Subject Access Requests

Subject Access Request (SARs)

A request by a patient, or a request by a third party who has been authorised by the patient, for access under the GDPR (and DPA 2018) is called a Subject Access Request (SAR).

You can receive full or part records, please specify in your request. If not all of the information is available electronically, you will receive paper copies of additional information. You don’t have to give a reason for wanting to see your records.

The Practice will deal with your request as quickly as possible. The information should be available to you 28 days of receipt of your accurately completed form and confirmation of consent. The 28 day time limit can be extended for two months for complex or numerous requests if more time is needed to collate and supply the data, you will be informed if this is the case.

You will be required to provide proof of identity at the point of application. If your records are held electronically, you can receive them via email through IGPR which is a secure system. If some of your records are paper copies you will need to collect them, ID will be required again upon collection.

Children under the age of 16

Where a child is competent, they are entitled to make or consent to a SAR to access their record.

Children aged over 16 years are presumed to be competent. Children under 16 must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR. However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records.

Where, in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR. Where a child is considered capable of making decisions about access to his or her medical record, the consent of the child must be sought before a parent or other third party can be given access via a SAR

Costs

You will not be charged to view your health records or for a copy of them. However the practice is allowed to charge a fee if requests are unfounded, excessive or repetitive.

Exemptions

In some cases, the act permits the data controller to withhold information held in your health record:

• If the information is likely to cause serious harm to the physical or mental health or condition of you or any other person.
• Where providing you access would disclose information relating to or provided by a third party person who had not consented to the disclosure. This does not apply where that third person is a clinician involved in your care.

Proof of identity

Two forms of identity must be provided (one of which must be photographic). This is to ensure information is not released to unauthorised individuals. The table below outlines the proof of identity we can accept.

If you are completing this application on behalf of another person, the Practice will require their authorisation before we can release the data to you. The person whose information is being requested should sign the relevant section within the online form. If the patient is a child (i.e. under 16 years of age) the application may be made by someone with parental responsibilities – in most cases this means a parent or guardian. If the child is capable of understanding the nature of the application, his or her consent should be obtained or, alternatively, the child may submit an application on their own behalf.  Children will, generally, be presumed to understand the nature of the application if aged between 13 and 16 however, all cases will be considered individually.