All NHS staff have a duty of confidentiality towards all patients and their records.
Patient records include:
- GP and hospital doctor records
- nursing records, and those made by other NHS staff
- records of your visits to the practice, clinic or hospital
- visits to you
- details of treatment, medication, tests and their results, diagnosis, referrals, etc.
- A Trust or GP Practice may also refuse you access to your records if to provide them would involve “disproportionate effort”. Disproportionate effort is not defined, but the Data Protection Information Commissioner has warned against abusing this reason.
- You have to apply to see your records, and some GP Practices and Trusts have a form specially designed for this that you are asked to complete. Most Trusts also have a specially appointed person, part of whose job is to deal with such requests.
- Records should be made available within 40 days of applying to see them, 21 days if they have been added to within the last 40 days.
- Trusts and GP Practices are allowed to charge you for seeing your records if they have not been added to within the last 40 days. This charge should not be more than £10.
- Trusts and GP Practices also have to explain to you anything in the records that is not easily readable, or which uses technical language that you do not understand.
- If you want copies of the records, Trusts or GP Practices can charge you for the actual cost of postage and photocopying, up to a maximum of £50, including the £10 charge if that is made. It is a good idea to get copies if you need to use something in your records as evidence in your complaint.
- If you are applying to obtain someone else’s records, you must have the patient’s authorisation in writing, including parents applying to see a child’s records if the child is able to understand matters. Where a patient is unable to give permission because of incapacity or illness, you may need legal advice and a court authorisation.
- In the case of a deceased patient, records can only be obtained by a personal representative; usually an executor, or someone making a claim arising from the death, unless the deceased specifically requested in the records that they did not want that person to have access to their records. The above charges do not apply in these circumstances.
Any complaint about this can be made to the Data Protection Information Commissioner (see Useful Addresses).