Subject Access Requests – accessing medical records

We’re not allowed to release any information without being satisfied about your identity. This means we’ll ask you to provide:

• Copies of two identity documents
• One proof of address
• Written consent from the patient if you’re requesting records for someone else
• Evidence of parental responsibility
• Power of attorney for health and welfare if you’re a carer
• Proof of probate or letters of administration if the patient is decease

Once you have made a request to dpa.requests@bdct.nhs.uk your request will be logged and once confirmed that it is a valid request, will be processed in accordance with the Data Protection Act 2018 which adopts General Data Protection Regulation (GDPR).

When we have retrieved the records requested, you will be alerted through our Data Protection Act 2018 compliant electronic portal (Smartbox.ai) (via email) that the requested documentation, which is encrypted, is ready to be accessed. You will be provided with a link where you will be able to download the files

It is important to note that the link will only remain valid for 30 days, so please ensure that you  have downloaded all required information within that time.

Please note, the trust is currently working to create an online request form. Once this is available the Information Governance Team will make this option available to you.

Once we’ve received your request, we will acknowledge your application as soon as possible.

We will provide your records within one calendar month of receiving both your request and satisfactory proof of your identity. This timeframe is set out under the UK GDPR.

There are some situations where the one‑month timeframe may be extended. For example:

• If your request is complex (e.g. your records span multiple services or include large volumes of information).
• If we need to contact you for clarification about the information you are seeking.
• If we are awaiting confirmation of your identity or authority to act on behalf of someone else.

If an extension is required, we will:

• Contact you within the original one‑month period,
• Explain the reason for the delay, and
• Confirm the new deadline (up to an additional two months, where permitted by law).

We will keep you updated throughout your request and let you know as soon as your records are ready.

We will not charge you for giving you a copy of your records. We may charge you a fee if you ask us to give more than one copy of the same information. The fee will be based on the administrative cost only.

Those who have the right of access to your healthcare records are:

• • You (the patient)
  • A person authorised in writing to apply on your behalf
  • A person with parental responsibility for a patient who is a child
  • Any person appointed by the Courts to manage the affairs of a patient who is deemed to be incapable

For any application to access a child or young person’s health record we are obliged to consider the following:

• • The child’s level of maturity and their ability to make decisions with regard to access the nature of the personal data
  • Any Court orders relating to parental access or responsibility that may apply
  • Any duty of confidence owed to the child or young person
  • Any consequences of allowing those with parental responsibility access to the child or young person’s information
  • Any detriment to the child or young person if individuals with parental responsibility cannot access this information
  • Any views the child or young person has on whether their parents should have access to information about them

There are sections in the regulations which state that under certain conditions access can be refused. These are:

• Where the holder of the records is not supplied with such information to satisfy themselves as to the identity of the applicant.
• Where the patient has died and the record includes a note made at the patient’s request that they did not wish access to be given to their personal representative or to any person having a claim arising from the patient’s death.
• Where in the opinion of the record holder, the information may cause serious harm to the physical or mental health of the patient or other individual.
• Where information is provided by a third party, who would be identified from that information.

You can read more information about accessing your medical records on the NHS website.

For more information about accessing someone else’s records, please view the NHS common questions:

• • Can I access the medical records of someone who has died?

If you have any questions regarding Subject Access Requests, you can contact us via phone or email.

• Telephone: 01274 228162
• Email: DPA.requests@bdct.nhs.uk

Information will be provided to applicants in an electronic format via our Subject Access Request portal Smartbox.ai.

If you require a paper version of the Subject Access Request form, please contact us using the details above.

If you are concerned about how we have handled your personal information, including delays or issues with your Subject Access Request, you should contact us first and give us the opportunity to resolve the matter. The ICO advises that organisations should be given a chance to put things right before a complaint is escalated. [ico.org.uk]

Please provide:

• A clear explanation of your concern
• Any relevant details (such as reference numbers)
• Copies of any correspondence relating to your request

We will review your concerns, investigate where necessary, and respond as promptly as possible.

If I’m still not satisfied, can I complain to the ICO?

Yes. If you remain unhappy with our response, you can raise your concern with the Information Commissioner’s Office (ICO). The ICO can investigate complaints about how organisations handle personal data and take action where necessary. More information is available here. 

How to contact the ICO:

• Online: Visit the ICO website’s data protection complaints section
• Phone: 0303 123 1113
• Address:
  Information Commissioner’s Office
  Wycliffe House
  Water Lane
  Wilmslow
  Cheshire
  SK9 5AF

All NHS staff are bound by law and a strict code of confidentiality and only staff who are directly involved in your care can see your records. The information we record and who it may be shared with can differ depending on which of our services you use. To see more details about how your information will be stored and shared see our Trust privacy notice.

• Third party request form
• Subject access request form
• Deceased person request form