GDPR SAR Medical Records to GP - failed twice - help

[MrSmithers]

Is the new GDPR SAR template suitable for a medical records request from a GP without any specific alterations?

Thanks.

[Old Cogger]

How to make a Subject access request - NHS Digital
https://digital.nhs.uk/about-nhs...i...access-request
You have the legal right to request a copy of the information we hold about you, in line with the General Data Protection Regulation (GDPR). .

[MrSmithers]

I put a request in (handed in at doctors so no proof of post) about 7/8 weeks ago now and have heard absolutely nothing back, not even a letter to say it would take longer than the required time frame. Any advice on how to proceed please?

Thanks.

[MrSmithers]

Im going to resend the letter but this time send recorded mail. im going to put at the beginning that a copy was already handed into the surgery on whatever date it was.

[MrSmithers]

Again after posting this in via recorded mail i have heard nothing back. The original letter was handed in around August and then posted in on the 8th November.

Is this normal? Has it happened to anyone else?

I dont know whether i should ring the surgery to complain, the NHS or even their watchdog?

Thanks for reading.

[dx100uk]

retitled and moved to the NHS forum as data protection is a bit low on readers

this might help too:

https://www.consumeractiongroup.co.u...-Viewing)-nbsp

[MrSmithers]

Thought i was already in that forum so thanks

[Ethel Street]

ICO say you should send a formal complaint to the GP about them not responding to the SAR and if that too is ignored refer it to the ICO.

https://ico.org.uk/your-data-matters/raising-concerns/


I'm not sure whether there would be any benefit in copying that to anyone else in the NHS. GPs are independent contractors, not NHS employees, so it's really only the GP you can pursue for the information they hold.

[BankFodder]

I suggest that you start off by reading this post https://www.consumeractiongroup.co.u...=1#post5170199 which I put up about the failure of GDPR and what you can expect from the ICO

[MrSmithers]

Thank you for the replies.

Im going to start off with the formal complaint to the surgery.

Is there any reason why i should not email this in rather than submit a letter? Im thinking emails leave a better trail then letters.

[dx100uk]

never use email
you need a verifiable PAPERTRAIL
1st class mail with free proof of posting from the PO counter

[MrSmithers]

Thank you for the quick answer.

[BankFodder]

Would you mind telling us why you are asking for the data.

[MrSmithers]

Sure its on behalf of a family member who suffers from several medical problems and has a ridiculously frequent amount of problems with the NHS not doing things they should be doing.

[BankFodder]

Okay. For whatever reason you seem to be constrained by fairly unsocial hours. This means that it is rather difficult to help you with your problem.

However, I would suggest that a fairly effective way forward would be to identify the data controller, make sure that you have sent your SAR to that data controller and if everything has been done correctly, then to threaten to bring an action for breach of statutory duty. I'm not sure how it works in the NHS. If the data controller is the GP practice that you are dealing with then I would have thought they would be anxious to avoid a judgement for breach of statutory duty because they will be obliged to report it to the GMC. This would cause them huge problems.

So, can you confirm the validity of your SAR and of the data controller you sent it to and let us know who that is.

[MrSmithers]

So, can you confirm the validity of your SAR and of the data controller you sent it to and let us know who that is.

Sorry if its a stupid question but how do you mean?

I copied the new SAR request from these forums and edited slightly (copy attached) for my needs, got them signed and then they were handed in and later posted to the surgery.

Thank you for the help by the way.

[BankFodder]

When you are contemplating this kind of action it is best to be very prepared and to doublecheck at every step. You don't want to be in a position where you issue proceedings and then suddenly find that there is a viable defence on the basis of some technicality.

Who is the data controller? Have you discovered this? I don't know how NHS records are controlled under the data protection regime. Is the data controller within the practice or is it some more generalised NHS data controller.

You need to check this and be absolutely certain. I suppose it might even be possible that you haven't sent your SAR to the correct person – in which case the SAR would not be valid.

I'm recommending this caution for your sake because it will be you who will suffer the humiliation of a defeat and also the loss of a claim fee – however little that might be. Much better to make sure that all your ducks are in a row and then you can go in heavy.

[think about it]

A quick thought on this one - you say that the request is on behalf of a family member. My initial thinking would be around whether or not you’re entitled to that information, whether or not the practice has received separate instruction from the data subject and whether or not you have the data subject’s consent to access their data in a form that is easily agreed upon and demonstrated to the data controller. It’s very unusual for no response to be made at all but I have dealt with requests where the patient has expressly told us not to provide any information about their care to family members. Another added complication can be in instances of family break ups where vexatious requests are made to try to gather information to undermine the other party.

[MrSmithers]

Sorry for leaving this so long...

I had a good search the other day because i was sure i had used this site to identify who i should have sent the SAR to in the first place but couldn't find anything here or elsewhere. Im certain i was helped somewhere with this bit and that the Doctors Surgery was the place to contact because i wanted copies of everything.

I think at this point i would like to just contact the doctors surgery anyway as im sure any answer to a complaint will be putting me in the right direction.

With regards to permission the SAR i wrote up was addressed from and signed by the relevant family member.