Subject Access Requests

Requests

If you want to see your health records or get a copy, you can make a Subject Access Request (SAR). This is a request made by you or by someone you’ve given permission to, under the General Data Protection Regulations (GDPR) and Data Protection Act (DPA) 2018.

To make a request, you can fill in a Practice Subject Access Request Form online, or contact the Practice for a paper version. The Practice will then arrange a time for you to come in and either collect or read your records. You don’t need to give a reason for wanting to see them, and it’s free. However, you will need to show proof of identity before being allowed to read them.

How Long It Takes to Get Your Records

The Practice has up to 28 days to respond to your request. If we need more information before giving you the copies, the 28 days will start once we have the extra information.

In some cases, like when the request is complex or there are a lot of records, the 28 days can be extended by two more months. If this happens, we’ll let you know within 28 days and explain why we need more time.

When you write or call to request your records, you should say if you:

  • Want to see your records and/or get a copy (if you want to see them, a doctor or staff member will be there to explain medical terms)
  • Want to see all your records or just part of them
  • Would like your records in a specific format, and we will try to meet your needs

If you ask for your records to be emailed, we’ll need your written permission to send them to a non-NHS email address, and you’ll need to agree to the risk of sending unencrypted information.

Application Form and Proof of Identity

You may need to fill in an Application Form and show proof of your identity. The Practice must follow the GDPR and DPA 2018 rules to make sure the information is given to the right person.

Please note that we never send original medical records because losing them could affect your care.

Who Can Ask to See Your Health Records?

If you’re able to make decisions, you have the right to see your own health records. You can also allow someone else, like a Solicitor, to ask for them on your behalf. Young people who understand this process can also ask to see their own records. You don’t need to give a reason.
Children who understand the process can ask to see their own records. If you’re 16 or older, it’s assumed that you can make this decision. If you’re under 16, you need to show that you understand what it means to ask for your records. In Scotland, if you’re 12 or older, you’re automatically considered able to make this decision. If a doctor thinks a child doesn’t understand, they can refuse the request.
The term ‘next of kin’ doesn’t give anyone legal rights to access your health records. Parents may be able to access a child’s records if the child agrees.
You can allow a Solicitor to ask for your health records. You need to give written permission before we can release them to the Solicitor. We’ll only share the information you have agreed to, and we may contact you to confirm this before sending anything. If you refuse, your Solicitor might need to ask the court for an order.
Why we collect your data: We collect your data to provide healthcare, and sometimes for research or public health purposes, as allowed by law.
What type of data: The data is about your healthcare.
Who we share it with: Your health records are shared with organisations involved in your care, like the NHS or research groups.
Your rights: You can ask for incorrect data to be fixed or choose to opt out of some uses of your data.
Automated decisions: Sometimes, we use your data to make decisions automatically, like assessing health risks.
Some information can’t be shared because of rules in the GDPR and Data Protection Act 2018. If we can’t give you certain information, we will let you know and explain why.
If an adult can’t make decisions for themselves, special laws allow someone else to make health choices for them. This person might be able to see parts of the adult’s medical records, unless it’s not in the best interest of the patient. If no one is chosen to help the adult, we will only share information if it’s good for them.

Records of People Who Have Died

You can see the medical records of someone who has died if those records were created after 1st November 1991. However, records are usually kept for about three years after death (in England and Wales, they are generally kept for 10 years).

You can look at the records if you are the personal representative, administrator, or executor of the deceased person’s estate.
You can’t see someone’s records if they made it clear that they didn’t want anyone else to see them after they died.
Before you can see these records, you might need to provide:
  • Proof of your identity.
  • Proof of your relationship to the person who has died.
You won’t be able to see information that could:

  • Harm your or someone else’s health.
  • Identify another person (except NHS staff who treated the patient), unless that person agrees.

    • If you have a claim because of the person’s death, you can only see information related to that claim.

    Accessing Your Medical Records

    If you want to see your hospital records, you need to contact your local hospital directly.
    Your health records are private, and your family can’t see them unless you give them written permission or they have a power of attorney.

    A lasting power of attorney is a legal document that allows you to choose someone to make decisions for you if you can’t make decisions yourself.

    This person is called your attorney. They can make choices about your money, property, and health care. It’s important to choose someone you trust, so they don’t misuse their responsibility.
    The legal power of attorney must be registered with the Office of the Public Guardian to be valid.

    Accessing Records of Someone Who Has Died

    If you want to see the health records of someone who has died, you need to apply under the Access to Medical Records Act 1990. You can only apply if you:

    • Are the next of kin (closest family member).
    • Are the legal executor (the person named in a will to manage the deceased person’s affairs).
    • Have permission from the next of kin or written permission from the deceased person before they died.

    To access these records, you need to contact the practice or hospital where the records are kept, just like you would for living patients.

    Correcting Mistakes in Your Health Records

    If you think there’s a mistake in your health records or if you need to update your personal details (like your name, address, or phone number), talk to the health professional informally and ask them to fix it. Some hospitals and GP surgeries have online forms for making these updates.

    If that doesn’t work, you can formally request the change using the NHS complaints procedure.

    Making a Complaint

    All NHS organisations, like hospitals and GP practices, have a complaints procedure. If you want to make a complaint about our services, please see our complaints procedure.

    Alternatively, you can complain to the Information Commissioner (the person responsible for regulating and enforcing the Data Protection Act), at:

    The Information Commissioner’s Office (ICO)
    Wycliffe House
    Water Lane
    Wilmslow
    Cheshire
    SK9 5AF
    Telephone: 01625 545745

    If your request to have your records amended is refused, the record holder must attach a statement of your views to the record.

    New Road Surgery uses Accessibility Checker to monitor our website's accessibility.