Access to Medical Records
All applications for access to records, whether paper or electronic, of a living person are now made under the General Data Protection Regulation 2018
Please see our fair processing policy GDPR fair processing policy NRMC v1.18.5
Patient leaflet NRMC GDPR patient leaflet a4 v1.18.5
For deceased persons, applications are made under sections of the 1990 Access to Health Records Act.
Personal requests for data are normally processed free of charge unless excessive requests are being made for the same information. ALL REQUESTS ARE DEALT WITH SEQUENTIALLY. PLEASE ALLOW UP TO 28 DAYS (1 MONTH). Information may be released in a number of formats on request once we verify ID (Paper copy, on CD as a PDF, emailed to a VERIFIED address, Via ‘My health online’ portal (temporary access) .
Some third Party requests such as solicitors and insurance company requests will be made under ‘subject access rules’ and therefore will invoke a processing charge of up to £50.
Applications can be made by:
- Children 16 years or over and the mentally compentent.
- Parents, or an individaul, given parental responsibility by a court for children under 16.
- Patient representatives with written authorisation from the patient (i.e. a solicitor or relative).
- Court representatives.
In some circumstances, the Act permits the data controller to withhold information held in your health record. These rare cases are:
- Where it has been judged that supplying you with the information is likely to cause serious harm to the physical or mental health or condition of you, or any other person, or;
- Where providing you with access would disclose information relating to or provided by a third person who had not consented to the disclosure. This exemption does not apply where that third person is a clinician involved in your care.
- When making your request for access, it would be helpful if you could provide details of the time-periods and aspects of your health record you require
- If you are using an authorised representative, you need to be aware that in doing so, they may gain access to all health records concerning you, which may not all be relevant. If this is a concern, you should inform your representative of what information you wish them to specifically request when they are applying for access.
- GPs have ethical obligations around how patient records are shared, and will explain to patients, in broad terms, the implications of making a Subject Access Request so they can make an informed decision on whether they wish to exercise their rights under the General Data Protection regulation (2018.eu) .
Applications may be made by the patients’ personal reprasentative or any person who may have a claim arising out of the patient’s death.