Irwin Mitchell has the largest dedicated medical negligence department in the country and is ranked in the top-tier of independent legal directories across the country. You can find out more about how we can help you and your family by visiting www.irwinmitchell.com or call freephone 0800 023 2233 to speak with one of our expert advisors.
A health record is any record created by a healthcare professional which relates to your physical or mental health condition created in connection with care provided to you.
Medical records are subject to the General Data Protection Regulation (GDPR) (as modified and enacted in British law by the Data Protection Act 2018, the DPA). The GDPR gives every living person a right to apply to see their own electronically and manually held records and any supplementary data. This applies to all existing records including NHS and private records which include information relating to your physical or mental health, recorded by a healthcare professional.
GP records include information about your medicine, allergies, vaccinations, previous illnesses and test results, hospital discharge summaries, appointment letters, and referral letters.
You can ask your GP practice for details of how to register online and to ask them to register you. You may need to provide ID and attend the practice in person.
You can access your GP records, and nominate someone you trust to access them, through GP online services. You can visit GP online services at https://www.nhs.uk/nhs-app/account/.
If your GP is connected, you may also be able to access your GP records through the NHS App. This can be downloaded for free from Google Play (for Android users) or the App Store (for iPhone users).
If you are not registered with a GP (for example, due to having moved abroad), you should visit the Primary Care Support England (PCSE) website and apply for the records from them: https://pcse.england.nhs.uk/services/medical-records.
The GDPR does not state that you have to put your request in a written form. You can therefore request your records verbally, by letter, by form, or by email. It may be advisable to follow up a verbal request with a written request.
If you request your records electronically, the information will be provided to you in a commonly used electronic form such as CD-ROM or USB. It should be noted that the GDPR allows you to receive a copy of your medical records, not the original records.
If a hospital and/or other health provider is likely to hold a large quantity of information about you, the GDPR allows you to be asked to specify the information the request relates to, such as by giving a time period. If you are wishing to access information such as X-rays or real-time imaging, for example ultrasound, it may be advisable to specifically mention this.
Under the GDPR, a copy of your records must be provided free of charge. A reasonable fee (based on the administrative cost of providing the information) may be charged if your request is considered by the data controller to be manifestly unfounded or excessive, or if you are requesting copies of the same information again.
If you are told that there is a fee involved, please contact avma for further assistance.
If there are technical medical terms or abbreviations you do not understand, ask the data holder to explain these to you. This may be in the form of a glossary.
Information must be provided without delay and within one month (28 days) from the date of the request. If the request is complex, then the data controller may take two months to supply the data, but they must inform you of this within the first month and explain why the extension is necessary.
If the provider needs to clarify additional information before being able to copy the records, the 28 days runs once the additional information has been provided.
You can ask to see the original records and should ask the GP or hospital about this.
You will usually have to visit the practice or the hospital records department to do this, and it is unlikely that you would be able to take materials away.
Many GPs’ records are available online and you should ask about this at the practice. Your Summary of Care Record, which is held on your GP records (and includes basic information such as your medications and allergy history), cannot be accessed online, so you will need to ask your GP for a copy.
The patient themselves can make a request to see the data held, but you will usually need to verify your identity.
If you have parental responsibility for a child under 16, you can request their records.
Will my request automatically be granted?
The record holder will have to consider what are the best interests of the child. If the child is able to understand their rights, the record holder may decide to send the records to them. The NHS website says:
“Children aged 13 or older are usually considered to have the capacity to give or refuse consent to parents requesting access to their health records, unless there is a reason to suggest otherwise.”
If you have another person’s consent (which will need to be in writing), you can request their records. If you are thinking about giving someone such as a relative your consent to obtain your records, you need to very carefully consider the sensitive information you may have provided to your doctors, which may not be relevant to the help and support you are being given, such as to make a healthcare complaint, and may like to only give consent to part of your record being obtained.
