Access to my medical records.

[nolegion]

(nolegion’s half-dozen time-related tips re DPA ‘subject access requests’ to the NHS)

 

1. Don’t fall for ‘the form’.

 

There is no set ‘form’ for a ‘subject access request’, save that it should be in (signed, hard copy) writing, so you don’t need to ask the surgery\hospital to supply you with one. Nor are you obliged to give any reason whatsoever for your requiring the copy records.

 

Sometimes, even when you have put in a perfectly valid written ‘request’, you will be sent a ‘standard form’ to complete. Don’t. The NHS body concerned will treat the date they receive the form back from you as the earliest possible ’starting date’ for compliance with the request - not the date of their receipt of your original written request.

 

To avoid any possible doubt, I put in requests a statement that they comply with all requirements for a ‘subject access request’ and that no other ‘form’ will be submitted. Avoids having to write a separate letter sending back the (uncompleted) ‘form’ later.

 

Even if you live next door, send it recorded delivery, first class, and say on your letter\request that it has been so sent in, on the date of the request, which should be clearly stated.

 

2.’ Come off it, you know me.’

 

Supply copy evidence of your identity and address with your request. Copy passport or photo driving licence and the usual couple of utility bills will normally be ample. List your enclosures.

 

If you have just told your GP\ consultant in person that you are about to put in a request you shouldn’t be challenged - but they won’t record what you have said, and you will be anyway. So supply the stuff up front on day one, in any event.

 

Say in your letter that you require the copy records to be posted to the address you have given ‘promptly and in any event within the statutory time limit’

 

 

3. Go for the lot.

 

Even though it can have by no means insignificant short-term financial consequences, ask for all health records as defined by the Data Protection Act and all or any other personal data held in respect of you. Anything less so often turns out to be a false economy in the longer run - and it may very well take considerably longer to get everything you are after, to boot.

 

 

4. Remember ’cheques’?

 

In the Michael Caine school of ‘not a lot of people know that’, there are some daft statutory provisions which result in time for compliance with the request not starting ‘to run’ until the requisite fee has been paid - which you can’t know until you are told by the records holder after it has ‘evaluated’ your request, quite probably many weeks or even months later. NHS ‘statististical compliance’ relies on this type of footling obfuscation.

 

If you possibly can, bite the bullet and send a cheque for £50.00 (the maximum they can charge, inclusive of postage, and it’s not subject to v.a.t.) with your request, authorising them to encash straight away and to account to you with the balance in due course.

 

On the plus side, I have yet to see a Trust\practice encash such a cheque unless the maximum fee has been reached and they are about to post. Their accounting systems simply aren’t up to it. If they send your cheque back and ask for a specific lesser sum, promptly comply. But they can’t deny they had their full fee from the outset.

 

(I agree it’s a disgrace they can charge for your own info this way at all.)

 

5. Non-compliance

 

The statutory time (‘prescribed period’) for compliance is 40 days (not 40 ‘working’ days) starting with the record holder\controller’s date of receipt of the written request, identifying the ‘subject’ (you), and the copy records required, and the fee.

 

It is purported NHS ‘policy’ to comply within 21 days. They won’t, but there is no harm in writing a letter on day 22 pointing out they haven’t.

 

(If you get a communication querying the ‘scope’ of your request point out that your original request said ‘everything’, that that is what you still mean, and that the number of days for compliance already elapsed is whatever it is. I have seen such queries raised in blatant attempts to ‘buy time’.)

 

When your request still hasn’t been complied with within 41 days after the date on the recorded delivery confirmation you have downloaded from the net, go to the site of the Information Commisssioner’s Office and download a complaint form. Once you’ve submitted that to the ICO (hard copy, plus a copy of the recorded delivery confirmation, and of your ‘reminder letter’) drop a ‘one-liner’ to the Trust\practice telling them that is what you have already done.

 

You should get your copy records within 2 or 3 weeks after that, unless they really have lost them on a train.

 

(Remember to insist they are posted to you - don’t accept any request to pick them up.)

 

6. Afterwards

 

Apart from very carefully checking you have absolutely everything you expect fully and legibly copied…

 

…take a copy of the date-stamp on the envelope which contained the late-posted copy records and send that to the ICO as well, ‘further to’ your already-submitted complaint. In due course you’ll get a letter from the ICO confirming that it did indeed appear that xyz was in breach of their statutory obligations, for you to do with as you see fit - like put a copy on the net with your details blanked out but not the defaulting party’s…

 

…so that maybe, just maybe…

 

…THE NEXT PATIENT’S REQUEST WILL GET DEALT WITH PROPERLY IN THE FIRST PLACE.

