Access to Medical Records

Accessing Your Medical Record Online

Most patients (aged 18 and over) will be able to automatically view their prospective/future medical records online from November 2023 (or their date of registration) onwards. This can be done using the NHS app or by signing up for Patient Access. You can use these services to:

• Order repeat prescriptions
• View your upcoming appointments/cancel appointments. 
• View your medical record including test results, recent consultations, diagnoses, immunisations and documents.
• View your COVID-19 vaccination status

If you have trouble accessing your medical record, or if you lack access and want it, visit the Access to Online Records link below. Please see the eligibility criteria below before requesting. You can also use this link to request restricted access. For example, you can use it just to view appointments or request repeat prescriptions. Your query will be passed to our patient services admin team.

Access to Online Records

If you would like to opt out of viewing your medical record online or have any concerns then please contact us. You may wish to speak with us first to understand what it is that you will see, and the risks which may be involved in having such confidential data either on your smartphone or online. This may be a concern if other people have access to your devices. If you are in a difficult or pressured relationship for example, you may prefer your records to remain accessible only to those treating you.

It’s important to remember that these documents may contain information that could be upsetting, especially if they contain news of a serious condition. It can also be a cause for worry seeing results online when it isn’t clear what the results might mean.

Your GP may talk to you to discuss test results before you are able to see some of your information on the app.

Sometimes people with a mental health condition might prefer not to see documents that remind them of difficult times in their life. Letters from mental health teams sometimes go into detail about past events, and great care would be needed in deciding whether you would want to see these letters. It is possible for individual items to be hidden at your request and your GP would be happy to talk about any concerns you may have.

Great care is also needed in case private details might cause harm at home, should people in a difficult or pressured relationship be forced to show their medical record to an abusive partner. Anyone in such a position should make this clear to us at the practice, so we can take steps to keep you safe. This might mean removing access through the NHS app for the time being, or through a careful process where we hide sensitive things. We would talk this through with you.

Paper health records or access to full historic records

Sometimes you might wish to have access to your historic notes, and there are several ways to do this. It usually takes some time to provide these as the practice must read through the notes to ensure that any third party or harmful data is not released. This process can be quite laborious for the practice and reduces the amount of clinical time GPs have to see and treat other patients. For this reason we ask wherever possible that you consider requesting specific information (e.g. related to certain dates or condition) rather than your entire past medical records.

To access specific information please contact the practice. For patients wanting access to their full historic digital medical record (from approximately the year 2000) please complete the form below. Your request will be forwarded to our patient services admin team.

Request access to historical online medical records

For patients wanting a copy of their full historic electronic notes a ‘subject access request (SAR)’ needs to be completed be completed. This surgery now uses a third party service eMR, provided by MediData Exchange, to process your SAR. You will be asked to sign a consent form, allowing us to do this. We will also ask you for an email address and a mobile phone number so that you can access your patient record securely online. If you do not have an email address or mobile number, then either we can print off a hard copy for you or you can provide family or a relative’s details, with their permission.

Complete a Subject Access Request online

A copy of your paper records (used before GP digital records began approximately around the year 2000) can also be provided if necessary. Please contact our patient services admin team to discuss this.

Subject Access Requests (SAR)

When we have processed your SAR you will be sent an email notification with a link to access your record.

This email may land in your ‘junk’ email so you will need to click and drag it over to your ‘inbox’ for the link to work.

You will be asked to request an ‘access code’ which will be sent by text message to your mobile phone. This is for security purposes.

Once you enter this code – you will be able to view, print or download a copy of your medical record. You can also authorise a 3rd party, for example a Solicitor to access this information.

Once the SAR form is submitted, Hedena Health will aim to process the request within one calendar month; however, this may not always be possible but the practice will provide updates if this is the case.

There may be occasions when the data controller will withhold information kept in the health record, particularly if the disclosure of such information is likely to cause undue stress or harm to you or any other person.

Under new regulations, we are obliged to send the patient record to you rather than anyone else (e.g. a solicitor if they are requesting this information), as it is your personal information. It is then your choice with whom you would like to share this information.

If you have any difficulties accessing your record, please contact MediData Exchange 

The Practice has up to 28 days to respond to your request. If additional information is needed before copies can be supplied, the 28-day time limit will begin as soon as the additional information has been received.

The 28 day time limit can be extended for two months for complex or numerous requests where the data controller (usually your Practice) needs more time to collate and supply the data. You will be informed about this within 28 days and provided with an explanation of why the extension is necessary.

Who may apply for access?

1(1) Patients with capacity

Subject to the exemptions listed in paragraph 1(6) (below) patients with capacity have a right to access their own health records via a SAR. You may also authorise a third party such as a Solicitor to do so on your behalf. Competent young people may also seek access to their own records. It is not necessary for them to give reasons as to why they wish to access their records.

1(2) Children and young people under 18

Where a child is competent, they are entitled to make or consent to a SAR to access their record.

Children aged over 16 years are presumed to be competent. Children under 16 in England, Wales and Northern Ireland must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR.However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records. In Scotland, anyone aged 12 or over is legally presumed to have such competence. Where, in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR. Where a child is considered capable of making decisions about access to his or her medical record, the consent of the child must be sought before a parent or other third party can be given access via a SAR (see paragraph 1 (3) below)

1(3) Next of kin

Despite the widespread use of the phrase ‘next of kin’, this is not defined, nor does it have formal legal status. A next of kin cannot give or withhold their consent to the sharing of information on a patient’s behalf. As next of kin they have no rights of access to medical records. For parental rights of access, see the information above.

