..

...

 

Releasing Patients' Notes/Patients' Rights under the Data Protection Act

The right of access to personal data is described in the Data Protection Act 1998 (DPA). It states that a Data Subject (i.e. the patient, or the patient's nominated representative e.g. a solicitor) having submitted a 'subject access request' (SAR) in writing and paid the appropriate fee (see below), is entitled to be provided within 21 days* with a copy of the Personal Data (i.e. the medical records/notes) held about him or her. The Act requires that a copy of the data must be supplied in permanent form unless the supply of such a copy is not possible, would involve disproportionate effort, or the Data Subject (the patient or solicitor) agrees otherwise.

The general rights as set out in the DPA are modified by two orders. The Data Protection (Subject Access Modification)(Health) Order 2000 provides that information need not be disclosed if it would be likely to cause serious harm to the physical or mental health of the Data Subject or any other person and describes the mechanisms for ensuring that decisions as to whether to disclose or withhold information are taken by the appropriate health professional. The Data Protection (Subject Access) Fees and Miscellaneous Regulations 2000 provides that whereas the normal maximum access fee that may be charged is £10, for health records a fee of up to £50 may be charged for paper notes and £10 for computerised records. Providing information under the Data Protection Act is seen as fulfilling a statutory duty, and is consequently deemed to be outside the scope of VAT; so Practices which are VAT registered should not add VAT to the fee.

*In response to a ministerial commitment to Parliament, all NHS organisations should endeavour to comply with subject access requests within 21 days, rather than the 40 days specified in the Data Protection Act 1998. The 21 day period starts as soon as both the request and fee have been received by the Data Controller (i.e. the Practice).

There is a draft Access to Medical Records Policy in the Information Management & Technology index of the Members Library. If you are not a Member, click here for information about the benefits of membership and how to subscribe.

Charges for providing information under the Data Protection Act are outside the scope of VAT, so Practices which are registered for VAT should not add VAT to such charges.

Practice action upon receiving a request from a solicitor

If the Practice receives a request from a solicitor, acting on behalf of a patient, to provide a copy of the patient's medical records, the patient's consent must first be obtained. A draft Consent Form, together with guidance notes for the patient, the solicitor and the Practice, can be downloaded from the BMA website - England & Wales or Scotland

Guidance from the BMA on access to health records by patients -

Further information

Department of Health guidance on access to health records -

NHS Code of Practice: records management -

Frequently Asked Questions

Q. Does the Data Protection Act 1998 mean that patients (not deceased) can now have access to all of their records including those created before Nov 1991?

A. That's correct. Parts of the Access to Health Records Act 1990 have been repealed and this Act now only applies to the deceased. Under the Data Protection Act 1998, competent living patients or their representatives can have access to their records regardless of when the record was created.

Q. Does the Data Protection Act (DPA) apply to records of deceased patients?

A. No, the DPA does not cover the records of deceased patients. Rights of access to records of deceased patients are set out in the Access to Health Records Act 1990 and Access to Health Records (Northern Ireland) Order 1993. In summary, any person (e.g. a personal representative, executor or a dependant of the deceased) with a claim arising from the death of a patient has a right of access to information which is directly relevant to that claim. More details are set out on the BMA website - go there

Q. Can we disclose records of a deceased patient to a GP who has now left our employment and is the subject of a GMC complaint from the family of the deceased patient?

A. The following answer was given by the Medical Defence Union:

It is important to note that the reason for the disclosure is not to benefit the patient in any way. It does not relate to any ongoing medical care, rather it is to benefit the doctor who is the subject of a complaint. In these circumstances consent is needed.

In this case the most sensible course of action would be for the GP who is the subject of the complaint to request the medical records in the usual way via the GMC. As part of the complaints process to the GMC the complainants are informed of the need for disclosure of medical records. They are also aware that they have complained to the GMC, so the fact that the GMC are writing to them to request consent should not be alarming to them.

You should explain to your ex-employee that the Practice are not willing to disclose copies of the medical records to him without consent, but that you have been advised that the usual procedure is for the doctor via his defence organisation to request copies of the medical records from the GMC.

Link won't open?