The organisation will then have to assess your request in terms of the strict rules which protect people’s privacy and wellbeing. They may therefore refuse to allow you access to any of the records or restrict the records you are allowed to see to those they consider necessary for the help and support you are giving the person.
If you have legal authority to make decisions on another person’s behalf (for example, power of attorney, or you have been appointed to manage their affairs by the Court of Protection), you can request the records.
If there is no power of attorney in place, you should speak to the GP or healthcare provider and explain why you want to see the records and how this is relevant to the help and support you are giving the person whose records you are requesting. Subject to their duties to safeguard privacy and wellbeing, the GP or healthcare provider may allow you access to at least that part of the records relevant to the help and support you are giving.
If your request is considered to be manifestly unfounded or excessive, you can be refused access. However, you should be told of your right to complain to the supervisory authority (the Information Commissioner’s Office) and your right to seek judicial remedy. This notification should be made as soon as possible, and within one month.
The records can also be withheld if they give information on a third party and the third party has not agreed to disclosure, but this does not apply if the third party is a health professional.
Under Schedule 3 Part 2 of the Data Protection Act 2018, the following exceptions are allowed to access requests: Access which “…would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person”. This, however, has to be more than the fact that the information may upset you.
Under Section 5, there is a requirement to consult the “appropriate health professional,” so that it is likely the decision as to whether access to the records will be refused would be made by your treating doctor or health professional. The opinion has to have been sought within the previous six months for this to be a valid reason for restricting access.
Access may also be denied under Section 4(2) if the information:
If the data subject subsequently expressly indicates they no longer have this expectation, the access can be granted. As this has to be expressly indicated, it may be difficult to get a dead relative’s records, where they have indicated they do not want information released to you.
Access may be denied on the basis of the exemption of confidentiality as between client and professional legal advisor. This may arise in the case of an independent medical report written for the purpose of litigation.
Usually a data holder should tell you if they are relying on a exemption, but not as such as to cut across the protections offered. For instance, one exemption is childhood adoption records, and it would be contrary to the spirit of why these records are exempt for you to be told this was the ground.
It is important to note that the GDPR applies to the records of living persons. Your rights in relation to accessing records where someone dies are based on the Access to Health Records Act 1990 (AHRA).
Under the AHRA (which is the legislation covering records of dead people as these are not covered by the GDPR or DPA18), there is no automatic right to access records where someone has died.
Applications for access can only be made by the personal representative of the deceased’s estate (the executor) who is entitled to administer the estate by virtue of a grant of probate (if the deceased person left a will) or letter of administration (if they died intestate).
This is an automatic right and the personal representative or person with letters of administration does not have to give a reason why they are seeking the records. If the deceased person made a specific request about non-disclosure of specific information, this should be respected, even if the request for access is from the personal representative.
If you are not a personal representative, or have not been granted letters of administration, access is available only where you can show that there is a claim arising from the death. The decision on whether you have potential claim lies with the record holder.
It is also not enough to say that you are enquiring generally into the circumstances of the death or wish to make a complaint. Access must be sought for the purposes of a claim, such as in relation to a clinical negligence claim in respect of the Fatal Accidents Act and the Law Reform (MP) Act, or in relation to contravention of a right under the Human Rights Act. If you require advice on whether you have a potential claim and you have been refused access, you can seek advice from avma on this.
The decision on what documentation will be made available to you under the AHRA is made by the holder of the records. Access may not be given to any part of the record which, in the opinion of the holder of the record, would disclose information which is not relevant to any claim which may arise out of the patient’s death.
The NHS Guidance for Access to Health Records Requests 2010 also indicates that if to you do not fall into these categories, access to a deceased person’s records will be judged on a case-by-case basis. The person requesting access should show:
40 days.
GDPR Article 16:
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Under the GDPR, you are entitled to have personal data rectified if it is inaccurate or incomplete. If there are factual inaccuracies in your records, such as incorrect dates or information recorded which may impact ongoing care (such as you are recorded as a smoker when you have never smoked), you should firstly raise this informally with the NHS provider and ask them to amend the record.
