An outstanding experience for every patient
Go to home page
Home
For patients and visitors
About Us
Why choose us?
Foundation
Keeping healthy
 

Access to Medical Records Policy 

Post Holder Responsible for Policy:
Health Records Manager
Directorate Responsible for Policy:
Chief Executive's Directorate
Contact Details:

Salisbury District Hospital

01722 336262 Ext 4358

Date Written:
September 2003
Date Revised:
December 2010
Approved By:

Approved by Information Governance Steering Group

Ratified by Joint Management Board

Date Approved:

Approved 17th March 2011

Ratified 20th April 2011

Next Due for Revision:
May 2016
Date Policy Becomes Live:
1st May 2011

Version Information

Version No. Author Review Date Description of Changes
2
.
2
Information Governance Manager
November 2014
Review date extended to 1st May 2016 by instruction of IG Manager

Table Of Contents

Introduction
Responsibilities
Retention of Medical Records
Who may make an application?
Processing the Application
Reasons why access could be denied
The release stage
Access to Medical Reports Act 1988
Amendments to Medical Records
Complaints
Review
Medical Records Contact Details
Equality Impact Assessment
Appendices
 
Top

 
Introduction

Definition of a Medical Record

The Data Protection Act 1998 defines a medical record as a record consisting of information about the physical or mental health or condition of an identifiable individual made by or on behalf of a health professional in connection with the care of that individual.

A health record can be recorded in a computerised form or in a manual form or even a mixture of both. They may include such things as, hand-written clinical notes, letters to and from other health professionals, laboratory reports, radiographs and other imaging records e.g. X-rays, printouts from monitoring equipment, photographs, videos and tape-recordings of telephone conversations.

Subject to certain exemptions, patients or their representatives have the right to access any of their personal records held by Salisbury NHS Foundation Trust.

The main legislative measures that give rights of access to medical records include:

The Data Protection Act 1998

The Data Protection Act 1998 gives every living person, or their authorised representative, the right to apply for access to their medical records irrespective of when they were compiled. The exception to this is the records of deceased patients, which are still governed by the Access to Health Records Act 1990.

The Data Protection Act 1998 is not confined to medical records held for the purposes of the National Health Service. It applies equally to the private health sector and to health professionals’ private practice records. It also applies to the records, for example, of employers who hold information relating to the physical or mental health of their employees if the record has been made by or on behalf of a health professional in connection with the care of the employee.

The Information Commissioners Office is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals under the Data Protection Act 1998. They have a Website with useful guidance around the Act www.ico.gov.uk

The Access to Health Records Act 1990

The Access to Health Records Act 1990 gives the personal representative of the deceased, or those who may have a claim arising out of the death of the individual, a right to access the medical record of the deceased

The Medical Reports Act 1988

The Medical Reports Act gives individuals the right to have access to reports, relating to themselves, provided by medical practitioners for employment or insurance purposes

The Mental Capacity Act 2005

The Mental Capacity Act 2005 gives a patient's attorney (or court appointed deputy) who have been authorised to make personal welfare decisions the right to access records as the patient's representative. The Code of Practice to the Act requires that attorneys and deputies should only ask for information relevant to any decision they are authorised to make on behalf of the patient when they cannot make the decision for themselves.

The Mental Capacity Act 2005 requires anyone making a personal welfare decision to act in best interests which includes consulting others. This may require sharing information in the person's best interests. In certain specified circumstances, where there is no-one to consult, the person making the decision must consult an Independent Mental Capacity Advocate who will have a right to access relevant health records in connection with their functions under the Act

Freedom of Information Act 2000

  • Living patients:

Requests for access to medical records are exempt under section 40 of the Freedom of Information Act. All such requests should be made under the provisions of the Data Protection Act 1998.

  • Deceased patients:

Most of the information in the medical record is likely to be confidential and exempt under section 41 of the Freedom of Information Act. This exemption may not apply to any information already made public, for example on the death certificate.

Requests for access to the records of a deceased patient should be made under the provisions of the Access to Health Records Act 1990.

Top

 
Responsibilities

Definition of a Medical Record

The Data Protection Act 1998 defines a medical record as a record consisting of information about the physical or mental health or condition of an identifiable individual made by or on behalf of a health professional in connection with the care of that individual.

