SARs also known as copy of medical records, patient notes, medical history requests.
You will appreciate that health data relating to any individual is highly confidential and the Practice must ensure that it releases such data only to the person to whom it relates, or to a person authorised to act on his or her behalf. If you require to see any health data, please complete this online Request Form as fully and accurately as possible to enable us to locate the exact information you require.
The General Data Protection Regulations (GDPR) gives you the statutory right of access to any information, manual (paper) or computerised. You may wish to authorise someone else to make your application on your behalf and if you have parental responsibilities you may make an application to see your child’s notes, if they are under the age of twelve years.
You do not have to give a reason for applying for access to your General Practice records. If you do not need access to your entire records, it would be helpful if you would inform us of the periods and area of your health records that you require, along with details which you feel may have relevance (e.g. clinic type, location, dates).
Timescale
The Practice will deal with your request as quickly as possible. If you request copies of all or part of your medical record, these will be ready within the allocated timescales specified by the Regulations (which is currently 28 days from receipt of your accurately completed form and confirmation of consent), and we will telephone you when they are available for you to come to the Practice to collect them. Under certain circumstances, this period can be extended to 3 months but we will keep you informed of the progress of your request during this extended period.
Fees
We will not make a charge for the first request for access to your medical records. We may, however, charge for subsequent requests or if we deem that the volume of information requested is excessive. You have the right to simply view your records (i.e. not receive a copy in a permanent form); information on how to arrange this is detailed below. If you’re requesting an opinion, a form to be completed or anything other than a copy of records the following charges apply.
Type of request
If you request to see the original records, you will be invited to make an appointment at a mutually convenient time to view them. If you request copies, these will be ready within the allocated timescales specified by the Regulations, and we will telephone you when they are available for you to come to the Practice to collect them.
Proof of identity
Two forms of identity must be provided (one of which must be photographic). This is to ensure information is not released to unauthorised individuals. The table below outlines the proof of identity we can accept.
| Type of Application | Identification Required |
| Patient applying for their own Can be waived if the applicant is known to the Staff Member accepting the request | One which must be photographic i.e. passport One containing individuals name and address |
| Third Party Applying Consent of Patient will be required BEFORE the request will be processes | One containing Third Party name and address One must be Photographic ID of Third Party |
| Applying on behalf of a child We will ALWAYS obtain consent for release of records from a child age 12+ to <16 if a third party is making request | One which must be Child’s birth certificate Photographic ID of person with parental rights |
If you are completing this application on behalf of another person, the Practice will require their authorisation before we can release the data to you. The person whose information is being requested should sign the relevant section within the online form. If the patient is a child (i.e. under 16 years of age) the application may be made by someone with parental responsibilities – in most cases this means a parent or guardian. If the child is capable of understanding the nature of the application, his or her consent should be obtained or, alternatively, the child may submit an application on their own behalf. Children will, generally, be presumed to understand the nature of the application if aged between 13 and 16 however, all cases will be considered individually.
Who may apply for access?
1(1) Patients with capacity
Subject to the exemptions listed in paragraph 1(6) (below) patients with capacity have a right to access their own health records via a SAR. You may also authorise a third party such as a Solicitor to do so on your behalf. Competent young people may also seek access to their own records. It is not necessary for them to give reasons as to why they wish to access their records.
1(2) Children and young people under 18
Where a child is competent, they are entitled to make or consent to a SAR to access their record.
Children aged over 16 years are presumed to be competent. Children under 16 in England, Wales and Northern Ireland must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR.However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records. In Scotland, anyone aged 12 or over is legally presumed to have such competence. Where, in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR. Where a child is considered capable of making decisions about access to his or her medical record, the consent of the child must be sought before a parent or other third party can be given access via a SAR (see paragraph 1 (3) below)
1(3) Next of kin
Despite the widespread use of the phrase ‘next of kin’, this is not defined, nor does it have formal legal status. A next of kin cannot give or withhold their consent to the sharing of information on a patient’s behalf. As next of kin they have no rights of access to medical records. For parental rights of access, see the information above.
