Subject Access Requests

A request by a patient, or by an authorised third party, for access to medical records under the GDPR (and DPA 2018) is called a Subject Access Request (SAR). If you would like a copy of your health record, please complete a the form below or contact us to make your request.  You don’t have to give a reason for wanting to see your record and there is no charge for this service. 

Complete a Subject Access Request online

We have up to 28 days to respond to your request; however, if additional information is needed from you, the 28-day time limit will begin as soon as the additional information has been received.

This 28 day limit can be extended for up to two months for complex or numerous requests where we need more time to collate and supply the data. You will be informed about this within 28 days and provided with an explanation of why the extension is necessary.

Please let us know if you:

• want all or just part of your health record
• would like your record to be given to you in a specific format that meets your needs, and we will endeavour to accommodate your request

We have an obligation under the GDPR and DPA 2018 to ensure that any information is provided to the Subject, or authorised third party, only and so where you request information to be sent to an address or email address we do not hold on file for you, we may ask for proof of identity.

1  Patients with capacity

Subject to the exemptions listed in 5 below, patients with capacity have a right to access their own health records via a SAR and can also authorise a third party, such as a solicitor, to do so on your behalf. 

2  Children and young people under 18

Where a child is competent, they are entitled to make or consent to a SAR to access their record.

Children aged over 16 years are presumed to be competent. Children under 16 in England, Wales and Northern Ireland must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR. However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records.  Where, in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR. Where a child is considered capable of making decisions about access to his or her medical record, the consent of the child must be sought before a parent or other third party can be given access via a SAR.

3  Next of kin

Despite the widespread use of the phrase ‘next of kin’, this is not defined, nor does it have formal legal status. A next of kin cannot give or withhold their consent to the sharing of information on a patient’s behalf.  As next of kin they have no rights of access to medical records. For parental rights of access, see the information above.

4  Solicitors

You can authorise a solicitor acting on your behalf to make a SAR. We must have your written consent before releasing your medical records to your solicitor. The consent must cover the nature and extent of the information to be disclosed under the SAR (for example, past medical history), and who might have access to it as part of legal proceedings. Where there is any doubt, we may contact you before disclosing the information. 

In England and Wales should you refuse, your solicitor may apply for a court order requiring disclosure of the information. A standard consent form has been issued by the BMA and the Law Society of England and Wales. While it is not compulsory for solicitors to use the form, it is hoped it will improve the process of seeking consent.1(5) Supplementary Information under SAR requests

5  Information that should not be disclosed

The GDPR and Data Protection Act 2018 provides for a number of exemptions in respect of information falling within the scope of a SAR. If we are unable to disclose information to you, we will inform you.

6  Proxy access on behalf of adults who lack capacity

Both the Mental Capacity Act in England and Wales and the Adults with Incapacity (Scotland) Act contain powers to nominate individuals to make health and welfare decisions on behalf of incapacitated adults. The Court of Protection in England and Wales, and the Sheriff’s Court in Scotland, can also appoint Deputies to do so. This may entail giving access to relevant parts of the incapacitated person’s medical record, unless health professionals can demonstrate that it would not be in the patient’s best interests. These individuals can also be asked to consent to requests for access to records from third parties.

Where there are no nominated individuals, requests for access to information relating to incapacitated adults should be granted if it is in the best interests of the patient. In all cases, only information relevant to the purposes for which it is requested should be provided.

7  Records of deceased patients

In some circumstances, the law allows you to see records of a patient that has died as long as they were made after 1st November 1991.

Records are usually only kept for three years after death (in England and Wales GP records are generally retained for 10 years after the patient’s death before they are destroyed).

Who can access records of deceased patients?

You can only see that person’s records if you are their personal representative, administrator or executor.

You won’t be able to see the records of someone who made it clear that they didn’t want other people to see their records after their death.

Accessing records of deceased patients

Before we provide access to these records, you will be asked for:

• proof of your identity
• proof of your relationship to the person who has died

Viewing records of deceased patients

You won’t be able to see information that could:

• cause serious harm to your or someone else’s physical or mental health
• identify another person (except members of NHS staff who have treated the patient), unless that person gives their permission
• If you have a claim as a result of that person’s death, you can only see information that is relevant to the claim.

8  Hospital Records

You need to contact the relevant hospital in order to see your hospital record. 

9  Inaccurate information

If you think that information in your health record is incorrect, or you need to update your personal details (name, address, phone number), please contact us. In some circumstances we are unable to amend the information on your record and if that is the case we will explain the reasons to you.  If after that explaination, you are unhappy with our decision, you can formally request that the information be amended under the NHS complaints procedure.

Alternatively, you can complain to the Information Commissioner (the person responsible for regulating and enforcing the Data Protection Act), at:

The Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 01625 545745

If your request to have your records amended is refused, the record holder must attach a statement of your views to the record.