Access to medical records on-line and subject access requests

Access to on-going medical records.

This surgery offers online access to the coded or the detailed information from the medical record i.e. information held in coded form, where requested by the patient. This is subject to appropriate safeguard checks and practice policy.

In order to proceed with an application for access to on-line medical records, an application form must be completed and you will be required to attend the surgery in person to verify your identity with two documents. These need to be presented to the receptionist with the application form.  When a patient’s identity is verified, at least one of which should contain a photo of the individual. The documents should be checked for consistency, and the applicant compared to the image on the photo ID. Any two of the following three documents are acceptable:

passport, driving licence, a bank statement, council tax or utility bill (dated within 3months) showing address - Please note mobile phone bills are insufficient evidence.

If you do not have these documents, alternatives can be checked against the government approved list of acceptable documents.

Identity verification follows legal, professional and ethical standards. The name of the person verifying an applicant’s identity, the method used and date will be recorded in the records. This is achieved by scanning in the completed application form, and ID provided.

Once your application has been received and identity documents have processed, the Practice Manager may contact you to discuss online records access.

Access must be authorised by the GP before the user is enabled as a registered online user for viewing detailed coded records.


Subject Access Requests (SARS)


What is the right of access?

The right of access, commonly referred to as subject access, gives individuals the right to obtain a copy of their personal data as well as other supplementary information. It helps individuals to understand how and why we are using their data, and check we are doing it lawfully. Our privacy notice provides further information about this.

What is an individual entitled to?

Individuals have the right to obtain the following from us:

Confirmation we are processing their personal data;

A copy of their personal data; and

Other supplementary information – this largely corresponds to the information that you should provide in a privacy notice detailed above.

Personal data of the individual

An individual is only entitled to their own personal data, and not to information relating to other people (unless the information is also about them or they are acting on behalf of someone).

How do I make a request for my records (SAR)?

Simply come to the practice and ask for a Subject Access Request (SAR) form. Or ask us for an access to medical records form.

For us to progress your request we will need to have evidence that you are who you say you are.   Your medical information is exceptionally personal and sensitive, and we have a duty of care to protect it for you.

Please bring in 2 x forms of ID – one must be photographic e.g. passport / driving licence and another must have your address (a recent utility bill or council tax bill - please note mobile phone bills are not sufficient).

If we know you, we may be able vouch for you at the time of collection without ID. However, for ongoing access to medical records online we do require the above ID

Then once you have been identified formally, completed the form and advised us what information you need, we do the following:

Make copies / email the part(s) of your record you have requested / provide on-going access to medical records

The records will be given to the GP to check what is being provided for any redactions – to ensure that information being shared would not cause harm or distress to you.

The GP returns the paperwork to the admin team to action any redactions. They will also remove any reference to 3rd parties not involved in your care.

The copy of your record is then ready for you to collect / emailed / log-in to your patient record and we will contact you to let you know.

We will do this within one calendar month of having received the completed SAR and having identified you – unless there is an issue which we will notify you about in advance.

Once you have taken receipt of your copy record, the practice accepts no responsibility or liability for it or how a patient chooses to use the information contained within it. The patient is responsible for secure storage or onward carriage of the information provided in an intact form where that is necessary.

Can someone else make the request on my behalf?

You may ask someone to make the request on your behalf e.g. friend, solicitor, relative.

In these instances, we still have a duty of care to ensure that we identify you as the data subject and confirm your consent – we provide you with information, not the requestor.  If you are housebound, we will make arrangements to have your record delivered to you.

The Information Commissioner’s Office (ICO) states:

“If you think an individual may not understand what information would be disclosed to a third party who has made a subject access request on their behalf, you may send the response directly to the individual rather than to the third party. The individual may then choose to share the information with the third party after having had a chance to review it.”

Due to the complex, sensitive nature of medical records, we confirm what you require and we will prepare the records for your collection. We will notify you when your record is ready to collect so that you can check it and you can choose what you wish to share with the 3rd party.

The Eston surgery accepts no liability for the record(s) once the patient has confirmed receipt and whether they remain intact for onward carriage to the 3rd party who may need to process information held within them.

What happens if I need another copy of my records?

The first copy of your records is provided for free. Any further requests for the same information whether for yourself or a third party would be deemed manifestly excessive and would incur a fee.

The fee is dependent on the amount of work required and relates to the size of the record and also any complexity involved in its review for redaction prior to final copy readiness.

Recent examples have been in the range of £20 to £200 of work undertaken for copy records.

So, please don’t lose or give away your free copy without making a copy!

Call 111 when you need medical help fast but it’s not a 999 emergencyNHS ChoicesThis site is brought to you by My Surgery Website