Subject Access Request (SAR) Form
Everybody has the right to obtain a copy of their personal data. You do not need to give a reason to see your data. An individual is only entitled to their own personal data, and not to information relating to other people (unless the information is also about them or they are acting on behalf of someone). Under special circumstances, some information may be withheld.
Access to the majority of your personal data (medical records) is provided free of charge through the Patient Online Access – this is the primary means of accessing your information and further copies may therefore be charged for. We encourage all patients to register for this service – please sign up here.
Where the records are not shown on the Patient Online Access, or access is not possible, then a Data Subject Access Request (SAR) can be made to us. We ask that this request is made in writing where possible; ideally this should be made using this form being as specific as possible about the information required. We will provide you’re a copy of your data within 1 calendar month, but can be extended if the request is complex or a number of requests have been received from you. We may also charge a reasonable fee for the administration of the request where the request is viewed as excessive or additional copies are required.
Legal Claim
There is a clear and established legal route for processing health (special category) data to support the investigation, preparation and pursuit of legal claims, in the form of Article 9(2)(f) of GDPR. In such cases a fee would be charged for the preparation of the medical records
As a SAR is motive blind some solicitors and insurance companies may use SARs inappropriately on the patient’s behalf to access their medical records free of charge contrary to the intentions of GDPR.
Most patients do not realise that in such circumstances their entire medical record, or a significant part of it, has been requested, potentially containing a large amount of very sensitive information that has no bearing whatsoever upon their claim and may be provided to other 3rd parties they are not aware of as part of their claim.
Disclosing that volume of information to one or more 3rd parties would most likely mean disclosing information that was not relevant, was excessive, and would not be pursuant to the principle of data minimisation, as per Article 5(1)(c) and Article 25(2) of the EU GDPR, and ICO guidance.
Therefore with such requests it is our policy, in line with ICO guidance to general practices, to arrange for the patient to collect their medical record in person from us, free of charge.
The patient is then able to review the content of their medical information and then choose to share the information with their solicitor or insurance company as they judge as relevant with regards to their legal claim.
