Introduction to medical record keeping

Access to health records

The GDPR and DPA give patients a right of access to their medical records. A request made by a patient to access their records in this way is commonly referred to as a subject access request (SAR). Patients can make a SAR verbally or in writing, and a third party can also make a SAR on behalf of another person. When a request is made by a third party, the third party should provide evidence that the patient has consented to the disclosure.

In most circumstances, a fee cannot be charged to process a request. The request should be processed and the records provided within one month, although the time limit may be extended if the request is complex.

There are some exemptions, including:

• that the request is manifestly unfounded or excessive;
• that providing access to the information about an individual’s physical or mental health or condition would be likely to cause serious harm to them or to another person’s physical or mental health or condition;
• disclosure would provide information about another person or identify another person as a source of the information (excluding another healthcare worker) unless that other person consents or it is reasonable in the circumstances to supply the information without their consent.

The Information Commissioner's Office (ICO) provides detailed guidance on dealing with subject access requests.

After death the Access to Health Records Act 1990 and the Access to Health Records (Northern Ireland) Order 1993, permit the personal representative of the deceased and anyone who may have a claim arising from the patient’s death to access the medical records. The records should not be disclosed if they may cause physical or mental harm to anyone, if they identify a third party (excluding a healthcare professional) or if the deceased gave the information on the understanding that it would remain private

A competent child has the right to make their own application for disclosure under the DPA, and accordingly any application by a parent (or any other party) at this point, can only be with the child’s consent.

Prior to the child becoming competent, someone with parental responsibility can exercise the right on the child’s behalf, as long as it is in the child’s best interests. For more information, please see Parental responsibility (medicalprotection.org)

Improper disclosure and data breach

A personal data breach is a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It may be accidental or deliberate and where a data breach is likely to “result in a risk to the rights and freedoms of individuals” it must be notified to the ICO as soon as possible and within 72 hours of first having become aware of the breach.

The Information Commissioner can impose a Civil Monetary Penalty for contravention of the DPA in a deliberate or reckless way, or of a kind likely to cause substantial distress or damage to an individual. Failure to notify a breach can also result in a significant fine.

It is important to be familiar with your responsibilities in the event of a breach and deal with the breach in accordance with the GDPR or inform your employer of a breach or potential breach as soon as possible in order that they can take the necessary steps.

More information on data breach is available in the following article The General Data Protection Regulation (GDPR) (medicalprotection.org) and from the Information Commissioner's Office (ICO) .