Subject Access Requests

 

BACK TO MAIN INDEX

 

Making a Subject Access Request (SAR)

You have a right to view your medical records under the GDPR (and DPA 2018). This is called a Subject Access Request (SAR). A third party can also make this request on your behalf if you have authorised them to do so. Subject Access Requests must be made in writing. You can do this by email, through our secure website form, or by letter.

You will not be charged for this request unless your request is deemed to be manifestly unfounded or excessive. Under these circumstances you will be charged a reasonable fee to cover administrative costs. This fee will be no less than £30.

The Practice has up to 28 days to respond to your request. If additional information is needed before copies can be supplied, the 28-day time limit will begin as soon as the additional information has been received. The 28 day time limit can be extended for two months for complex or numerous requests where the data controller (usually your Practice) needs more time to collate and supply the data. You will be informed about this within 28 days and provided with an explanation of why the extension is necessary.

When writing/calling, you should say if you:

  • want a copy of your healthcare records as well as to see them (if you wish to see them your Doctor or member of staff will be present to assist you and explain any medical terms to you)
  • want all or just part of them
  • would like your records to be given to you in a specific format that meets your needs, and we will endeavour to accommodate your request
  • If you request your records to be emailed, then we will secure you or your representative’s agreement (in writing or by email) that they accept the risk of sending unencrypted information to a non-NHS email address

You may also need to fill in an Application Form and give proof of your identity. The Practice has an obligation under the GDPR and DPA2018 to ensure that any information provided for the patient can be verified.

Please note we never send original medical records because of the potential detriment to patient care should these be lost.