Subject Access Requests

A request by a patient, or a request by a third party who has been authorised by the patient, for access under the GDPR (and DPA 2018) is called a Subject Access Request (SAR). If you want to see your health records, or wish a copy, please complete a Practice Subject Access Request Form which you can complete online or please contact the Practice and we will provide you with our paper format. Contact will, subsequently, be made by the Practice to arrange a time for you to come in and collect or read them. You don’t have to give a reason for wanting to see your records and there is no charge for this service. You willl however be required to produce proof of identity before being allowed to read them.

Download Subject Access Request Form

Timescale

The Practice has up to 28 days to respond to your request. If additional information is needed before copies can be supplied, the 28-day time limit will begin as soon as the additional information has been received.

The 28 day time limit can be extended for two months for complex or numerous requests where the data controller (usually your Practice) needs more time to collate and supply the data. You will be informed about this within 28 days and provided with an explanation of why the extension is necessary.

When writing/calling, you should say if you:

  •     want a copy of your healthcare records as well as to see them (if you wish to see them your Doctor or member of staff will be present to assist you and explain any medical terms to you)
  •     want all or just part of them
  •     would like your records to be given to you in a specific format that meets your needs, and we will endeavour to accommodate your request

    If you request your records to be emailed, then we will secure you or your representative’s agreement (in writing or by email) that they accept the risk of sending unencrypted information to a non-NHS email address

You may also need to fill in an Application Form and give proof of your identity. The Practice has an obligation under the GDPR and DPA2018 to ensure that any information provided for the patient can be verified.

Fees

The Practice will not make a charge for the first request for access to your medical records. The Practice may, however, charge for subsequent requests or if we deem that the volume of information requested is excessive. You have the right to simply view your records (i.e. not receive a copy in a permanent form); information on how to arrange this is detailed below.

Proof of identity

Two forms of identity must be provided (one of which must be photographic). This is to ensure information is not released to unauthorised individuals. The table below outlines the proof of identity we can accept.

TYPE OF APPLICATION IDENTIFICATION REQUIRED
Patient applying for their own
Can be waived if the applicant is known to the Staff Member accepting their request		 One which must be photographic, i.e. passport, drivers licence
One containing individuals name and address
Third Party Applying
Consent of Patient will be required BEFORE the request will be processed		 One containing Third Party name and address
One must be photographic ID of Third Party
Applying on behalf of a child
We will ALWAYS obtain consent for release of records from a child aged 12 to <16 if a third party is making the request		 One which must be child's birth certificate
Photographic ID of person with parental rights

If you are completing this application on behalf of another person, the Practice will require their authorisation before we can release the data to you. The person whose information is being requested should sign the relevant section within the online form. If the patient is a child (i.e. under 16 years of age) the application may be made by someone with parental responsibilities – in most cases this means a parent or guardian. If the child is capable of understanding the nature of the application, his or her consent should be obtained or, alternatively, the child may submit an application on their own behalf.  Children will, generally, be presumed to understand the nature of the application if aged between 13 and 16 however, all cases will be considered individually.

INDEX - Policies

MAIN INDEX