Subject Access Request (SAR)

Overview
Patient's Application
Third Party Application
Child Application
Fees
Response Time
The Law
SAR Application Form

Guidance for patients and service users

A SAR is a request that can be made asking for access to the personal information a company or organisation holds on you. This is a legal right that any individual in the UK is entitled to exercise at any point for free. 

You can ask someone else to submit a subject access request for you, for example, a solicitor or family member acting on your behalf. You will be asked to provide confirmation of this request by completing the Medical Information Release Consent form.

Whilst a SAR gives you the right to obtain a copy of your personal data, it should be noted that there are other ways to obtain your health and care records. The NHS is seeking to empower people and transform their experience of health and care by giving them the ability to access, manage and contribute to digital tools, information and services – for example, most patients can now request access to their GP record online, including via the NHS App.

There are 3 types of subject access request:

    1. Patients applying for themselves
    2. A third party application (applying on behalf of someone else)
    3. Application on behalf of a child

1. Patients applying for themselves

Complete the Subject Access Request form below and upload your proof of identification.  There should be 2 documents as proof of your identification.  This should include one photographic and one that contains your name and address.  Altogether, the documents should include your name, date of birth and current address. If you have changed your name please supply relevant documents evidencing the change.

These can include:

    • your birth certificate
    • your passport
    • your driving licence
    • an official letter addressed to you at your address (e.g. bank statement, recent utility bill or council tax bill)

Please note that proof of address must be dated within the last 3 months.  

2. A third party application

A patient can authorise their solicitor, or another third party, to make a SAR on their behalf. 

Provided the solicitor or third party has given the practice the patient’s written consent or we have received a completed Medical Information Release Consent form, the SAR from the solicitor or third party will be treated in the same way as if it was made directly by the patient.   Alternatively, if you have the permission of a third party to act on their behalf, then both persons must be present when completing this online form.

Complete the Subject Access Request form below and upload the relevant proof of identification.

There should be 2 documents as proof of your identification.  This should include one photographic and one that contains your name and address.  Altogether, the documents should include your name, date of birth and current address. If you have changed your name please supply relevant documents evidencing the change.

These can include:

    • your birth certificate
    • your passport
    • your driving licence
    • an official letter addressed to you at your address (e.g. bank statement, recent utility bill or council tax bill)

Please note that proof of address must be dated within the last 3 months.  If you are the third party completing the form with the subject please upload identification for both.

3. Application on behalf of a child

All patients have a right to access their own health and care records, including children. A child can exercise their own data protection rights so long as they are deemed competent to do so. Generally, children aged 13 and over, are considered competent to make a SAR unless there is information to suggest otherwise. If the child (of any age) does not have sufficient understanding to exercise their rights themselves, you may allow a person with parental responsibility to exercise the child’s right to make a SAR.

If a SAR is made on behalf of a child who is deemed to lack capacity to act on their own behalf, information may be sent to a person with parental responsibility. However, this is not a decision that should be made automatically. In all cases the best interests of the child should be considered. It is possible to restrict information going to a parent where it is not considered to be in the best interests of the child, for example, where there are “do not disclose” notes on the child’s record.

There should be 2 documents as proof of identification for this application:

    • For the child you must provide their birth certificate. 
    • For the person with parental rights there must be photographic ID such as a copy of their passport or driving licence.

Fees

Under GDPR, SARs are generally free of charge. Only if the SAR is considered to be ‘manifestly unfounded’ or ‘excessive’ can a ‘reasonable’ fee be charged. 

A SAR could be deemed as ‘excessive’ if an individual was to receive information via a subject access request (SAR), and then request a copy of the same information within a short period of time. In this scenario, the practice could charge a reasonable fee, or refuse the request.

Our response

We will usually process your request within 30 days as long as we have received the correct proof of your identity. 

Following your request, we may write back to you within the 30-day time frame to request you to narrow or modify your requirements. This may also result in an extension of a further 60 days whilst we examine your request.

Information is provided in line with the General Data Protection Regulations (GDPR), Chapter 3, Article 15 (Recitals 63 & 64).

Method of receipt

Your copy records will be provided to you in hard copy format. It may be possible to provide this electronically by email depending on the size of the file. Please note any records sent electronically will be sent with an encryption, which means they will only be accessible via a set password. If this method is requested, the set password will be provided to you.

The Law

The Access to Medical Records Act 1988 and The Data Protection Act 1998 require that you give consent to the release of information your GP holds about your health to any third party. This is usually Solicitors and Insurance Companies for example, who are not directly involved in providing you with healthcare. In addition it gives you the right to view, and comment on, any such report before your GP sends this to the said third party. You can also choose to request sight of a copy of the report at any time up to six months later.

Your right to choose

To make sure that you are aware of your rights, your choices and that the correct procedure has been followed we outline this legislation below. Please read this form carefully. Your GP can only respond to requests from third parties if they have your written permission to disclose any information about your health. Many companies have their own request form which you will complete and they will forward to us. Alternatively you will need to complete the form below.

