Getting your medical records

What are medical records?

Medical records, also called health records, contain information created or held in connection with a person’s healthcare.

Depending on the service and treatment involved, records can include:

• consultation and appointment notes;
• medical and nursing notes;
• diagnoses and clinical histories;
• referral letters;
• hospital correspondence;
• discharge summaries;
• test results;
• radiology reports;
• scans and other medical images;
• prescriptions and medication records;
• operation notes;
• anaesthetic records;
• consent documentation;
• observations and monitoring records; and
• correspondence between healthcare services.

There may not be one single record containing everything. Different healthcare organisations can hold different parts of a person’s medical history.

Do I have a right to see my medical records?

Yes, in general.

For a living person, the data-protection right of access allows someone to ask an organisation whether it is using or storing their personal information and to obtain a copy of that personal information together with specified supplementary information.

A request exercising this right is commonly called a subject access request, or SAR.

Health information is personal information and can therefore fall within the right of access. Special rules and exemptions apply to some health information, so the right is important but not absolute.

What is a subject access request?

A subject access request is simply a request to exercise the data-protection right of access.

It does not need special legal wording. The ICO’s current guidance says a SAR can be made verbally or in writing.

Using the words ‘subject access request’ can still be useful because it makes the nature of the request immediately clear, particularly where someone is asking for a large medical record.

Who should I ask for the records?

Ask the organisation that holds the information.

For example:

• a GP practice for the GP record;
• a hospital or health board for the hospital record;
• a dentist for the dental record;
• an ambulance service for records it holds;
• a private hospital or clinic for its records; or
• another healthcare provider for information created or held by that provider.

Where several organisations were involved, more than one request may be needed.

For example, a GP record may contain a discharge letter from a hospital. That letter can be useful, but it is not necessarily a substitute for the hospital’s own notes, observations, imaging, operation records and other underlying material.

What should I ask for?

The request can be broad or focused.

Someone investigating a particular episode of care may find it helpful to identify:

• the healthcare organisation;
• the relevant date range;
• the department or specialty;
• the admission or appointment involved; and
• any particular type of information that matters.

Depending on the issue, this might include clinical notes, nursing records, observations, test results, correspondence, medication records, consent documentation, operation notes, anaesthetic records and radiology material.

A person can ask for a wider record where that is what they need. Being specific can, however, make it easier to identify the material sought and reduce the risk that an important part of a particular episode is overlooked.

Is seeing records in the NHS App the same as getting the full record?

Not necessarily.

In England, the NHS App can provide access to information from a person’s GP health record. The information visible depends on the access available through the GP practice.

The NHS says that a person with GP-record access will see at least summary information, such as medicines and allergies, and many people can see additional information such as appointment notes, letters and test results.

That is useful for everyday access, but it should not automatically be treated as a complete disclosure of every record that may exist.

How long does a subject access request take?

The current general rule is that an organisation must respond to a SAR without undue delay and before the end of the applicable one-month period.

But ‘one month from the day I sent the email’ is not always the complete rule.

Identity or authority needs confirming

Where the organisation reasonably needs information to confirm the requester’s identity, the one-month period starts when the necessary identity information is received.

Where somebody is making the request for another person, the same principle can apply while the organisation obtains the information needed to confirm that person’s authority to act.

The request needs clarification

Current data-protection law also allows the response clock to pause where the organisation reasonably requires further information to identify the information or processing activities covered by the request.

The clock resumes once the necessary clarification is received.

Complex or numerous requests

The organisation can extend the response period by up to a further two months where that is necessary because of the complexity of the requests or the number of requests made by the person.

If it relies on that extension, it must notify the person and explain the reason within the initial one-month period.

Can the healthcare provider ask for identification?

Yes, where it is reasonably necessary.

Medical information is highly sensitive, so an organisation needs to be satisfied that it is giving the information to the correct person.

The ICO says identity checks should be reasonable and proportionate. An organisation should not demand more identification than is necessary merely because somebody has made a SAR.

Where proof of identity is genuinely required, it is sensible to provide it promptly because the response period does not begin until the organisation has the information it reasonably needs to confirm identity.

