Guidance on requests for information

Contents

Information about your personal treatment and care is confidential and will normally be something you will discuss with the healthcare professionals you meet. However, there may be other issues about which you would like further information or you may just want to have a copy of the information we hold about you.

Your right to request access to your personal records

The Data Protection Act 2018 incorporating the General Data Protection Regulation 2016 (GDPR) gives living individuals the right to request access to personal records held about them by organisations such as ours. This is known as a subject access request (SAR). The Data Protection Act 2018 requires the trust to comply with requests for information within one month of receipt.

Any individual can make a request for their own information. In addition, an individual may nominate a representative (such as a solicitor, relative or just someone they trust) to apply on their behalf. In this case, there must be a valid consent signed by the individual who authorises the release of information to the representative.

Request access to someone else’s personal records (including children)

Even if a child is too young to understand the implications of subject access rights, it is still the right of the child rather than of anyone else such as a parent or guardian. So it is the child who has a right of access to the information held about them, even though in the case of young children these rights are likely to be exercised by those with parental responsibility for them.

Whilst there is no legal age limit in the UK that young people may apply themselves, the trust takes the guidance of the information commissioner’s office whereby a person aged 12 years or over, is presumed to be of sufficient age and maturity to be able to exercise their right of access, unless the contrary is shown. Therefore they should be consulted regarding any request that has been made for their records by another individual, even if another individual has parental responsibility for them.

All people have the same rights over their personal data, regardless of their age. These include the rights to access their own personal data; request rectification; object to processing and have their personal data erased.

For mentally incapacitated adults a person may make a request on their behalf if they have been granted power of attorney or agent by a court to manage their affairs.

Access to deceased patient records

The Access to Health Records Act 1990 provides certain individuals with a right of access to the health records of a deceased individual. These individuals are defined under section 3(1)(f) of the act as “the patients personal representative and any person who may have a claim arising out of the patients’ death”. A personal representative is the executor or administrator of the deceased person’s estate.

How to request access

If you wish to request access to patient records, you will need to complete the enclosed application form and either, post to:

Or email with the required copy documentation (please note that this is not a secure method to send personal or sensitive information):

• Email: rdash.ig@nhs.net

You can obtain a copy of the application form on the trust’s access your information and submit using the above methods.

What documentation will I need to provide

In most cases we will require copies of two items of evidence of identity and all ID must be current, see table below:

Exemptions to the release of personal information

In general, all the personal records you request will be released to you, although there may be circumstances where certain information could be restricted. These include:

• if it is considered that information in the records, if released, may be likely to cause serious mental or physical harm to yourself or another

And, or:

• where there is personal information concerning another person contained within your records, for example, third party

Should one or both of these exemptions apply to your request, we will notify you.

How long will it take for you to complete my request?

There are time scales laid down by the acts, which state that you should be given the information within a month, although we can extend this time by a further two months if the request is ‘complex’ or you have made a number of requests.

How will the information be provided?

In most cases, copies of the records will be made and sent to you (or you can collect the copies if you prefer). You may prefer to view the records, in which case the trust will arrange with you a suitable time and location for you to come in and view the records.

Will I be charged for access to the records?

In most cases we cannot charge a fee to comply with a subject access request. However, where a request is manifestly unfounded or excessive we may charge a reasonable fee for the administrative costs of complying with the request. We can also charge a reasonable fee if an individual requests further copies of their data following a request. We will base the fee on the administrative costs of providing further copies.

If you are not satisfied with your response

In the first instance you should write to information governance explaining why you are dissatisfied with the response and asking for an internal review to be carried out.

If you remain unhappy and you wish to discuss further you can do this by writing to the trust’s data protection officer at:

Independent advice

If you remain dissatisfied with the trust’s response you can contact the Office of the Information Commissioner (ICO), the body with responsibility for enforcing the Data Protection Act at:

Please note that the ICO does not support complaints or queries that have been made under the Access to Health Records Act 1990.

Requests for other health records for example, GP

If you require access to your primary care health record, the request should be made to the relevant GP, etc.

Page last reviewed: December 05, 2024
Next review due: December 05, 2025