Accessing medical records: knowing your rights
Obtaining your own medical records, or the records of someone you care for, can often be an essential element in making a successful clinical negligence claim. However, people are often confused about whether or not they have the right to obtain records, or how they can do this.
What are medical records?
The term medical record is inclusive of any record held or created by a healthcare professional (GP, hospital trust, dentist or other healthcare provider) which relates to a person’s mental or physical health condition. The records can be either electronic or paper, and can include correspondence such as referral or discharge letters, test records, and x-rays and film.
Do I have a right to my own medical records?
According to the General Data Protection Regulation (GDPR) every living person has the right to apply for their own records, whether held as paper versions or on a computer. This right is inclusive of both NHS and privately held records.
You can request your medical records verbally, by letter, by form or through email according to the GDPR. What is more, under the GDPR your medical records must be provided free of charge. A charge should only be expected in situations where you make an unfounded or excessive request; for example if you request three separate copies of the same records.
Once a request for medical records has been made, the records ought to be provided within one month from the date of the request. If the request is complex – for example if the records are in many different hospital sites or are a very large set of records – and will take longer to fulfil, then the record holder can take up to two months to provide the records, but they must inform you that this is the case within the first month of your request.
Who can apply to see medical records?
As a patient you always have a right to request your own medical records.
If you have Parental Responsibility for a child under 16 years of age then you also have the right to request their records. However, if the child is 16-17 then they may be required to give their consent to your request as well. If you have legal authority to act on someone’s behalf, such as through a Power of Attorney, then you also have the right to request their medical records for them.
If you lack the legal authority to obtain someone else’s medical records on their behalf then you may still request their records, provided that you have their written consent to do so.
Accessing medical records where someone has died
Rights to medical records under the GDPR only apply to people who are alive. Rights in relation to accessing records for someone who has died derive from the Access to Health Records Act (AHRA) 1990. According to the AHRA, either Personal Representatives or those who hold Letters of Administration have the right to request medical records on the deceased’s behalf. Lastly, you may also be granted to the records if you can demonstrate that there is a potential claim arising from the death.
The Information Commissioner
If you have requested records and are disappointed in how this request has been dealt with by the healthcare provider, then you can make a complaint to the Information Commissioner’s Office (ICO). Any complaint made to the ICO should be made within three months of your final correspondence with the medical organisation in question.
Retention of medical records
Medical records should be be retained by a service provider for a minimum period, depending on the type of record, and who is holding them.
Important examples include the following:
- dental records are kept for 10 years after you are last seen;
- GP records are kept for 10 years after a person has died. Electronic Patient Record should never be destroyed;
- care records generally are kept for 8 years after you are discharged from care or from when you were last seen;
- children’s services records are kept up until the individual’s 25th birthday
- general hospital records should be kept for 8 years after the conclusion of treatment or death.