpful if you could provide details of the periods and parts of your health record that you require. Although this is optional, it will help save NHS time and resources, and may avoid the issue of excessive requests and associated costs.
If you are using an authorised representative, you need to be aware that in doing so they may gain access to all health records concerning you which may not be relevant. If this is a concern, you should inform your representative of what information you wish them to specifically request when they are applying for access.
Please contact the surgery for alternative methods of obtaining access if you are unable to make a request in writing.