The Data Protection Act 1998 and Access to Health Records Act 1990

The Data Protection Act 1998 allows people to access their health and medical records.

Your Health & Medical records

The right to look at our health records was first introduced by the Access to Health Records Act 1990. In 1998 the Data Protection Act (DPA) partly replaced the Access to Health Records Act.

Whenever a doctor or health professional sees you they will write up what they have observed, their thoughts on your illness and any treatment they have prescribed in your health records. At some point you may wish to see your health records to see what they have written. Health records that you might want to see include those written by:

medical doctors, nurses, clinical psychologist, or child psychotherapist, art/drama/music therapist, occupational therapist

Why might you want to see your health records
There are a number of reasons why people want to see their health records. Among the most common are:
  • you want to see what health professionals have written about you or what health professionals read about you
  • you want to know your diagnosis
  • you want to make a complaint

Can anyone else see my records 

Someone other than the patient (e.g. a solicitor) may make an application to access health records on their behalf in the same way a patient would. Due to the common law rules on confidentiality, a data controller will not release records to third parties without express consent . When individuals want to access health information for the purposes of employment or insurance they can only access a medical report provided by the medical practitioner and cannot access your entire record. They must also have your consent first . If a person lacks capacity then common law on confidentiality would mean that a person appointed to deal with their affairs on their behalf (for example someone with lasting power of attorney for welfare) could access health records
 

can a child see their health records? 

At 16, a young person is considered an adult in terms of consent to medical treatment and has a right to confidentiality. A person with ‘parental responsibility’ (Children’s Act 1989) has the right to access a child’s health record if the child is under 16. However, information should only be disclosed without the child's consent if the child does not have the capacity to consent and it is in the child's best interest . A person under the age of sixteen who has been subject to medical investigation under the expectation of confidence should have their confidence respected.

What are the rights to access the health records of someone who has died?
The health records of someone who has died are treated with the same level of confidentiality as those of a living person. Access to these records is covered by the Health Records Act 1990 which states that their "personal representative” or anyone having a claim resulting from the death (not only relatives) has the right to apply for access . The personal representative means that you are responsible for administering or executing a person's estate. This can also include closing down bank accounts or attending to other administrative matters needed following the person's death. See Access to health records factsheet (176 kb) [pdf] for more informaton.

 

Getting access to your records

If you want to see your health records you need to write or email the 'data controller' who is usually a doctor, medical practice or NHS Trust. In the letter you should include your name, address, date of birth and any other information which would help locate your file. I would be helpful to mention that the request is made under Section 7 of the Data Protection Act, and to send the letter by recorded delivery.

Is there a charge?
As long as you apply to look at your records within 40 days of the last time they were updated and that you do not require copies, there should be no cost. After 40 days, you may be charged up to £50. If you want a copy of your notes you may be charged up to 25p per photocopy.

When will I get the records
The data controller (usually the person you write to to see your records) should release the records to you within 40 days of your request. In practice, it can be considerably longer than this.

can any information be withheld?
Yes. Any information that 'would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person' can be withheld . The record holder should be able to justify a decision to withhold information and if you believe you have not been provided with a good enough reason then you could put in a complaint to the body holding your information. Please see Rethink Advice and Information Services' Access to health records factsheet.

In practice, the notes are not always complete when you get them. Sensitive information may be removed or blocked out. If you are concerned that information is missing you should contact the record holder.

Difficulties in getting access

what if my records are not supplied or if there is a delay?
If you are having difficulty getting hold of your health records you can make a complaint. You will need to use the NHS Complaints Procedure. See Rethink Advice and Information Service's Access to health records factsheet for more information.


What if I disagree with the information on the record?
If you disagree with anything written in your health record you can ask for the health professional to correct it or that they add a written note giving your view. See our Rethink Advice and Information Service Access to health records factsheet  for more information.