Your consent

When you give your consent you must also decide whether you wish to see the report before it is sent to the third party requesting the information.

 

If you choose not to see the report

If you choose not to see the report then this will be forwarded directly by your GP to the third party without further recourse to yourself.

If at a later stage you change your mind then you can ask to see a copy of the report up to six months later. You are required to give prior notice to your GP to allow them to make the necessary arrangements and if you require a copy from your GP then a charge may be made for this service.

 

If you choose to see the report

If you choose to see the report before it is sent off then you need to advise your GP accordingly and as soon as possible. You then have 21 days to arrange to see the report before it is sent off to the third party.

Once you have seen the report it can not be sent off unless you give your consent to the content. If you consider any part to be misleading or incorrect, you can ask your GP to amend it. If your GP is unwilling to amend the report then you can attach a written statement of your views relating to the disputed section.

Your Doctors rights

In the following circumstances your GP can withhold the report from you :

    • If your GP believes that letting you see a particular part of the report would be likely to cause serious harm to your physical or mental health, or that of others, that part can be with held.
    • If the report, or part of it, indicates the doctor’s intentions towards you.
    • If disclosure would reveal information about, or the identity of, another person who has supplied information about you (unless that person has consented or is a health professional who has been involved in caring for you).
    • If disclosure would mean revealing information about a third party who has not given consent.

In such cases the GP will show you the remaining part of the report if you have opted to view it first. If either the whole or part of the report is not to be disclosed to you, the GP must notify you accordingly. If the whole report is withheld from you, the GP cannot send it to the third party unless you give your consent to do so.

Please complete the consent form below to allow us to release your medical records.

Subject Access Request Application Form

Details of Patient Record to be Accessed

A patient can authorise their solicitor, or another third party, to make a SAR on their behalf.

Provided the solicitor or third party has given the practice the patient’s written consent or we have received a completed Medical Information Release Consent form, the SAR from the solicitor or third party will be treated in the same way as if it was made directly by the patient.  Alternatively, if you have the permission of a third party to act on their behalf, then both persons must be present when completing this online form. We will require them to complete “The Authorisation of Patient if Request made by Third Party” declaration shown below.
Generally, children aged 13 and over, are considered competent to make a SAR unless there is information to suggest otherwise. If the child (of any age) does not have sufficient understanding to exercise their rights themselves, you may allow a person with parental responsibility to exercise the child’s right to make a SAR.

If a SAR is made on behalf of a child who is deemed to lack capacity to act on their own behalf, information may be sent to a person with parental responsibility. However, this is not a decision that should be made automatically. In all cases the best interests of the child should be considered. It is possible to restrict information going to a parent where it is not considered to be in the best interests of the child, for example, where there are “do not disclose” notes on the child’s record.

We will require them to complete “The Authorisation of Patient if Request made by Third Party” declaration shown below.

Details of Applicant

Type of SAR Request

Parts of Medical Record

Partial Medical Record (Date Range)

Consent

Privacy Policy

The information you supply us will be used lawfully, in accordance with GDPR Regulations. GDPR gives you the right to know what information is held about you, and sets out rules to make sure that this information is handled properly.

Please note that by using this form you will be sending information about yourself across the Internet. Whilst every effort is made to keep this information secure, you should be aware that we cannot offer any guarantees of absolute privacy. If this matter concerns you then you should use another method of application.

Personal information retained on this system is stored in a secure data centre located in the UK and is treated as confidential.  

Please read our Privacy Policy to discover how we protect and manage your submitted data.

Declaration

I declare that information given by me is correct to the best of my knowledge and that I am entitled to apply for access to the health record(s) referred to above, under the terms of the Access to Health Records Act (1990) / Data Protection Act.

Authorisation

I authorise the practice to release personal data requested relating to me to the above applicant to whom I have given my consent to act on my behalf.

Please Note:    

 

  • If you are making an application on the behalf of somebody else, we require evidence of your authority to do so i.e. signed authorisation, medical information release, personal authority, court order etc.
  • It is necessary to provide evidence of identity (i.e. passport, driving Licence). 
  • If there is any doubt about the applicant’s identity or entitlement, information will not be released until further evidence is provided. You will be informed if this is the case.
  • Under the terms of the Data Protection Act, requests will be responded to within 28 days after receiving all necessary information and/or fee required to process the request. 
  • If you are making a request under the Access to Health Records Act 1990, requests will be responded to within 40 days where no entries have been made to the patient/client’s record 40 days immediately preceding the date of this request, otherwise requests will be responded to within 21 days after receiving all necessary information and/or fee required to process the request. 

 

Under the terms of Section 7 of the Data Protection Act, Information disclosed under a Subject Access Request may have information removed; this is to ensure that the confidentiality is maintained for third parties referred to who have not consented to their information being disclosed.