Accessing your health records - Bradford District Care NHS Foundation Trust

The NHS is not allowed to release any information without proof of identity. This means we’ll ask you to provide:

copies of two identity documents, such as a passport or driving licence
one proof of address, such as a utility bill
written consent from the patient if you’re requesting records for someone else
evidence of parental responsibility
power of attorney for health and welfare if you’re a carer
proof of probate or letters of administration if the patient is deceased.

To ask to view your medical record for yourself or the medical record for someone you care for, firstly request this by sending an email to dpa.requests@bdct.nhs.uk.

Your request will be logged and once confirmed that it is a valid request, will be processed in accordance with the Data Protection Act 2018 which adopts General Data Protection Regulation (GDPR).

When we have retrieved the records requested, you will be alerted through our Data Protection Act 2018 compliant electronic portal (Smartbox.ai) (via email) that the requested documentation, which is encrypted, is ready to be accessed. You will be provided with a link where you will be able to download the files

It is important to note that the link will only remain valid for 30 days, so please ensure that you have downloaded all required information within that time.

Please note, the trust is currently working to create an online request form. Once this is available the Information Governance Team will make this option available to you.

Once we’ve received your request, we will acknowledge your application as soon as possible.

We will provide your records within one calendar month of receiving both your request and satisfactory proof of your identity. This timeframe is set out under the UK GDPR.

There are some situations where the one‑month timeframe may be extended. For example:

If your request is complex (eg: your records span multiple services or include large volumes of information).
If we need to contact you for clarification about the information you are seeking.
If we are awaiting confirmation of your identity or authority to act on behalf of someone else.

If an extension is required, we will:

contact you within the original one‑month period,
explain the reason for the delay, and
confirm the new deadline (up to an additional two months, where permitted by law).

We will keep you updated throughout your request and let you know as soon as your records are ready.

We will not charge you for giving you a copy of your records. We may charge you a fee if you ask us to give more than one copy of the same information. The fee will be based on the administrative cost only.

People who have the right of access to your healthcare records are:

- you (the patient or service user)
- a person authorised in writing to apply on your behalf
- a person with parental responsibility for a patient who is a child
- any person appointed by the courts to manage the affairs of a patient who is deemed to be incapable.

For any application to access a child or young person’s health record our Trust is obliged to consider:

- the child’s level of maturity and their ability to make decisions with regard to access the nature of the personal data;
- any court orders relating to parental access or responsibility that may apply;
- any duty of confidence owed to the child or young person;
- any consequences of allowing those with parental responsibility access to the child or young person’s information;
- any detriment to the child or young person if individuals with parental responsibility cannot access this information;
- any views the child or young person has on whether their parents should have access to information about them.

There are sections in the regulations which state that under certain conditions access can be refused. These are:

where the holder of the records is not supplied with such information to satisfy themselves as to the identity of the applicant;
where the patient has died and the record includes a note made at the patient’s request that they did not wish access to be given to their personal representative or to any person having a claim arising from the patient’s death;
where, in the opinion of the record holder, the information may cause serious harm to the physical or mental health of the patient or other individual;
where information is provided by a third party, who would be identified from that information.

You can read more information about accessing your medical records on the NHS website.

For more information about accessing someone else’s records, please view the NHS common questions:

- Can I access the medical records of someone who has died?

If you are concerned about how we have handled your personal information, including delays or issues with your Subject Access Request, you should contact us first and give us the opportunity to resolve the matter.

The Information Commissioner’s Office (the independent authority in the United Kingdom responsible for upholding information rights, data privacy for individuals, and public sector transparency), advises that organisations should be given a chance to put things right before a complaint is escalated. [ico.org.uk]

Please provide:

a clear explanation of your concern
any relevant details (such as reference numbers)
copies of any correspondence relating to your request.

We will review your concerns, investigate where necessary, and respond as promptly as possible.

If I’m still not satisfied, can I complain to the ICO?

Yes. If you remain unhappy with our response, you can raise your concern with the Information Commissioner’s Office (ICO). The ICO can investigate complaints about how organisations handle personal data and take action where necessary. More information is available here.

How to contact the ICO:

Online – visit the ICO website’s data protection complaints section
By phone – 0303 123 1113
By post – write to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

If you have any questions regarding Subject Access Requests, you can contact us by:

Telephone: 01274 228162
Email: DPA.requests@bdct.nhs.uk

Information will be provided to applicants in an electronic format via our Subject Access Request portal Smartbox.ai.

If you require a paper version of the Subject Access Request form, please contact us using the details above.

All NHS staff are bound by law and a strict code of confidentiality and only staff who are directly involved in your care can see your records. The information we record and who it may be shared with can differ depending on which of our services you use. To see more details about how your information will be stored and shared see our Trust privacy notice.