A health record can be recorded in a computerised form or in a manual form or even a mixture of both. They may include such things as, hand-written clinical notes, letters to and from other health professionals, laboratory reports, radiographs and other imaging records e.g. X-rays, printouts from monitoring equipment, photographs, videos and tape-recordings of telephone conversations.

Subject to certain exemptions, patients or their representatives have the right to access any of their personal records held by Salisbury NHS Foundation Trust.

The main legislative measures that give rights of access to medical records include:

The Data Protection Act 1998

The Data Protection Act 1998 gives every living person, or their authorised representative, the right to apply for access to their medical records irrespective of when they were compiled. The exception to this is the records of deceased patients, which are still governed by the Access to Health Records Act 1990.

Responsibility for dealing with an access to medical record request lies with the "data controller". The Trust is known as a data controller. A data controller is defined as a person who either alone or jointly determines the purposes for which and the manner in which any personal data about an individual are, or are to be, processed. A data subject would refer to a patient.

Within Salisbury NHS Foundation Trust responsibility for the management of requests for access to medical records is devolved as follows:

  • Patients medical records Health Records Manager
  • RadiologySpeciality Manager, Radiology
  • Medical Photographs Head of Service, Medical Photography

Appropriate health professional to consult

The data protection (Subject Access Modification) (Health) Order 2000 sets out the appropriate health care professional to be consulted to assist with subject access requests as the following:

  • the health professional who is currently, or was most recently, responsible for the clinical care of the patient ; in connection with the information which is the subject of the request

or

  • where there is more than one such health professional, the health professional who is the most suitable to advise on the information which is the subject of the request.
Top

 
Retention of Medical Records

The Department of Health recommends minimum retention periods for health records.

At the end of the specified time the medical records will be considered for secure and confidential destruction by the Trust.

For full details on the retention of medical records please see the following:-

The Medical Records Policy

Records Management: NHS Code of Practice

Top

 
Who may make an application?

4.1 The Patient

Subject to the exemptions listed in section 6 any patient can request access to any of their personal records held by the Trust. The patient does not have to state the reason for their request.

The request for access to medical records should be made in writing and with the patient’s signature. In cases where consent can only be taken verbally, then the details of this consent will be recorded on the individual’s Medical Record. Electronic requests will only be accepted with an electronic signature. If this is not possible, the applicant will be advised to fill in a manual consent form.

Once a subject access request is received, consent must be verified. The Trust will require:

  • A signature from the patient to the release of their records
  • 2 forms of identification e.g. Drivers Licence, Passport or Birth Certificate and proof of address e.g. utility bill.

4.2 A representative of a patient who lacks capacity

The application may be made by:

  • Persons with authority under a Personal Welfare Lasting Power of Attorney
  • Court Appointed Deputy with specific personal welfare responsibilities
  • an appointed Independent Mental Capacity Advocate

What can be requested?

Information to enable the person to make a personal welfare decision when the patient is unable to do so or information required to enable consultation in best interests. This will not necessarily include the whole of the record and should be limited to information necessary to meet their responsibilities under the Mental Capacity Act.

In order to ensure that patient confidentiality is maintained the Trust will require:

  • Evidence of authority to make personal welfare decisions or
  • Evidence of IMCA appointment and
  • Evidence of identity
  • The reason why information is being requested and
  • Exactly (if possible) what information is required

4.3 Deceased patient’s records (requested under the Access to Health Records Act)

The patient’s personal representative (the executor or administrator of the deceased’s estate) is the only person who has an unqualified right of access to a deceased patient’s record and need give no reason for applying for access to a record.

Individuals other than the personal representative have a legal right of access under the Act only where they can establish a claim arising from the patient’s death. There is less clarity regarding which individuals may have a claim arising out of the patient’s death. Whilst this is accepted to encompass those with a financial claim, determining who these individuals are and whether there are any other types of claim is not straightforward. The decision as to whether a claim actually exists lies with the Trust as the record holder. In cases where it is not clear whether a claim arises the Trust will seek legal advice

In order to proceed with the request the Trust will require:

  • Documentary proof that an individual is the patients personal representative or executor of the estate
  • If the application is made on the basis of a claim arising from the deceased’s death applicants must provide evidence to support their claim
  • Identification as in section 4.1

4.4 Parents

If a parent or a person authorised with parental responsibility is applying for access to their child’s medical records the Health Professional should consider if the child is of a capable age of making his or her own judgement on their healthcare. If they are, consent should be sought before the application is accepted.

