Subject Access Requests

Data protection legislation gives you the right to get a copy of your personal data including the information in your Health Care Record or Medical Record. This is called a Subject Access Request (SAR). Each NHS organisation holds their own records. We can only supply records about your care at University Hospitals Sussex NHS Foundation Trust.

Children can also exercise their data protection rights. Even if a child is too young to understand subject access rights, it is still their right to access information held about them, rather than the right of a parent or guardian. But, in the case of young children this right is likely to be exercised by someone with parental responsibility for them. Before we respond to a subject access request for information about a child, we will consider if they are mature enough to understand their rights or if it is in the best interests of the child for someone to exercise the child’s rights.

If you would like to view your records or get a copy of them, you may submit your request in writing or verbally. To help us process your request faster, please include your name and address and describe the information that you are requesting. Give us as much detail as you can to help us correctly identify and find it. You will also need to provide proof of your identity.

• We must act on a subject access request within one month of receiving it.
• Your friends and family are not allowed to ask to see your records without your consent.
• In some circumstances your right to see details in your health care record may be limited in your own best interests.
• You have the right to request that any inaccuracies are corrected or annotated.

If you have any queries about your request, please contact the relevant Subject Access Request Team.

While UK GDPR only applies to living individuals, records relating to deceased patients remain subject to a duty of confidentiality. Therefore, the Trust will consider each request on a case-by-case basis.

The Access to Health Records Act 1990 gives certain people a right to see the health records of somebody who has died. These people are defined under section 3(1)(f) of that act as ‘the patient’s personal representative and any person who may have a claim arising out of the patient’s death’.

Requests from personal representatives

Access will usually be granted where the request comes from a personal representative of the deceased who holds a role set out in law. This is usually the person who holds the probate documentation (such as the Grant of Probate or Letters of Administration) or is named as executor in the deceased’s will.

The Trust must be satisfied that you are the personal representative before releasing records to you.

Requests if you have a claim arising out of the death of the deceased

If you are not the personal representative of the deceased but you have a claim arising out of the death of the deceased, you may have the right to see the health records of the deceased where they are relevant to your claim. However, because the duty of confidentiality extends after someone has died, the Trust will not always grant access. We will need to consider, for example, any wishes expressed by the individual before their death, or by their personal representative.

Sharing information with family members or individuals close to the deceased

There are times when it is appropriate to share information with a family member or an individual close to the deceased. However, this would be outside the remit of AHRA, which would be in the form of a formal written request to access the record.

While the UK GDPR does not apply, the common law duty of confidentiality still applies to the health and care records of the deceased. The Trust will therefore carefully consider the circumstances, for example:

• is there a recorded next of kin
• Is there a previously registered Power of Attorney for health and welfare,
• Is there a previously registered Power of Attorney for property and finance and the request from the individual relates to a finance related issue
• If the patient or service user had authorised the sharing of information in their lifetime (for example, to enable someone to pursue a complaint on their behalf)
• Sharing general information about an individual’s death with those close to them where there is no reason to believe that the individual would have objected to such disclosure will be permissible.

Information you will need to submit a request

To make a request to access the records of someone who has died, you may need to provide:

• information that identifies the deceased, such as their name and date of birth or NHS number
• documentation demonstrating that you are the personal representative, or you have permission from the personal representative
• information that identifies who you are (including photographic ID)
• information outlining what your request is for; for example, exactly which records you are requesting and the reason you are requesting them (if applicable)
• evidence of the nature and basis for your claim arising out of the death of the deceased.

You should receive a response within 40 days.

A request does not need to be in a particular format, but it may help you to use our Subject Access Form.

Requests in writing should be sent to:

• By law, everyone working for or on behalf of the NHS or other qualified health care providers must respect your confidentiality and keep your information secure.
• We reassure you that the computer systems we use have strict access controls. Only staff who are involved in your care will have access to your records.
• We will always obtain your consent  before sharing your information with other health professionals unless exempted by law.
• When we do share your information we will always endeavour to use the most secure method available where possible.

You can now also manage the letters you receive from the hospitals online using My Health and Care Record.

Visit the Information Commissioner’s Office website at www.ico.gov.uk

Please talk to your health professional if you are worried about the use of your medical information.

University Hospitals NHS Foundation Trust is a data controller under Data Protection Legislation. We collect and keep information about you in order to give you the best possible care.

We keep your information securely on paper and on computer. By law you are entitled to ask to see a copy.