You should usually inform the data controller which information you consider to be inaccurate or incomplete and explain to them how you would like it to be corrected. You can make requests verbally, but it is good practice to have a written record, in case you need to take the matter further.
Such corrections should usually be made within a month, but if the request is more complex, this can be extended to two months.
The data controller should take reasonable steps to investigate the accuracy or completeness of the records. This should take into account the information you have provided. At the conclusion of this, they should notify you if they have corrected, completed, deleted, or added to the record. If the information was sent to third parties, they should also be told about the correction or completion of the record.
If the hospital or other health provider intends to take no action in response to a request for rectification, the reasons for this decision should be explained to you, and you should be told about your right to complain to the supervisory authority (the Information Commissioner), and about the judicial remedy. The ICO advises it is good practice to record the fact that the accuracy of the record has been challenged and the reasons for this, but this is not a legal obligation.
The organisation can refuse to comply with a request for rectification if it believes that the request is what the law calls “manifestly unfounded or excessive”, or they can request a fee.
Data subjects have the right to require data controllers to restrict processing (which the GDPR defines as “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”) when:
Therefore, if you are exercising your right to ask for amendment of inaccuracies, you can also exercise your right to request that this information is not processed (for example, sent on to other doctors or healthcare providers).
Often, people want to have their medical records corrected because they contain information they consider to be wrong. One common example is where a diagnosis has been reached and recorded, but at a later stage a different diagnosis is reached. As long as the records include both the initial and final diagnosis, and this is clear, it would be difficult to say the record is inaccurate.
As long as the record of an opinion is clear that it is an opinion, and where appropriate whose opinion it is, it can be difficult to maintain it is inaccurate and needs to be corrected.
In requesting amendment of mistakes or opinions recorded in the records, you should therefore ask:
This is known as the right to be forgotten. This is not an absolute right and only applies in specific circumstances:
You do not have to prove that the information causes unwarranted or substantial damage or distress, but if it has this will strengthen the case to have the data removed.
A right to be forgotten request can be refused on grounds that the information needs to be retained:
The organisation can also refuse your request if it is, as the law states, “manifestly unfounded or excessive”. It is likely that in a healthcare context, it will be difficult to be forgotten.
If you are not happy with the way in which your data has been handled or the response to your request for access to your records has been dealt with, you have a right to complain to the organisation which holds the records. The ICO has a template letter on their website and information on how to make a complaint here: https://ico.org.uk/your-data-matters/your-right-to-get-copies-of-your-data/what-to-do-if-the-organisation-does-not-respond-or-you-are-dissatisfied-with-the-outcome/.
If this does not resolve the matter, you can make a complaint to the Information Commissioner. If asked to do so by the complainant, the ICO must provide further information about how to pursue the complaint. You should raise your concerns with the ICO within three months of your last contact with the organisation.
If this does not resolve your concerns, under Article 79 each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.
You should usually notify the data controller of your intention to bring a claim by writing to them of your intention to begin a court case and referring to which part of the GDPR or DPA applies. You should also indicate the remedy you are seeking and if you are seeking compensation.
As data protection law is a complex field, you would be advised to seek legal advice on taking the matter to court.
A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller:
There is also a right under the GDPR to ask for compensation for material or non-material damage (“non-material damage” includes distress).
There are different periods for how long records are kept.
Website: https://ico.org.uk/
Address: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113 or 01625 54 5745
Email: casework@ico.org.uk
Address: Information Commissioners Office, 3rd Floor 14 Cromac Place, Belfast BT7 2JB
Phone: 028 9027 8757 or 0303 123 1114
Email: ni@ico.gsi.gov.uk
Address: Information Commissioners Office, 45 Melville Street, Edinburgh EH3 7HL
Phone: 0131 244 9001
Email: scotland@ico.gsi.gov.uk
Address: Information Commissioners Office, 2nd Floor Churchill House, Churchill Way, Cardiff CF10 2HH
Phone: 029 2067 8400
Email: wales@ico.gsi.gov.uk