Parental responsibility for a child is defined in the Children Act 1989 as "all the rights, duties, powers, responsibilities and authority which by law a parent of a child has in relation to the child and his property". Although not defined specifically, responsibilities therefore would include:-

  • Safeguarding and promoting a child’s health, development and welfare.
  • Financially supporting the child.
  • Maintaining direct and regular contact with the child.

Included in the parental rights which would fulfil the parental responsibilities above are:-

  • Having the child live with the person with responsibility or having a say in where the child lives.
  • If the child is not living with her/him, having a personal relationship and regular contact with the child.
  • Controlling, guiding and directing the child’s upbringing.

The law regards young people aged 16 or 17 to be adults for the purposes of consent to treatment and right to confidentiality. Therefore if a 16 year old wishes a medical practitioner to keep the treatment confidential then that wish should be respected.

Children under the age of 16 who have capacity and understanding to take decisions about their own treatment are also entitled to decide whether personal information may be passed on and generally to have their confidence respected. However, good practice dictates that the child should be encouraged to involve parents or other legal guardians in any treatment.

In order to proceed with the request the Trust will require:

  • Proof of relationship to the child
  • Identification as in section 4.1

4.5 Patients domiciled outside the United Kingdom

Former patients living outside of the UK who have been treated by the Trust have the same rights of access to their records as UK based patients

4.6 Solicitors/Insurance/Medical Company requests

Solicitors/Insurance/medical companies acting on behalf of a patient may make an application for access to the patient’s records

The Trust will require written consent from the patient for the release of copies of the notes

In some circumstances, the health professional may contact the patient to clarify that they fully understand they will be consenting to the release of their health records to a third party

4.7 The Police

The Trust’s Data Protection, Confidentiality and Disclosure Policy details the circumstances in which information from patients records can be given to the police.

4.8 Government Benefit Agencies

Requests for information may be made by:

  • Department of Work and Pensions
  • Veterans Department
  • Criminal Injuries Compensation Authority

The Trust will require written consent from the patient for the release of copies of the notes

4.9 Other Health Care Providers

Other healthcare organisations (NHS and private) may request copies of a patient’s record in order to provide continuity of care for that patient.

Top

 
Processing the Application

Where an access request has previously been complied with, the Act permits that the Trust does not have to respond to a subsequent identical or similar request unless a reasonable interval has elapsed since the previous compliance.

Timing

Under the Data Protection Act 1998, there is no obligation to comply with an access request unless the health professional has such information as s/he needs to identify the applicant and locate the information and unless the required fee has been paid. Although the Act says the fee has to be paid up front before the health professional complies with an access request, this Trust will not ask for the fee until all the information is gathered or copied and ready for despatch.

Once the health professional has all the relevant information and fee where relevant, they should comply with the request promptly, within 21 days and by no later than 40 days after the request has been made. In exceptional circumstances if it is not possible to comply within the 40 day period the applicant should be informed.

Costs

Under the Data Protection Act 1998 (Fees and Miscellaneous Provisions) Regulations 2001, patients may be charged to view their medical records or to be provided with a copy of them.

To provide copies of patient medical records the costs are:-

  • Medical records held totally on computer: up to a maximum £10 charge.
  • Medical records held in part on computer and in part manually: up to a maximum £50 charge
  • Medical records held totally manually: up to a maximum £50 charge
  • All these maximum charges include postage and packaging costs.

To allow patients to view their medical records (where no copy is required) the Trust may charge the following:

  • Medical records held totally on computer: up to a maximum £10 charge, unless the records have been added to in the last 40 days.
  • Medical records held manually: up to a maximum £10 charge, unless the records have been added to in the last 40 days.
  • Medical records held in part on computer and in part manually: a maximum of £10 unless the records have been added to in the last 40 days.

Note: if a person wishes to view their medical records and then wants to be provided with copies this would still come under the one access request. The £10 maximum fee for viewing would be include within the £50 maximum fee for copies of medical records, held in part on computer and in part manually.

Please note: Salisbury NHS Foundation Trust charges a minimum of £5.00 for photocopying.