 

“…a data controller shall comply with a request…promptly…and in any event before the end of the prescribed period.” - ex S.7, Data Protection Act 1998.

[nolegion]

Don’t fall for ‘the form’.

 

There is no set ‘form’ for a ‘Subject access request’, save that it should be in (signed, hard copy) writing, so you don’t need to ask the surgery\hospital to supply you with one. Nor are you obliged to give any reason whatsoever for your requiring the copy records.

 

Sometimes, even when you have put in a perfectly valid written ‘request’, you will be sent a ‘standard form’ to complete. Don’t. The NHS body concerned will treat the date they receive the form back from you as the earliest possible ’starting date’ for compliance with the request - not the date of their receipt of your original written request.

 

To avoid any possible doubt, I put in requests a statement that they comply with all requirements for a ‘subject access request’ and that no other ‘form’ will be submitted. Avoids having to write a separate letter sending back the (uncompleted) ‘form’ later.

 

Even if you live next door, send it recorded delivery, first class, and say on your letter\request that it has been so sent in, on the date of the request, which should be clearly stated.

 

I wrote this back in October of last year, fjear, and for what its worth, you can find it together with quite a lot more chuntering from me on the subject (always winds me up, how badly patients are treated when seeking their own info) back in post no.39 , this thread.

[nolegion]

I wish you well in pursuit of the sensible and courteous advice to which you are fully entitled, fjear, but which I suspect you have been denied at least in part by medical arrogance and stupidity.

 

 

In my view, getting hold of your full medical records (and periodically keeping your copy set up to date) is a very postive step in the right direction for every patient - even when things appear to be going well. All the best.

 

 

(PS. Well done also for writing to the General Medical Council; but they will, alas, send you a standard letter saying that they are not going to do anything. They will at the same time neverthless tell the doctor concerned that you have complained about them, without telling you that is what they have done. They are a grotesque and duplicitous disgrace.)

[nolegion]

Yesterday, newspapers and other media carried quite a lot about the proposal to provide patients with online access to their medical records promptly and free, and even the ability to add their own comments.

 

Personally, I think that is a genuinely excellent, precise and significant idea in principle. Like many others, though, I fear that in practice several factors, but mostly strenuous resistance from the medical profession, will delay, decimate or otherwise dilute or destroy its implementation. Anybody else any views?

 

One factor for this thread which I think should be emphasised is that the coverage included (in e.g. the Times and the Daily Mail) reports suggesting that the current rules on access torecords i.e. under the Data Protection Act require patients to provide reasons for their requiring the access. This was and is complete nonsense,and for once I am happy to say that it was a doctor (a GP) who commented in the most clear and eye-catching fashion:-

 

“But to do so they must make an application to their GP and usually attend a meeting where a case for access has to be made." That is simply untrue. Yes, you have to ask your GP for your records (by letter, email, fax or in person, or by phone if your GP knows you well), he/she won't spontaneously send them to you. But you absolutely DO NOT have to make a case or give ANY reasons as to why you want the records. And you DO NOT have to attend a meeting to make your case. That is utter rubbish. Many GPs are very happy to give patients a copy of their records. Yes, we do have to ensure that information about 3rd parties is removed but on the whole the entire record - warts and all - is provided. Neil(GP)

 

See:-

 

http://www.dailymail.co.uk/health/article-2077847/NHS-patients-given-access-medical-records-years.html#ixzz1hS8WtrV2

[nolegion]

And warm seasons’ greetings to you too, HB, from the other end of the day, as it were and still, just, partly, sober

 

Yes, indeed. Could the NHS possibly get this right security-wise -or at all? Apart from anything else the incredible £multibillion-and-still-counting fiasco with last NHS IT ‘initiative’ must give pause for very serious thought.

 

Yet, yet… it seems to me that the heart of this proposal is so much in the right place, one must wish it well. Just for once the jargon expression ‘patient-centred’ is actually being correctly deployed.

 

I’m not technophobic, but I know the, severe, limitations of my technocompetence. With that in mind, during the festivities, I (the ever vigilant NL) have been able to consult the next generation down, who say it should be as ‘easy as chip and PIN’. Yeah right, but I do wish the scheme every best chance against the opposition which I am sure will be severe and (however disguised) more iatric than technocratic or cost-based.

 

We shall see.

[nolegion]

I follow that, zippy.

