Access to medical records

In the past, an individual did not have a right to see his or her medical records. The position has gradually altered due to a number of laws, the most important of which is now the Data Protection Act 1998. This covers both computerised and (some) manual records, and as such is a significant advance on its predecessor (the Data Protection Act 1984), which only regulated records held on computer.

There is specific legislation on access to manually held health records in the form of the Access to Health Records Act 1990. However, “since the passing of the Data Protection Act 1998, the terms of this Act are now redundant except in so far as they relate to a deceased person”¹, and so this legislation is not discussed further here.

The Data Protection Act 1998 gives anybody the right to know what information is being stored about them and to have access to it (the ‘right of access to personal data’). It also allows anyone to have inaccurate personal data rectified, blocked, erased or destroyed, and to prevent the processing of information which is likely to cause unwarranted damage or distress.

There are a number of exceptions to the ‘right of access’. Most importantly, medical information may be exempt if applying the right “would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person.” (Data Protection (Subject Access Modification) Health Order 2000, reg 5(1)).

Further information about data protection is available from the website of the Information Commissioner’s Office (www.ico.gov.uk).

Under this Act, a person has the right to see a medical report prepared by his or her doctor (“who is or has been responsible for the clinical care of the individual”) for employment or insurance purposes. Any employer, potential employer or insurance company who wants a medical report from somebody's doctor must first obtain the individual's consent and inform them of their right of access under the Act.

The person concerned has a right to see the report before it is sent to the employer or insurance company if they have asked to do so, in writing, when giving their consent to the report. Once the report has been sent, the individual may still seek a copy of it for up to six months. There is no right to amend or correct the report unless the doctor agrees, but there is a right to prevent the report being sent at all.

The Act allows circumstances where non disclosure by the doctor is possible. If somebody feels that they have been wrongly refused access to a medical report, they may apply to the county court, which can order disclosure (section 8).

Although an employer or insurance company can get round the Act by appointing their own doctor to prepare reports, such a report might still be accessible under the provisions of the Data Protection Act 1998.

Electronic patient records are widely used by hospitals and NHS trusts. In addition, four different national systems of electronic patient records are at various stages of development and implementation: Summary Care Records in England, Emergency Care Summary records in Scotland, Emergency Care Records in Northern Ireland, and Individual Health Records in Wales. The details of each scheme are described in NAT’s December 2009 report Confidentiality in Healthcare for People Living with HIV.

One other national scheme is worth mentioning: in Scotland, the National Sexual Health System (NaSH) is an electronic record system used by the majority of specialist sexual health clinics in Scotland. Patients may choose to be registered using an alias, although most are happy to use their real details. Consent to communicate with GPs is needed before any letters can be sent to them. The system is accessible only to staff working in specialist services, who are limited by their role and geographic location in what they can see. Patients can choose to have all tests sent just by a clinic number rather than with their name on.