Patient contact point for questions

If a patient has any queries regarding their request or need help completing the form, please contact the Medical Records Department on (01722) 429359.

Top

 
Reasons why access could be denied

Under the Data Protection Act 1998 the only reasons where access to Medical Records could be denied or limited to a patient or their authorised representative are as follows:

  • Where the information released may cause serious harm to the physical or mental health or condition of the patient, or any other person.
  • Or where access would disclose information relating to or provided by a third person, this would not be a health professional who had not consented to that disclosure.
  • The patient has requested a note be made that they did not wish access to be given to a representative.
  • Where requests are made in the exercise of functions under the Mental Capacity Act 2005, access can be denied to information which is not necessary for the purpose of making a personal welfare decision or which is beyond the scope of the authority.

6.1 Third party information contained within a health record

Where records contain information that relates to an identifiable third party, that information may not be released unless:

1. The third party is a health professional who has compiled or contributed to the medical records or who has been involved in the care of the patient.

2. The third party, who is not a health professional, gives their consent to the disclosure of that information.

3. It is reasonable to dispense with that third party’s consent (taking into account duty of confidentiality owed to the other individual, any steps to seek his or her consent, whether he or she is capable of giving consent and whether consent has been expressly refused).

6.2 Examples of where a third party may be involved

A parent may apply for access to their fourteen-year-old child’s health records. The child may have made some reference to his/ hers parents (the third party), contained within their health record, of which the child didn’t want disclosing. The doctor may withhold this information from the child’s parents.

Top

 
The release stage

The Trust will release or deny/restrict the patient or their representative copies or access to their medical records. No reason is required for denying/ restricting access, but if necessary, the Trust will direct the patient through the appropriate complaint channels if they have been denied access.

On the release of the records, where the information is not readily intelligible, an explanation (e.g. of abbreviations or medical terminology) will be given by an appropriate Health Care Professional.

Whilst the Data Protection Act 1998 allows a patient or their authorised representative to be supplied with a copy of a medical record, it does not require that the patient or their representative is given the original medical records to keep. The Trust does not allow original notes to be sent to patients or their representative because of the potential detriment to patients should the records be required for emergency admission, lost and for medico-legal purposes.

Copies of records may be collected from the Medical Records Department or sent to the patients/representatives registered address by Special Delivery

If it is agreed that the patient or their representative may directly inspect their medical records, access will be supervised by the attendance of an appropriate lay administrator. If requested, a relevant Health Professional will attend the session on the booking of an appointment. The lay administrator is not permitted to comment or advise on the content of the record.

The patient or their representative will be asked to provide proof of identity when attending the appointment to view the records.

Safeguarding Adults/Children

Before we release clinical records which may include a reference to, or information about a disclosure of abuse or neglect in relation to Safeguarding Adults, Children & Domestic Abuse, the person authorising the release should discuss this request with the Named Nurse for Safeguarding Children or Adult Safeguarding Lead.

Top

 
Access to Medical Reports Act 1988

The Access to Medical Reports Act 1988 governs access to medical reports made by a medical practitioner who is, or has been responsible for the clinical care of the patient, for insurance or employment purposes. Reports prepared by other medical practitioners, such as those contracted by the employer or insurance company, are not covered by the Act. Reports prepared by such medical practitioners are covered by the Data Protection Act 1998.

A person cannot ask a patient’s medical practitioner for a medical report on him/her for insurance or employment reasons without the patient’s knowledge and consent. Patients have the option of declining to give consent for a report about them to be written.

The patient can apply for access to the report at any time before it is supplied to the employer/insurer, subject to certain exemptions. The medical practitioner should not supply the report until this access has been given, unless 21 days have passed since the patient has communicated with the doctor about making arrangements to see the report. Access incorporates enabling the patient to attend to view the report or providing the patient with a copy of the report.

Once the patient has had access to the report, it should not be supplied to the employer/insurer until the patient has given their consent. Before giving consent, the patient can ask for any part of the report that they think is incorrect to be amended. If an amendment is requested, the medical practitioner should either amend the report accordingly, or, at the patient’s request, attach to the report a note of the patient’s views on the part of the report which the doctor is declining to amend. Patients should request amendments in writing. If no agreement can be reached, patients also have the right to refuse supply of the report.