1(4) Solicitors

You can authorise a Solicitor acting on your behalf to make a SAR. We must have your written consent before releasing your medical records to your acting Solicitors. The consent must cover the nature and extent of the information to be disclosed under the SAR (for example, past medical history), and who might have access to it as part of the legal proceedings. Where there is any doubt, we may contact you before disclosing the information. (England and Wales only – should you refuse, your Solicitor may apply for a court order requiring disclosure of the information. A standard consent form has been issued by the BMA and the Law Society of England and Wales. While it is not compulsory for Solicitors to use the form, it is hoped it will improve the process of seeking consent).

The Practice may also contact you to let you know when your medical records are ready. If your Solicitor is based within our area, then we may ask you to uplift them and deliver them to your Solicitor. This is because we can no longer charge for copying and postage, so we would appreciate your help if you can do this, or alternatively ask your Solicitor if they can uplift your medical records.

1(5) Supplementary Information under SAR requests

The purposes for processing data

The purpose for which data is processed is for the delivery of healthcare to individual patients. In addition, the data is also processed for other non-direct healthcare purposes such as medical research, public health or health planning purposes when the law allows.

The categories of personal data

The category of your personal data is healthcare data.

The organisations with which the data has been shared

Your health records are shared with the appropriate organisations which are involved in the provision of healthcare and treatment to the individual. Other organisations will receive your confidential health information, for example Digital or the Scottish Primary Care Information Resource (SPIRE) or research bodies such as the Secure Anonymised Linkage Databank (SAIL). (This information is already available to patients in our Practice privacy notices).

The existence of rights to have inaccurate data corrected and any rights of objection

For example, a national ‘opt-out’ model such as SPIRE etc.

Any automated decision including the significance and envisaged consequences for the data subject

For example, risk stratification.

The right to make a complaint to the Information Commissioner’s Office (ICO)

1(6) Information that should not be disclosed

The GDPR and Data Protection Act 2018 provides for a number of exemptions in respect of information falling within the scope of a SAR. If we are unable to disclose information to you, we will inform you and discuss this with you.

1(7) Individuals on behalf of adults who lack capacity

Both the Mental Capacity Act in England and Wales and the Adults with Incapacity (Scotland) Act contain powers to nominate individuals to make health and welfare decisions on behalf of incapacitated adults. The Court of Protection in England and Wales, and the Sheriff’s Court in Scotland, can also appoint Deputies to do so. This may entail giving access to relevant parts of the incapacitated person’s medical record, unless health professionals can demonstrate that it would not be in the patient’s best interests. These individuals can also be asked to consent to requests for access to records from third parties.

Where there are no nominated individuals, requests for access to information relating to incapacitated adults should be granted if it is in the best interests of the patient. In all cases, only information relevant to the purposes for which it is requested should be provided.

1(8) Deceased records

The law allows you to see records of a patient that has died as long as they were made after 1st November 1991.

Records are usually only kept for three years after death (in England and Wales GP records are generally retained for 10 years after the patient’s death before they are destroyed).

Who can access deceased records?

You can only see that person’s records if you are their personal representative, administrator or executor.

You won’t be able to see the records of someone who made it clear that they didn’t want other people to see their records after their death.

Accessing deceased records

Please contact the patient’s last registered GP service if you need to access these records. Before you are granted access you may be asked for:

• proof of your identity
• proof of your relationship to the person who has died

Viewing deceased records

You won’t be able to see information that could:

• cause serious harm to your or someone else’s physical or mental health
• identify another person (except members of NHS staff who have treated the patient), unless that person gives their permission
• If you have a claim as a result of that person’s death, you can only see information that is relevant to the claim.

GP health records for un-registered or deceased individuals

NHS England is only the data controller for GP health records where an individual is currently not registered with a GP or is deceased. These records are held by Primary Care Support England (PCSE) on behalf of NHS England. To request access to GP health records in these circumstances please visit the PCSE website.

You can find more information about accessing health records on the NHS website.

1(9) Hospital Records

To see your Hospital records, you will have to contact your local Hospital.

1(10) Power of attorney

Your health records are confidential, and members of your family are not allowed to see them, unless you give them written permission, or they have power of attorney.

A lasting power of attorney is a legal document that allows you to appoint someone to make decisions for you, should you become incapable of making decisions yourself.

The person you appoint is known as your attorney. An attorney can make decisions about your finances, property, and welfare. It is very important that you trust the person you appoint so that they do not abuse their responsibility. A legal power of attorney must be registered with the Office of the Public Guardian before it can be used.

If you wish to see the health records of someone who has died, you will have to apply under the Access to Medical Records Act 1990. You can only apply if you:

• are that person’s next of kin, are their legal executor (the person named in a will who is in charge of dealing with the property and finances of the deceased person),
• have the permission of the next of kin or have obtained written permission from the deceased person before they died.
• to access the records of a deceased person, you must go through the same process as a living patient. This means either contacting the Practice or the Hospital where the records are stored.

If you think that information in your health records is incorrect, or you need to update your personal details (name, address, phone number), approach the relevant health professional informally and ask to have the record amended. Some Hospitals and GP Surgeries have online forms for updating your details. If this doesn’t work, you can formally request that the information be amended under the NHS complaints procedure.

All NHS trusts, NHS England, CCGs, GPs, Dentists, Opticians and Pharmacists have a complaints procedure. If you want to make a complaint, go to the organisation concerned and ask for a copy of their complaints procedure.

Alternatively, you can complain to the Information Commissioner (the person responsible for regulating and enforcing the Data Protection Act), at:

The Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 01625 545745

If your request to have your records amended is refused, the record holder must attach a statement of your views to the record.