Access to Medical Records

    • What Constitutes a Health Record?

      A health record could include, and not exhaustively, hand-written clinical notes, letters between clinicians, lab reports, radiographs and imaging, videos, tape-recordings, photographs and monitoring printouts. Records can be held in both manual or computerised medias.

      Patient Access to Medical Records Policy

      The Data Protection Act 1998

      This scope of this Act includes the right of patients to request information on their own medical records. Requests for information under this Act must:

      Be in writing to the data controller (Kathryn Bush, Site Manager is the data controller) at Stourport Medical Centre. (E-mail requests are allowed. Verbal requests can be accepted where the individual is unable to put the request in writing – this must be noted on the patient record);

      • Be accompanied with sufficient proof of identity to satisfy the data controller and to enable them to locate the correct information (where requests are made on behalf of another, the data controller must satisfy themselves that correct and adequate consent has been given);
      • Be accompanied with the correct fee where applicable (see below for guidance on fees);

      The data controller should check whether all the individual’s health record information is required or just certain aspects.

      Where an information request has been previously fulfilled, the data controller does not have to honour the same request again unless a reasonable time-period has elapsed. It is up to the data controller to ascertain what constitutes as reasonable.

      Requests for health records information should be recorded internally and fulfilled within 21 days (unless under exceptional circumstances – the applicant must be informed where a longer period is required). Information given should be in a manner that is intelligible to the individual.

      Which clinician should be consulted for information?

      The correct clinician to be consulted about an individual’s information should be:

      • The clinician who is currently, or was most recently, responsible for the clinical care of the individual in connection with the information which is the subject of the request; or
      • where there is more than one such clinician, the one who is the most suitable to advise on the information which is the subject of the request.

      Denial or Limitation of Information

      The data controller may deny or limit the scope of information given where it may fall under any of the following:

      • The information released may cause serious harm to the physical or mental health or condition of the individual or any other person, or
      • The disclosure would also reveal information relating to or provided by a third person who has not consented to that disclosure unless:
      • The third party is a clinician who has compiled or contributed to the health records or who has been involved in the care of the individual;
      • The third party, who is not a clinician, gives their consent to the disclosure of that information;
      • It is reasonable to disclose the information without that third party’s consent.

      A reason for denial of information does not have to be given to the individual, but must be recorded.

      Former NHS Patients Living Outside the UK

      Patients no longer resident in the UK still have the same rights to access their information as those who still reside here, and must make their request for information in the same manner.

      Original health records should not be given to an individual to take abroad with them, however, the practice may be prepared to provide a summary of the treatment given whilst resident in the UK.

      Parental Requests for Information pertaining to their Children

      Parents will normally have responsibility for accessing the health records of their children, however, care must be taken to obtain consent of the child where necessary (16 and 17 year olds are seen as adults in relation to confidentiality, and their consent would be necessary). It is important to be aware that children under 16 who have capacity and understanding for decision-making should also have their confidence respected, however, they should be encouraged to involve parents and guardians in their healthcare matters.

Consent for Patient Record Access – Proxy consent form

Consent form for FULL Record Access – June 2021

Patient Record Access – Information leaflet from RCGP

Pat Guide – Getting started GP online

Patient Access Support Portal – FAQs patient access link

Using online services – NHS ( –  Patient details for using online services

Hospital Records

As well as having a copy of your health records, the surgery will also have a summary of any hospital tests, or treatment, that you have had.  Any hospitals where you have had treatment, or tests, will also hold records.  To see your hospital health records, you will have to contact the Hospital Trust where you were seen / received treatment.

Power of Attorney

Your health records are confidential, and members of your family are not allowed to see them, unless you give them written permission, or they have ‘Power of Attorney’.  A lasting ‘Power of Attorney’ is a legal document that allows you to appoint someone to make decisions for you, should you become in capable of making decisions yourself.  The person you appoint is known as your Attorney.  An Attorney can make decisions about your finances, property, and welfare.It is very important that you trust the person you appoint as Attorney, so that they do not abuse their responsibility.  A legal ‘Power of Attorney’ must be registered with the Office of the Public Guardian before it can be used.