Patient Record

Sharing Your Medical Record

Increasingly, patient medical data is shared e.g. between GP surgeries and District Nursing, in order to give clinicians access to the most up to date information when attending patients.

The systems we operate requires that any sharing of medical information is consented to by patients beforehand. Patients must consent to sharing of the data held by a health provider out to other health providers and must also consent to which of the other providers can access their data.

e.g. it may be necessary to share data held in GP practices with district nurses but the local podiatry department would not need to see it to undertake their work. In this case, patients would allow the surgery to share their data, they would allow the district nurses to access it but they would not allow access by the podiatry department. In this way access to patient data is under patients' control and can be shared on a 'need to know' basis.

Emergency Care Summary

Emergency health records

Most patients in Scotland now have an Emergency Care Summary containing basic information about your health in case of an emergency.

NHS staff can also use your Emergency Care Summary if your GP refers you to an outpatient clinic or for admission to hospital to check your details.

Before any member of staff looks at your Emergency Care Summary, they must get your consent. If you are too unwell to give consent, they may need to read your Emergency Care Summary without your agreement in order to give you the best possible care.

The Scottish Government provide more information about the Emergency Care Summary in the leaflet – Your Emergency Care Summary – What does it mean to you?

 

Access to Medical Records under the Data Protection Act

Making a Subject Access Request (SAR)

Introduction

The Data Protection Act gives every living person (or authorised representative) the right to apply for access to their health records.

To make a subject access request

A request for your medical health records held at Arran Medical Group must be made in writing to the data controller who is: Fiona Robson (please contact the practice for alternative methods of access if you are unable to make a request in writing).

You should apply using an Application for Access to Medical Records Form which is available from any of our surgery receptions.

Costs

Under the Data Protection Act you will not normally be charged a fee to view your health records or to be provided with a copy of them unless the request is judged to be unfounded or excessive.

In the event that a request is deemed to be unfounded or excessive, a fee will be incurred based on the administrative cost of providing the information.

Once the data controller has all the require information, and fee where relevant, your request should be fulfilled within one month (in exceptional circumstances where it is not possible to comply within this period, you will be informed of the delay within one month of the request. We will provide you with a timescale of when the information will be made available, which will be no more than three months after the request was made).

Exemptions

In some circumstances, the Act permits the data controller to withhold information held in your health record. These rare cases are:

  • Where it has been judged that supplying you with the information is likely to cause serious harm to the physical or mental health or condition of you, or any other person, or;
  • Where providing you with access would disclose information relating to or provided by a third person who had not consented to the disclosure. This exemption does not apply where that third person is a clinician involved in your care.

When making your request for access, it would be helpful if you could provide details of the time-periods and aspects of your health record you require (this is optional, but it may help save practice time and resources).

If you are using an authorised representative, you need to be aware that in doing so, they may gain access to all health records concerning you, which may not all be relevant. If this is a concern, you should inform your representative of what information you wish them to specifically request when they are applying for access.

GPs have ethical obligations around how patient records are shared, and will explain to patients, in broad terms, the implications of making a Subject Access Request so they can make an informed decision on whether they wish to exercise their rights under the Data Protection Act.

Complaints

If you have any complaints about any aspect of your application to obtain access to your health records, you should first discuss this with the clinician concerned. If this proves unsuccessful, you can make a complaint through the NHS Complaints Procedure by contacting the Practice Manager.

Further information about the NHS Complaints Procedure is available on the NHS Choices website.

Alternatively you can contact the Information Commissioners Office (responsible for governing Data Protection compliance):
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Tel: 01625 545745 or www.ico.org.uk

All complaints will be acknowledged within three working days and a full response will be provided within 20 working days. If a complaint is made verbally to the practice, this will be documented and you will be asked to confirm in writing that you agree with what has been recorded.