The Data Protection Act 1998 (Section 7) specifies the rights of access by a patient to their medical records (data subject).
The data subject is the person whose information is within the system and who has rights of access as determined under the Data Protection Act 1998.
The data controller of the patient’s medical records/specific data and the system, in this case, is the Reepham & Aylsham Medical Practice.
Provision of information to third parties
Information will not normally be released to other family members without written patient consent.
Also, when a request is made on behalf of a person who is deceased, there are special rules regarding release of the deceased patient’s records. Please make contact with the Practice Manager for advice in these circumstances.
A third party is a body or person other than the patient (data subject) who requests access or to whom information is released.
Process for making a subject access request
A Subject Access Request (SAR) can be made using any format to the practice and will be considered on an individual basis. Our preference is for the below form to be used to support us in locating the information you are requesting:
- Your request will be actioned once it is received at the practice and within 28 days. We will notify you of any reasonable cause for delay that may exceed this timeframe.
- Where an application is declined, a reason will be given. In some circumstances, some parts of the record may be withheld, this will be clearly visible to the applicant.
- Your usual doctor will review your records before we can authorise release.
- We are unable to meet requests for immediate access.