Subject Access Rights (SAR) Consent Form

You will appreciate that health data relating to any individual is highly confidential and the Practice must ensure that it releases such data only to the person to whom it relates, or to a person authorised to act on his or her behalf. If you require to see any health data, please complete this online Request Form as fully and accurately as possible to enable us to locate the exact information you require.

The General Data Protection Regulations (GDPR) gives you the statutory right of access to any information we hold for you.  You may wish to authorise someone else to make your application on your behalf and if you have parental responsibilities you may make an application to see your child’s notes.

You do not have to give a reason for applying for access to your General Practice records. If you do not need access to your entire records, it would be helpful if you would inform us of the periods and area of your health records that you require, along with details which you feel may have relevance (e.g. clinic type, location, dates).

Timescale

The Practice will deal with your request as quickly as possible. The information should be available to you within 28 days of receipt of your accurately completed form and confirmation of consent. Under certain circumstances, this period can be extended to 3 months but we will keep you informed of the progress of your request during this extended period.

Fees

We will not make a charge for the first request for access to your medical records. We may, however, charge for subsequent requests or if we deem that the volume of information requested is excessive. Fees for records of less than 5 years will be charged at £25, and for records over 5 years £50 *note this is a guide and pricing may increase without notice; you will be advised of the fee prior to accepting your request and payment must be received prior to work commencing, which is when the 28 days will start. You have the right to simply view your records (i.e. not receive a copy in a permanent form); information on how to arrange this is detailed below.

Type of request

If you request to see the original records, you will be invited to make an appointment at a mutually convenient time to view them.  If you request copies, these will be ready within the allocated timescales specified by the Regulations, and we will telephone you when they are available for you to come to the Practice to collect them. 

Proof of identity

Two forms of identity must be provided (one of which must be photographic). This is to ensure information is not released to unauthorised individuals. The table below outlines the proof of identity we can accept.

If you are completing this application on behalf of another person, the Practice will require their authorisation before we can release the data to you. The person whose information is being requested should sign the relevant section within the online form. If the patient is a child (i.e. under 16 years of age) the application may be made by someone with parental responsibilities – in most cases this means a parent or guardian. If the child is capable of understanding the nature of the application, his or her consent should be obtained or, alternatively, the child may submit an application on their own behalf.  Children will, generally, be presumed to understand the nature of the application if aged between 13 and 16 however, all cases will be considered individually.

eMR Consent

For SAR requests, we use a third party to run this request called medi2data/eMR - once we submit your SAR request, medi2data/eMR may contact you directly for additional consent and to answer any of your questions about their services before they proceed.

About eMR

Disputes Concerning Content of Records

Once access to records has been granted, patients or their proxy may dispute their accuracy or lack understanding of medical codes.

Patients or their proxy may notice and point out errors in their record, unexpected third-party references and entries they object to or want deleted. The right of rectification and erasure is established within the UK GDPR.

In the first instance that a patient wishes to raise a dispute about their medical record; the patient must submit it in writing to the practice, marking for attention of the practice manager.

Any queries will be directed to the practice who will contact the patient. They will investigate swiftly and thoroughly to identify the source and extent of the problem. This process can take up to 6 weeks.

The responsible clinician and Caldicott Guardian/data controller will then decide on the most appropriate action. Where the dispute concerns a medical entry, the clinician who made the entry should be consulted and consideration given as to whether it is appropriate to change or delete an entry.

Where it is not possible or practical to contact the clinician concerned, the Caldicott Guardian or data controller should be consulted. If it is not possible to amend the records, a meeting with the patient or their proxy should be organised to explain why.

If a patient wishes to apply their UK GDPR rights of:

• Rectification (Article 16 UK GDPR)
• Erasure (Article 17 UK GDPR)
• Restriction of processing (Article 18 UK GDPR)
• Data portability (Article 20 UK GDPR)
• Right to object (Article 21 UK GDPR)

advice must be sought be sought from the organisation’s the Caldicott Guardian or data controller.

Where it is not appropriate to amend a medical record, an entry may be made declaring that the patient disagrees with the entry. If the patient further disputes the accuracy once a decision has been made, they will be referred to the complaint’s procedure and/or the Health Ombudsmen.