 

Dr Mark Porter, however, who sounds like a nice chap though I very much want him to be wrong in this, suggests (in The Times, last Friday) that current records systems in both hospitals and GPs practices are so“antiquated” that he “can’t see online access happening in the next decade, let alone the next three years.”

 

Dare one hope that in fact he is more antiquated than the ITsystems which will be involved? Is there actually sufficient hardware andsoftware in place, or readily installable on top what is already there, to cope with literally millions of separate users?

 

It would be so easy for this fine proposal to get “kicked into the long grass”.

 

(And talking of that newspaper, I note that 6 of the 15 letters printed in it today are on this subject, including one expressly contradicting the previously printed misconception that patients need to give reasons for wanting to see their records: see post 24/12 here. Good. One dead canard.)

[nolegion]

Here’s a heartfelt comment appended by a patient to one of the online newspaper articles about the proposed new rights of access:-

 

“ Speaking as someone who had his medical records tampered with by his GP, confirmed by the GMC (eventually) I have concerns about the lack of protection your medical records have. The laws are just not sufficient, not enforced and not a deterent for a GP to fake your medical records to manipulate legal proceedings, as I discovered.”

 

(I would duly honour it with a link but it’s behind a £subscribe.)

 

The, I trust fairly obvious, point is that if or when the new access is in place, the sort of (frequent) tampering referred to would become much more scarce because very, very much more dangerous for a doctor to attempt. He or she wouldn’t know whether a patient had already printed off a version of the untampered-with record.

 

I have seen shameless record tampering by doctors, and the GMC’s fitness to practise panels know all about it, even if they do so little to stamp it out.

Edited December 28, 2011 by nolegion

[nolegion]

It looks like the Shadow Health Secretary was ‘under-briefed’, yesterday:-

 

“ I’m hearing that some people are going to their private surgeries and being told they will have to wait to get access to their records, or even pay a £50 fee to get their records. Well, that’s clearly unacceptable.”

 

Well, I agree Mr Burnham, but that has been the law, under the Data Protection Act and as applied by the NHS, all this millennium, and I seem to remember that the labour party was in power for most of it.

 

See, e.g.:-

http://news.sky.com/home/politics/article/16141255

[nolegion]

Indeed, HB. Under-briefed is like being caught with your pants down.

 

But Health Secretary Lansley wasn’t going to let that go, so now:

 

“ Let me be absolutely clear, all affected women should be able to find out details of their implant free of charge.”

 

(See, e.g.:-

http://www.bbc.co.uk/news/health-16395244)

 

Fine. Agreed. But these are mere precatory words, not legally enforceable. So change the flaming law, right now, such that we can all get prompt and free access to our own medical records. (There is no need to wait till the proposed online access is available in three years time, if ever.)

[nolegion]

Predictably, Laurence ("Chuckles") Buckman, honcho GP at the BMA, is tearful about the proposed right of patients to read, online, the notes GPs make concerning them:-

 

"Data having gone to the patient, the patient will read things that concern them and that will result in additional work for the practice."

 

O for goodness sake, my heart bleeds…

 

Frankly, I think that sort of argument lies somewhere between utterly blind, contemptible ignorance, and duplicitous, self-serving arrogance. And that's my mild view. Anybody disagree?

 

What about taking the the trouble to tell patients what you propose to say about them to them in the first place, for goodness sake?

 

See GP Online, yesterday:-

 

http://www.gponline.com/News/article/1113203/patient-access-medical-records-will-add-gp-workload/

[nolegion]

Good evening, HB.. A pleasure and privilege as always.

 

As regards confidentiality and security, I can only emphatically agree.These concerns are surely justified. They need to be addressed and, I hope, solved at the IT and managerial level..

 

It is particularly specious, though, I think, that such arguments should be raised by an influential doctor in the context of medical records which are already 90% computerised, in facilities already 90% online!

 

However, can anyone shed further light on what on earth is going on with the supposed further 'limb' of Chuckles Buckman's 'concerns', as accurately cited by HB? Namely:-

 

"Dr Buckman raised concerns that patients could be coerced to share their records with family, employers and insurance companies and a variety of other people who might wish to have access to them."

 

I am ready to learn that I am missing a point or two neither my own experience nor that of patients I have sought to assist have made clear to me, but what is supposed the 'evil 'resulting from online access to be feared, here?

 

The information in question is supposed already to be available to patients via the DPA. How many patients are currently worried that their 'family' will coerce them into making a 'subject access request' to obtain and reveal their personal medical records'? And should the right of access for all patients be removed even if there were a minority which did?