1(4) Solicitors
You can authorise a Solicitor acting on your behalf to make a SAR. We must have your written consent before releasing your medical records to your acting Solicitors. The consent must cover the nature and extent of the information to be disclosed under the SAR (for example, past medical history), and who might have access to it as part of the legal proceedings. Where there is any doubt, we may contact you before disclosing the information. (England and Wales only – should you refuse, your Solicitor may apply for a court order requiring disclosure of the information. A standard consent form has been issued by the BMA and the Law Society of England and Wales. While it is not compulsory for Solicitors to use the form, it is hoped it will improve the process of seeking consent).
The Practice may also contact you to let you know when your medical records are ready. If your Solicitor is based within our area, then we may ask you to uplift them and deliver them to your Solicitor. This is because we can no longer charge for copying and postage, so we would appreciate your help if you can do this, or alternatively ask your Solicitor if they can uplift your medical records.
1(5) Supplementary Information under SAR requests
The purposes for processing data
The purpose for which data is processed is for the delivery of healthcare to individual patients. In addition, the data is also processed for other non-direct healthcare purposes such as medical research, public health or health planning purposes when the law allows.
The categories of personal data
The category of your personal data is healthcare data.
The organisations with which the data has been shared
Your health records are shared with the appropriate organisations which are involved in the provision of healthcare and treatment to the individual. Other organisations will receive your confidential health information, for example Digital or the Scottish Primary Care Information Resource (SPIRE) or research bodies such as the Secure Anonymised Linkage Databank (SAIL). (This information is already available to patients in our Practice privacy notices).
The existence of rights to have inaccurate data corrected and any rights of objection
For example, a national ‘opt-out’ model such as SPIRE etc.
Any automated decision including the significance and envisaged consequences for the data subject
For example, risk stratification.
The right to make a complaint to the Information Commissioner’s Office (ICO)
1(6) Information that should not be disclosed
The GDPR and Data Protection Act 2018 provides for a number of exemptions in respect of information falling within the scope of a SAR. If we are unable to disclose information to you, we will inform you and discuss this with you.
1(7) Individuals on behalf of adults who lack capacity
Both the Mental Capacity Act in England and Wales and the Adults with Incapacity (Scotland) Act contain powers to nominate individuals to make health and welfare decisions on behalf of incapacitated adults. The Court of Protection in England and Wales, and the Sheriff’s Court in Scotland, can also appoint Deputies to do so. This may entail giving access to relevant parts of the incapacitated person’s medical record, unless health professionals can demonstrate that it would not be in the patient’s best interests. These individuals can also be asked to consent to requests for access to records from third parties.
Where there are no nominated individuals, requests for access to information relating to incapacitated adults should be granted if it is in the best interests of the patient. In all cases, only information relevant to the purposes for which it is requested should be provided.
1(8) Deceased records
The law allows you to see records of a patient that has died as long as they were made after 1st November 1991.
Records are usually only kept for three years after death (in England and Wales GP records are generally retained for 10 years after the patient’s death before they are destroyed).
Who can access deceased records?
You can only see that person’s records if you are their personal representative, administrator or executor.
You won’t be able to see the records of someone who made it clear that they didn’t want other people to see their records after their death.
Accessing deceased records
Before you get access to these records, you may be asked for:
- proof of your identity
- proof of your relationship to the person who has died
Viewing deceased records
You won’t be able to see information that could:
- cause serious harm to your or someone else’s physical or mental health
- identify another person (except members of NHS staff who have treated the patient), unless that person gives their permission
- If you have a claim as a result of that person’s death, you can only see information that is relevant to the claim.
1(9) Hospital Records
To see your Hospital records, you will have to contact your local Hospital.
1(10) Power of attorney
Your health records are confidential, and members of your family are not allowed to see them, unless you give them written permission, or they have power of attorney.
A lasting power of attorney is a legal document that allows you to appoint someone to make decisions for you, should you become incapable of making decisions yourself.
The person you appoint is known as your attorney. An attorney can make decisions about your finances, property, and welfare. It is very important that you trust the person you appoint so that they do not abuse their responsibility. A legal power of attorney must be registered with the Office of the Public Guardian before it can be used.
If you wish to see the health records of someone who has died, you will have to apply under the Access to Medical Records Act 1990. You can only apply if you:
- are that person’s next of kin, are their legal executor (the person named in a will who is in charge of dealing with the property and finances of the deceased person),
- have the permission of the next of kin or have obtained written permission from the deceased person before they died.
- To access the records of a deceased person, you must go through the same process as a living patient. This means either contacting the Practice or the Hospital where the records are stored.