The Data Protection Act 1998 and the Data Protection (Subject Access Modification) (Health) Order 2000 now regulate access to the records of living patients.
Access to the records of deceased patients is still regulated by the Access to Health Records Act 1990. For further information in cases of requests to access the records of deceased patients please contact the Director of Central Services (ext. 2203) or click here to e-mail.
Rights of access to personal data are central to the 1998 Data Protection Act. However, if the personal data concerns physical or mental health or condition the provisions of the Act are modified by the Data Protection (Subject Access Modification) (Health) Order 2000.
The Act provides for access to both manual and computerised records, irrespective of when the record was compiled.
Under The Act, the patient has a right to the following
1) to be informed if personal data is processed (including being held or stored)
2) a description of the data held, the purpose for which it is processed and to whom it may be disclosed
3) a copy of the information constituting the data
4) information as to the source of the data
There are exemptions to these rights
1) the request may be refused if any of the following are not supplied by the applicant/patient
a) any fee requested* see below
b) information required to confirm the identity of the applicant
c) information required to locate the information requested
2) the request may be refused where disclosing the personal data would reveal information which relates to and identifies another person (for example, that a relative had provided certain information) unless that person has also consented to disclosure.
In the case of personal data consisting of information on the physical or mental health or condition of the subject, (i.e. most NHS records, including patients' case files) the above rights are modified by the Data Protection (Subject Access Modification) (Health) Order 2000, which provides exemption from the rights in two situations.
1) where permitting access to the data would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person (which may include a health professional)
2) where the request for access is made by another on behalf of the data subject, such as a parent for a child, access can be refused if the data subject had either provided the information in the expectation it would not be disclosed to the applicant or had indicated it should not be so disclosed, or if the data was obtained as a result of any examination or investigation to which the data subject consented on the basis that information would not be disclosed.
Before deciding whether the exemption 1) above applies, a data controller who is not a health professional must consult the health professional responsible for the clinical care of the data subject. If that health professional is not available, another appropriate health professional must be consulted, usually the department chair (Tavistock Clinic) or director (Portman Clinic)
A request for access must be made in writing to the data controller, the Director of Central Services.
No reason need be given. The signature on the letter should be checked with the case file where possible; otherwise it is reasonable to ask the patient to apply with a witness to their signature.
The Director of Central Services is entitled to satisfy herself that the applicant is either the data subject, or, if the applicant is applying on behalf of a data subject that the person has been authorised to do so.
Subject to any applicable exemption, the applicant must be given a copy of the information and, where the data is not readily intelligible, an explanation (e.g. of abbreviations or medical terminology).
The obligation to provide a copy
may be waived where the data subject agrees otherwise or it is not possible
to supply a copy of the material sought.
The Act does not provide an express right to directly inspect records, although
it is permitted with the agreement of the data subject and Director of Central
Services. The Tavistock & Portman NHS Trust positively encourages patients
who wish to have access to their records to come to view the records in the
clinics with an appropriate health professional who can provide explanations.
This is preferable to sending out copies 'cold'.
Requests for access must be responded to no later than 40 days after the request and fee (and any additional information as to the identity of the applicant or the location of the information reasonably required by the data controller) are received by the Director of Central Services. In exceptional circumstances if compliance is not possible within this period the applicant should be advised accordingly.
Patients may add a separate sheet to their record if they disagree with anything written there. The sheet will be clearly marked as an addition by the patient. This is Trust policy and does not affect statutory rights to rectification as follows:
If the data subject believes that data recorded about them are inaccurate the person may apply to the court, for an order, or to the Data Protection Commissioner for an enforcement notice, either of which may require that the inaccurate data, and any expression of opinion based on it, is rectified, blocked, erased or destroyed.
However, where the data is inaccurate but accurately records information given by the data subject or another person the Court or the Commissioner may instead order that the record should be supplemented by a statement of the true facts as approved by the court/Commissioner.
The Act gives the Trust the right to charge a fee for processing the application. Charging is at the discretion of the clinician involved with the case.
The 1998 Data Protection Act gives patients a right to access to their records but this right is modified by the Data Protection (Subject Access Modification) (Health) Order 2000 which permits Trusts to refuse access if the disclosure would cause serious harm to the physical or mental health or condition of the patient. This decision must be taken by an appropriate health professional.
Subject to the above, patients have a right to receive a copy of their notes. However, the preferred method of the Trust is to ask the patient to attend a meeting with an appropriate health professional to discuss the notes. The patient may still ask for copies after the meeting.
Queries concerning the above should be addressed to the Director of Central Services (ext. 2203) or click here to e-mail.