Access to Medical Records

In the course of an Employment Tribunal claim, Claimants may want or need to obtain their medical records. Such records can be essential where, for example, a Claimant is making a disability discrimination claim that hinges on them being able to provide medical evidence in support of their case. Issues may arise where a GP practice, hospital, or clinic declines to provide such records. This may be due to busyness making it hard to fulfil a request, or perhaps because a decision has been taken that it is not necessary to provide a patient with all their medical records. Whatever the reason, where issues like this arise, it is important for Claimants to be clear on the scope of their right to access their medical records.

Gaining Access

Medical records can be accessed in two ways. How they are accessed depends on whether the request involves the interpretation of existing reports and/or the creation of new reports, e.g. asking your GP to write a letter summarising what treatment you have received in relation to a particular illness.

 (i)                  Access to Medical Reports Act 1988

Where interpretation/creation is required, patients are entitled to such reports/records under s1 of the Access to Medical Reports Act 1988. Fees can be charged for requests of this type. The only exemptions to the right of access are those contained in s7 of the 1988 Act: (i) disclosure of the reports/records is likely to cause serious physical or mental harm to the individual; and/or (ii) disclosure of the report would be likely to reveal information about another person who is not a health professional and has not consented to the information being supplied. These are therefore the only reasons why an individual could be refused access to medical records/reports of this type.

 (ii)                GDPR and DPA 2018

Where the request simply relates to existing medical records, the entitlement to access stems from the General Data Protection Regulation (GDPR), read alongside the Data Protection Act 2018 (DPA 2018). The GDPR and the DPA 2018 replace the Data Protection Act 1998.

A request by a patient, or a request by a third party who has been authorised by the patient, for access under the GDPR (and DPA 2018) is called a subject access request (SAR). Subject to the GDPR and s12 of the DPA 2018, these requests must be fulfilled on a free of charge basis unless the request is ‘manifestly unfounded’ or ‘excessive.’ Where this is the case, a ‘reasonable’ fee can be charged.

 No explicit official guidance has been given on the meaning of ‘manifestly unfounded,’ however, the Information Commissioner’s Office (ICO) has suggested that this is aimed at requests that are made solely for the purpose of disrupting an organisation. Where an individual has a genuine intention in obtaining their records, the request is unlikely to be manifestly unfounded.

The British Medical Association (BMA) has suggested that a request could be deemed as ‘excessive’ if an individual were to receive information via a subject access request (SAR), and then request a copy of the same information within a short period of time. In this scenario, the organisation could charge a reasonable fee. The ICO have also suggested that “a SAR for the whole medical record would never be considered excessive for the purposes of imposing a charge.”  This means that a patient asking for their whole medical record cannot be classified as an excessive request.

Again, the right to access records through this route is a right that can only be refused where certain exemptions apply. Those exemptions are set out in the GDPR and the schedules to the DPA 2018 and can be summarised as follows:

• it is likely to cause serious physical or mental harm to the patient or another person; or

• it relates to a third party who has not given consent for disclosure (where that third party is not a health professional who has cared for the patient) and after taking into account the balance between the duty of confidentiality to the third party and the right of access of the applicant, the data controller concludes it is reasonable to withhold third party information; or

• it is requested by a third party and, the patient had asked that the information be kept confidential, or the records are subject to legal professional privilege or, in Scotland, the records are subject to confidentiality as between client and professional legal advisor. This may arise in the case of an independent medical report written for the purpose of litigation. In such cases, the information will be exempt if after considering the third party’s right to access and the patient’s right to confidentiality, the data controller reasonably concludes that confidentiality should prevail; or

• it is restricted by order of the courts; or

• it relates to the keeping or using of gametes or embryos or pertains to an individual being born as a result of in vitro fertilisation; or

• in the case of children’s records, disclosure is prohibited by law, e.g. adoption records.

 Conclusion

Patients therefore have a clear right to access their medical records/reports that can only be deviated from if one or more of the relevant exemptions apply. Prior to making a request, Claimants should consider whether the request requires the interpretation/creation of medical reports or, if not, whether the request can be made via a SAR.

Where a Claimant faces difficulty in obtaining a medical record/report from a medical services provider (e.g. a hospital or GP’s surgery), they should consider whether any of the exemptions outlined above apply. If none do, the Claimant should make the relevant provider aware of this and remind them of their right to access their medical records/reports.