Medical practitioners must retain a copy of the report for at least 6 months following its supply to the employer/insurer. During this period patients continue to have a right of access.

The medical practitioner is not obliged to give access to any part of a medical report whose disclosure would in the opinion of the practitioner:

  • cause serious harm to the physical or mental health of the individual or others,

or

  • indicate the intentions of the medical practitioner towards the individual,

or

  • identify a third person, who has not consented to the release of that information or who is not a health professional involved in the individual’s care.

A medical practitioner may make a reasonable charge for supplying the patient with a copy of the report.

Top

 
Amendments to Medical Records

Medical records should reflect the observations, judgements and factual information collected by the contributing health professional (see the Medical Records Policy)

The Data Protection Act fourth principle also states that information should be accurate and kept up-to-date and this provides the legal basis for enforcing corrections when appropriate. However, an opinion or judgement recorded by a health professional, whether accurate or not should not be amended subsequently. Retaining relevant information is essential for understanding the clinical decisions that were made and to audit the quality of care.

If a patient or their representative feels that information recorded on their medical record is incorrect then they should firstly make an informal approach to the health professional concerned to discuss the situation in an attempt to have the records amended. Where both parties agree that the information is factually incorrect it should be amended to clearly display the correction whilst ensuring that the original information is still legible. An explanation for the correction should also be added.

If this avenue is unsuccessful then the patient or their representative may pursue a complaint under the NHS complaints procedure in an attempt to have the information corrected or erased. They could further complain to the Information Commissioner, who may rule that any erroneous information is rectified, blocked, erased or destroyed.

If the patient or their representative is still not satisfied the patient may submit a statement for inclusion within their record that they disagree with the content.

Further guidance on amending records can be found in ‘Requesting amendments to health and social care records’ published by the National Information Governance Board for Health and Social Care document:

Top

 
Complaints

If a patient or their representative is unhappy with the outcome of their access request, such examples may include, information withheld from them or they feel their information has been recorded incorrectly within their health record. To help rectify the complaint, the patient or their representative can go through the following channels:-

  • An informal meeting with the lead health professional may help to resolve the complaint.
  • If the health professional feels that they cannot do anything for the patient, the patient can make a complaint through the Trust's Complaints procedure
  • Ultimately, the patient may not wish to make a complaint through the NHS Complaints Procedure and can take their complaint direct to the Information Commissioner.
  • Alternatively, if the patient or their representative wishes to do so, they may seek legal independent advice to pursue their complaint.
Useful Contact Addresses
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

ICO helpline :
08456 306060
01625 545745

www.ico.gov.uk

British Medical Association
BMA House
Tavistock Square
London
WC1H 9JP

Switchboard:020 7387 4499

http://www.bma.org.uk/

General Medical Council
178 Great Portland Street
London
W1W 5JE

Switchboard: 0845 357 8001

www.gmc-uk.org

Top

 
Review

This policy and associated documents will be:

  • Reviewed annually by the Information Governance Steering Group
  • Formally ratified every three years by the Trust Board
  • Reviewed earlier if appropriate, to take into account any changes to legislation that may occur, and /or guidance from the Department of Health and/or the NHS Executive.
Top

 
Medical Records Contact Details

Telephone 01722 429359 (DD)

Fax 01722 425245

Email: shc-tr.Subjectaccessrequest@nhs.net

Top

 
Equality Impact Assessment

SFT aims to design and implement services and policies that meet the diverse needs of its services, population and workforce, ensuring that none are placed at a disadvantage compared to others.This document has been assessed against the Trust’s Equality Impact Assessment Tool.

A copy of the completed Impact Assessment has been included as appendix G.

Top

 
Appendices

Appendix Description Attachment

A

Guidance Notes for making a Subject Access Request

 

B

Form 1 Subject Access Request – for individuals requesting their own records

C

Form 2 Subject Access Request - for a relative of guardian acting on behalf of the patient

D

Form 3 Subject Access request – for a representative acting on behalf of a patient who lacks capacity

E

Guidance notes for applications under the Access to Health Records Act

F

Form 4 Application form for deceased records

G

Equality Impact Assessment

Top

 
 

Top
Page Last Updated: 10/11/2015 13:54 
Printed from Salisbury NHS Foundation Website http://www.salisbury.nhs.uk