All NHS staff have a duty of confidentiality towards all patients and their records.
Patient records include:
- GP and hospital doctor records
- nursing records, and those made by other NHS staff
- records of your visits to the practice, clinic or hospital
- visits to you
- details of treatment, medication, tests and their results, diagnosis, referrals, etc.
Under the Data Protection Act 1998 you have a right to see and receive copies of records unless:
- your doctor thinks that to do so would seriously harm you or another person. Note: This refusal can apply to part of your records and there is no obligation to inform you of such a partial refusal. It is worth asking if any part of your records has not been made available.
- providing them would disclose information relating to another person who has not consented to the disclosure.
- You have to apply to see your records, and some GP Practices and Trusts have a form specially designed for this that you are asked to complete. Most Trusts also have a specially appointed person, responsible for dealing with such requests.
- Records should be made available within 40 days of applying to see them, or 21 days if they have been added to within the last 40 days.
- Trusts and GP Practices are allowed to charge you for seeing your records if they have not been added to within the last 40 days. This charge should not be more than £10.
- Trusts and GP Practices also have to explain to you anything in the records that is not easy to read, or which uses technical language that you do not understand.
- If you want copies of the records, Trusts or GP Practices can charge you for the actual cost of postage and photocopying, up to a maximum of £50, including the £10 charge if that is made. It is a good idea to get copies if you need to use something in your records as evidence in your complaint.
- Trusts and GP Practices can refuse to provide copy records if providing them would involve “disproportionate” effort.Note: Disproportionate effort is not defined, but the Data Protection Commissioner has warned against abusing this clause to block your access to your records.
- If you are applying to obtain someone else’s records, you must have the patient’s authorisation in writing. This includes parents applying to see a child’s records if the child is able to understand matters. Where a patient is unable to give permission because of incapacity or illness, you may need to seek legal advice and a court authorisation.
- In the case of a deceased patient disclosure is governed by the Access to Health Records Act 1990 and records can only be obtained by a Personal Representative of the deceased (the executor or administrator of their estate) or by someone who may have a claim arising out of the death, unless the deceased specifically requested in the records that they did not want that person to have access to their records after their death.
Any complaint about this can be made to the Data Protection Information Commissioner (see Useful Addresses).