 

And note that as regards employers and insurance companies (and any other service providers) any such coercion would be a criminal offence and contractually void: see DPA sections 56 and 57, http://www.legislation.gov.uk/ukpga/1998/29/section/56 .

 

I think the medical profession will continue to resist the proposal out of fear, not principle. Other professionals, as HB mentions, take for granted their clients should know what is on file.

[nolegion]

Just a note partly prompted by another thread recently started in this forum which I don't want to clutter with the legal detail. Sensible information\advice already provided there, seems to me.

 

Re: Access to Medical Records Act 1990. This is no longer what it sounds like. Access to medical records is now largely achieved via the Data Protection Act 1998, not the 1990 Act.

 

The 1990 Act has in fact largely been repealed except as regards access to the medical records of the deceased where access can be gained, with difficulty, by:-

 

"…the patient’s personal representative and any person who may have a claim arising out of the patient’s death."

 

The trouble with this is the set of hoops the average NHS body will, as much in ignorance as earnest, try to make you jump though while not providing the information. I say, start early and don't wait for the lawyers. They can always join in later and charge you for the privilege.

[nolegion]

Of course, nobody would actually rely on a new computerised medical records system until they were sure it worked properly, would they?

 

http://www.thisisbristol.co.uk/chaos-NHS-hospitals-Bristol/story-15050772-detail/story.html

[nolegion]

Here's an extract from a recent GMC case (although the underlying facts stretch back several years):-

 

"In particular you admitted and the Panel found proved that you had altered medical records retrospectively in relation to some 20 patients. The Panel found that your actions were not in the best interests of the patients, not of a standard expected of a reasonably competent general practitioner and misleading.

 

The Panel also found that over a period of two years you dishonestly amended the records of six patients, in one case potentially causing direct harm by recording a coil check which had not been undertaken. In some of those cases you were seeking to hide a clinical oversight, in one you sought to make your actions appear more appropriate than they were in the context of a potential clinical incident and you sought to deflect blame onto a colleague. The Panel also considered that your actions were serious and caused a risk to patients."

 

(ex: http://www.gmc-uk.org/static/documents/content/Moneim.pdf)

 

The point I would like to make at this juncture is that in GMC cases, you will find that in one after another some degree of false or 'misleading' records is involved in the facts considered – along with, it might well be said, other forms of fraud or dishonesty.

 

This should be contrasted with the position under the complaints policies of e.g. hospital Trusts where you are quite likely to find that someone who denies the accuracy of medical records may be classified as a 'vexatious' complainant, resulting in even more non-communicative, obstructive and indeed stonewalling behaviour.

 

Go figure.

Edited March 3, 2012 by nolegion

[nolegion]

burlyb. Apologies if it is me who is mixing things up, but in another thread to which you are currently contributing you have mentioned a GP practice manager (?) asking you to sign some form of 'disclaimer' before releasing copy medical records. If I have understood the situation correctly, that is of course completely unacceptable.

 

Are you able to post here what the purported disclaimer actually says?

Edited May 10, 2012 by nolegion

[nolegion]

burlyb. Thank you. That is OUTRAGEOUS and the first time I have seen or heard of anyone trying such a stunt on. They have no right to require such 'confirmation' at all, and you are, of couse, wholly right not to sign it. Even though, in my opinion, the text would be of negligible legal significance in the long run, it represents an unconscionable degree of ignorance, obstruction, officiousness and would-be bullying.

 

The remedy is wearisome, I'm afraid. You need to put in a 'subject access request' (i.e in writing, not just a phone call) under the Data Protection Act. And, again outrageouely, in my view, but this time legally, they can charge you up to £50 for the privilege.

 

I put some accumulated bitter experience about this into post #49 of this thread. I hope that might help. It's a long haul. Best of luck.

Edited May 10, 2012 by nolegion

[nolegion]

SAR is the only sure way forward at this stage, I'm afraid, burlyb.

 

I seldom invite or respond to 'private messages' in forums - even ones as well moderated as this - but if you care to let me know the names of the practice concerned and that of the hospital your friend mentioned by such a route (not 'in the open', site rules) I think I could interest a co-conspirator buddy of mine in raising some awkward freedom of information requests to the Trusts involved. I also agree with the advice you have received elsewhere about recording how you are treated, and about making a formal complaint to the Primary Care Trust, even if on the 'disclaimer point' alone.

 

Truly, I had never heard of this 'disclaimer' point until today, and I think it is disgraceful.