Do I have to pay for my medical records?

Usually, no.

The general rule is that an organisation cannot charge a fee simply for dealing with a subject access request.

A reasonable fee can be charged in limited circumstances, including where a request is manifestly unfounded or excessive, or where further copies of information already supplied are requested.

Where a reasonable fee is lawfully required, the ICO’s current guidance says the one-month response period does not start until the fee has been received.

Can information be removed or withheld from the records I receive?

Yes, in some circumstances.

The right of access is not absolute. Information may need to be withheld or redacted where a relevant exemption or restriction applies.

Two issues are particularly relevant to health records.

Information about other people

Medical records can contain personal information about relatives, witnesses or other third parties. Data-protection rules may require the healthcare provider to consider whether that information can properly be disclosed.

The fact that the name of a doctor, nurse or other healthcare professional appears in a record does not automatically mean it must be removed. The ICO says that identifying information about professionals carrying out their duties can normally be disclosed where the relevant test is met.

The serious-harm restriction

The Data Protection Act 2018 contains a specific restriction for health information where disclosure would be likely to cause serious harm to the physical or mental health of the person concerned or another person.

Can someone else request my records for me?

Yes, where they have appropriate authority.

For example, a solicitor can make a SAR on behalf of a client. The healthcare provider can ask for evidence that the person making the request is authorised to receive the patient’s information.

The same principle can apply to another properly authorised representative.

Can a parent request a child’s medical records?

Sometimes, but parental responsibility does not create an automatic right to every part of a child’s health record in every circumstance.

Data-protection rights belong to the child. Whether a child can exercise those rights personally depends on their understanding and the circumstances.

Where a request is made on a child’s behalf, the healthcare provider may need to consider matters including the child’s capacity to understand the request, parental responsibility, confidentiality, the child’s wishes and the health-information exemptions that apply.

How do I get the records of someone who has died?

This is a different legal route.

A subject access request applies to the personal information of a living person. It cannot be used simply to obtain the medical records of somebody who has died.

In England and Wales, access to a deceased patient’s health records can instead be available under the Access to Health Records Act 1990.

For someone seeking access to a deceased person’s records, the two applicant categories most likely to be relevant are:

• the deceased patient’s personal representative; and
• a person who may have a claim arising out of the patient’s death.

Where access is sought because a person may have a claim arising from the death, the Act can restrict disclosure to information relevant to that claim. Other statutory restrictions can also apply.

How long does access take after a death?

Under section 3 of the Access to Health Records Act 1990, the record holder must generally give access within 21 days where the application relates only to records made during the 40 days immediately before the application. In other cases, the statutory period is 40 days.

There is a further qualification where the application does not contain enough information to identify the patient or establish that the applicant is entitled to make the request. If the record holder asks for the necessary further information within 14 days, the 21- or 40-day period runs from when that information is supplied.

Why are medical records important in a clinical negligence investigation?

Medical records can provide a contemporaneous account of the care.

They may help establish:

• what symptoms were reported;
• what examinations were recorded;
• what diagnoses or differential diagnoses were considered;
• what tests were requested and when;
• what the results showed;
• when referrals were made;
• what treatment was recommended or provided;
• what risks and alternatives were recorded as having been discussed;
• how the patient’s condition changed;
• what monitoring took place; and
• what happened after the relevant event.

They can therefore be central to building a chronology and to the work of independent experts considering breach of duty and causation.

What if something appears to be missing from the records?

First identify exactly what appears to be missing.

For example, a person may have received hospital correspondence in their GP record but not the hospital’s underlying clinical notes, or a radiology report but not the images.

Where expected information is absent, useful questions can include:

• whether the information is held by a different healthcare organisation;
• whether a different record system or department holds it;
• whether the request covered the correct dates and type of information;
• whether anything has been withheld or redacted under an exemption; and
• whether the organisation says that the record does not exist or is no longer held.

Does requesting records protect a clinical negligence time limit?

No.

Obtaining records is often an important part of investigating a possible clinical negligence claim, but making a subject access request does not by itself stop or extend the statutory limitation period.

A records request can still be outstanding while a legal deadline continues to run.