As a practice, we receive significant numbers of requests for access to medical records under the Subject Access Request process.

Where we receive these from an individual for their own data, we will release information directly to that person, usually in electronic format subject to relevant checks.

We send these as encrypted archives in order to comply with the relevant legislation, ordinarily as .zip files. Sometimes, Windows will struggle with encrypted archives, so if you get an error message trying to open it natively on your computer, please install 7-zip and try using that to extract the files.

SAR FAQs

Will you send/release the records to a third party?

Practice policy is that we do not under any circumstances disclose your full medical record to a third party, for several reasons.

We are under no legal or contractual obligation to release the GP record to anyone but yourself, except in very limited circumstances; it is your subject access right, and no-one else’s. Releasing the data to you allows you easily to determine:

• what information (if any) you wish to share with any third parties, and
• what information you do not wish to share

We would strongly urge you to read through your GP record, so that you are aware of the detailed and possibly sensitive information that it contains. This information might contain medical history about your family that you have provided directly (to the surgery or other medical organisation). We would ask you to bear this in mind when considering what to disclose, from your supplied record, to any third party.

There could be a large amount of personal and/or sensitive information in your GP record that has no relevance whatsoever to the purpose of the SAR.

Why won’t you send them directly to the person I want to receive them?

We would have significant concerns were we to disclose your SAR directly to a third party:

• that we would be disclosing excessive information – the records requested go beyond that necessary for the intended purpose
• that you would not in a position to be aware of, and verify, the lawfulness and nature of the processing of your personal data, in line with Recital 63 of the GDPR
• that you would not be in a position to determine whether there was personal confidential information that you did not wish to share with a third party- that sections 184 and 185 of the DPA 2018 afford you important protections and safeguards (against “enforced access”) for your confidential medical information which would be bypassed, to your detriment, were we to disclose your SAR directly to a third party
• that, if you are a claimant in a legal matter, you would be unaware of the information that might be, or would have to be, disclosed by your solicitor (i.e. “served”) to the defendant’s legal representative
• that you will not be in control of your own medical information

Disclosing your SAR directly to a third party would neither:

• be providing you, the data subject, with a copy of your personal data, nor
• be allowing you, the data subject, access to your personal data

Accordingly, doing so would be a contravention, by us, of Article 15 of the GDPR.

Am I required to send the information on to someone else?

No. You are under no obligation to forward on your entire GP record – nor indeed any information – to a third party as a result of your subject access request, even if you have signed a “consent form” or “form of authority”.

It is a criminal offence, under s184 of the Data Protection Act, for an organisation to ask, “invite”, “request”, require, compel, or coerce you into providing them with all, or any, of the medical information that you have received as a result of a subject access request.

In addition, to require an individual to exercise their subject access rights and to supply their heath records to an organisation will render a term or condition of contract as void (s.185 DPA 2018).

If you feel that you are being forced into releasing any of your medical information, from the record that we have provided you with, to an organisation then you are entitled to make a complaint to the Information Commissioner’s Office (ICO).

Can I be charged for requesting information under a SAR?

Not the first time – you are entitled to the first copy of your medical record without charge, and similarly to requests for subsequent information which was not in earlier requests.

Should you, or any third party on your behalf, request another SAR from us, following this first request, we are entitled to charge for re-providing the information in this response. We would encourage you to keep a full copy of the record that we have provided you with, at all times, in order that you can:

• disclose any or all of it to a third party for medical purposes
• disclose any or all of it to a third party for any purpose
• produce it, in its entirety, if required to by a court, in the course of a claim
• facilitate engaging a new legal representative, should you wish to or have need to, without needing to request that second copy from us