Purpose
This policy sets out how patients at Collegiate Medical Centre can request access to their medical records. It ensures the practice complies with the Data Protection Act 2018, UK GDPR an GMS Regulations Part 10 (71ZA and 71ZB). The policy explains how request are received, reviewed and fulfilled safely and lawfully.
Principles
- Patients have the legal right to access their personal health information.
- All requests are handled securely, fairly and without unnecessary delay.
- Information is provided within one calender month of receiving a valid request.
- No fee is charged unless a request is clearly excessive or repeated.
- Only authorised staff manage and release patient information.
How patients can request access
Patients may request copies of their medial record at reception, through the practice website, by secure email or by letter.
Requests are coordinated by the Medical Records Clerk, who confirms the patient’s identity and records each request in the Subject Access Register.
Verification and preparation
Before releasing any information, the Medical Records Clerk or a GP Partner:
- Confirms the identity and right of access
- Reviews the record to remove third-party information or any details that could cause serious harm if disclosed
- Ensures that only the information requested is shared
Timescales and method of response
The practice will respond within one calender month of receiving the request and any required proof of identity.
Copies of the records are provided by secure NHS email only.
If the request is complex, the timescale may be extended by up to two further months. The patient will be informed in writing before the first month ends.
Refusals or limitations
Access may be refused or limited if:
- Disclosure would likely cause serious harm to the physical or mental health of any person, or
- The record contains third-party information that cannot be removed.
Any refusal must be authorised by a GP Partner and recorded on the patients notes. The patient will be informed and advised of their right to contact the Information Commissioners Office (ICO).
Deceased patients
Requests for the records of deceased patients are managed under the Access to Health Records Act 1990.
Access may be given to the personal representative or to a person with a claim arising from the estate, after removal of any third-party information or details not relevant to that claim.
Representitives and third parties
Solicitors, insurers or relatives must provide the patients signed consent before information is shared. No record is released until consent and identity are verified.
Logging and audit
All requests, actions and completion dates are logged in the Subject Access Register, maintained by the Medical Records Clerk and overseen by a GP Partner.
Review
This policy is reviewed annually or sooner if national guidance or data protection law changes. It aligns with the Data Protection Act 2018, UK GDPR, and GMS Regulations Part 10 (71ZA and 71ZB).