Subject Access Request
The General Data Protection Regulation 2018 gives patients or their representatives a right of access, subject to certain exemptions, to their health record. Hightown Surgery respects the rights of individuals to have copies of their information wherever possible.
Who can make an Access Request?
An application for access to personal data may be made to the Practice by any of the following:
A person authorised by the individual in writing to make the application on an individual’s behalf e.g. solicitor, family member, carer
A person having parental responsibility for the individual where he/she is a child.
A person appointed by a court to manage the affairs of an individual who is deemed incompetent
Individuals who hold a health and welfare Lasting Power of Attorney
Where the individual has died, the personal representative and any person who may have a claim arising out of the individual’s death (the executor of the deceased’s will; someone who has been appointed as an Administrator of the Estate by the Courts; someone who has the written consent of either of the above to be given access, someone who is in the process of challenging the deceased’s will)
Individuals wishing to exercise their right of access should:
- Make a verbal or written application to the Practice holding the records, including via email
- Provide such further information as the Practice may require to sufficiently identify the individual
Fees and Response Time
Under GDPR the Practice musts provide information free of charge. However, we can charge a “reasonable fee” when a request is manifestly unfounded or excessive, particularly if it is repetitive.
The fee must be based on the administrative cost of providing the information only.
The request must be complied with without delay and at least within one calendar month of receipt of the request (day one is day of receipt - so a request received on 3rd September should be responded to by 3rd October) This period can be extended for a further two months where requests are complex or numerous, however the Practice must inform the individual within one month of receipt of the request and explain why the extension is necessary.
The Release Stage
In accordance with guidance from the ICO practice preference is to release the GP record to the patient rather than to the organisation requesting on the patients behalf. The patient can then check their own record and determine what information from it they are happy to release to a third party organisation.
Once the records have been collated, redacted where applicable and signed off by the Usual GP, they should be sent to the requester.
Subject Access Request Form