The practice is registered with the Data Protection Act 2018 (DPA 2018). Any request for access to notes by a patient, patient’s representative or outside body will be dealt with in accordance with the Act. Please contact the Practice Manager for further information.
Subject Access Requests (SARS)
You will appreciate that health data relating to any individual is highly confidential and the Practice must ensure that it releases such data only to the person to whom it relates, or to a person authorised to act on his or her behalf. If you require to see any health data, please complete the Request Form as fully and accurately as possible to enable us to locate the exact information you require.
The General Data Protection Regulations (GDPR) gives you the statutory right of access to any information, manual (paper) or computerised. You may wish to authorise someone else to make your application on your behalf and if you have parental responsibilities you may make an application to see your child’s notes.
You do not have to give a reason for applying for access to your General Practice records. If you do not need access to your entire records, it would be helpful if you would inform us of the periods and area of your health records that you require, along with details which you feel may have relevance (e.g. clinic type, location, dates).
If you are completing this application on behalf of another person, the Practice will require their authorisation before we can release the data to you. The person whose information is being requested should sign the relevant section within the online form. If the patient is a child (i.e. under 16 years of age) the application may be made by someone with parental responsibilities – in most cases this means a parent or guardian. If the child is capable of understanding the nature of the application, his or her consent should be obtained or, alternatively, the child may submit an application on their own behalf. Children will, generally, be presumed to understand the nature of the application if aged between 13 and 16 however, all cases will be considered individually.
The Practice will deal with your request as quickly as possible. The information should be available to you within 1 calendar month of receipt of your accurately completed form and confirmation of consent.
We use a processor, iGPR Technologies Limited (“iGPR”), to assist us with responding to report requests relating to your patient data, such as subject access requests that you submit to us (or that someone acting on your behalf submits to us) and report requests that insurers submit to us under the Access to Medical Records Act 1988 in relation to a life insurance policy that you hold or that you are applying for.
iGPR manager the reporting process for us by reviewing and responding to requests in accordance with our instructions and all applicable laws, including UK data protection laws.
The instructions we issue to iGPR include general instructions on responding to requests and specific instructions on issues that will require further consultation with the GP responsible for you care.
To request a SARS, please complete the below form and bring to the surgery along with identification.
Call Recordings
Patients may request a copy of their call recordings. To help us locate the correct file, specific dates and times of the call may be required. As a practice, we will first offer you the opportunity to attend in person to listen to the recording. However, if preferred, the recording can be sent through a secure NHS network upon request.
Please note that we are unable to provide written transcriptions. Call recordings can sometimes be misinterpreted, and in some cases the audio quality may not allow for an accurate transcription.
The Information Commissioner’s Office (ICO) provides guidance on the personal use of call recordings. If you share a call recording on a private social media account that is only visible to friend s and family, this will usually fall under “personal use”, meaning data protection law does not apply.
However, posting recordings on a public account, where they can be accessed by an unlimited number of people, goes beyond personal use. In these circumstances, you become responsible for complying with data protection law. Once a patient receives a copy of a call recording, they are responsible for how that data is used and ensuring any further sharing is lawful
You are not automatically prohibited from posting call recordings publicly, but you must consider whether the people whose voices are captured would reasonably expect their conversations to be shared in this way.
If a recording of you has been posted online, you can request that it be removed. We advise contacting the account owner first and asking them to delete the recording. In most cases, they should agree to remove recordings of another individual uploaded to their personal account, including recordings of staff members.
If the account owner refuses or does not respond, you can raise a complaint with the ICO. The ICO may then contact the account owner to help resolve the issue. Staff members who are concerned about a recording posted online can also seek advice from the NHS Data Protection Team and submit a complaint to the ICO.
We ask all staff and patients to handle recordings responsibly and respect the confidentiality of everyone involved.
GP2GP
GP2GP allows patients’ electronic health records to be transferred directly, securely, and quickly between their old and new practices, when they change GPs.
Find out more about GP2GP on the NHS website
