Subject Access Requests (SARs)
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, patients have the right to request access to the personal information we hold about them, including their medical records.
This is known as a Subject Access Request (SAR).
How to make a request
Patients can request copies of their records by:
- Completing a Subject Access Request form
- Contacting the practice reception team
We will ask for proof of identity before releasing any information to protect patient confidentiality.
What information can be requested?
Patients may request:
- A copy of their medical records
- Test results
- Consultation notes
- Letters from hospitals or other healthcare providers
- Medication history
Patients can request either their full record or information relating to a specific period or treatment.
How long does it take?
We aim to respond to all requests within one calendar month. In some cases, where requests are particularly complex, this timeframe may be extended in line with data protection legislation.
Is there a charge?
There is normally no charge for providing an initial copy of a medical records. However, if you require a further copy of this information, the Practice will charge a fee. A list of our current fees can be found here.
Third-party requests
We can only release information to another person where:
- The patient has provided written consent, or
- The person has legal authority to act on the patient’s behalf
To promote safer data protection working practices, upon receipt of any request and even with a signed consent form, this organisation will contact the subject (patient) to confirm that this request is genuine.
Proxy Access to Medical Records
Proxy access allows a patient to give another person permission to access parts of their GP online services and medical information.
This can be helpful for:
- Parents or guardians managing a child’s healthcare
- Carers supporting someone with long-term health needs
- Family members assisting elderly or vulnerable patients
What can proxy access include?
Depending on the patient’s wishes, proxy access may allow another person to:
- Order repeat prescriptions
- View parts of the medical record
- View test results or correspondence
Patients can choose the level of access they would like to give.
How to request proxy access
Both the patient and the person requesting proxy access may need to complete a consent form and provide identification.
The practice will review each request carefully to ensure it is appropriate and in the patient’s best interests.
Children and young people
Parents or guardians may request proxy access for children under 16. As children become mature enough to make decisions about their own healthcare, access arrangements may be reviewed in line with NHS guidance and confidentiality rules.
Removing proxy access
Patients can withdraw proxy access at any time by contacting the practice. Proxy access for children will automatically end when a child reaches the age of 11. At this stage a further application would need to be submitted.
Confidentiality and safeguarding
The practice has a duty to protect patient confidentiality and may refuse or limit proxy access where there are concerns about patient safety, coercion, or safeguarding.
Having read the information above, I would like to:
Request retrospective access to my online record in the NHSapp Online Access (word document)
Request Proxy Access to the NHS app Proxy Online Access (word document)
Make a Subject Access Request SAR Request (word document)
Provide consent for the Practice to discuss my medical information with a nominated individual Third Party Consent (word document)
Read a copy of the Practices Additional Privacy Information Notice and sign the Practice disclaimer Additional Privacy Information Notice (word document)