Introduction
Under the General Data Protection Regulations 2018, patients can request the information we hold about them, just like any other organisation. All GP practices in England are required to provide online access to more detailed medical records to registered patients. For more information about information governance and patients’ rights see the IG Homepage.
Procedure
1️⃣ Receiving the request
- Most requests from patients and third parties come in writing via email. They should be automatically sent to the ‘Medical Reports’ folder of the Generic Surgery Inbox. They be passed to the Clinical Admin team on the same day that the request is received.
- If someone makes a verbal request to Reception or a clinician complete the online medical reports request form (see Handling Medical Reports Requests)
- SNOMED - Please add the most appropriate SNOMED code in the smae consultation
- 647551000000110 – Patient requests copy of medical record (free text in if patient representative)
- 2159182015 – Patient record requested by solicitor
- 2129781000000118 – Copy of clinical record requested by insurance company
2️⃣ Assessing the request
Assess the request to ensure that it meets the requirements for a SAR, and that we have the necessary information to fulfil the request.
- Checklist - Work through the ‘triage’ checklist on the Asana task, ignoring tasks related to payment & invoicing
- EMIS Records - Add a copy of the patient’s request to EMIS, restricting the view from the patient’s record
SARs are generally free of charge.
If the SAR is ‘excessive’ a ‘reasonable’ fee can be charged (this should be handled on a case-by-case basis)
3️⃣ Assembling the report
Once it is confirmed that the SAR can be completed, it should be prepared, including any necessary redactions.
- Include only what the patient is asking for → this could include particular dates or certain types of consultation
- Do not include any consultations / documents that are related only to a third party
- Do not include any sensitive consultations / documents that have restricted visibility or are hidden from patient’s online view
- Redact any sensitive or third party information within otherwise relevant consultations and documents
- Check for any consultations / documents that are not hidden, but may contain sensitive information → the following keywords may be helpful to search on EMIS and Adobe Acrobat Pro to find information that should be redacted:
- abus-
- violen-
- assault
- safeguard-
- social work
- child protection
- mother / mum
- father / dad
- names of household members
- domestic
- vulnerable
Make a note of what has been redacted, and why, then attach this to the patient’s record.
Note: There are some file types that cannot be directly exported from EMIS.
- NHS 111 reports (.CDAX files)
- Kettering reports (.ket)
- Some word files (.rtf or .txt)
To export these files: open the report → print as PDF
4️⃣ Preparing for review & dispatch
If checking with the Caldicott Guardian:
- Save a copy of the draft with the original request on EMIS, and add a comment to the consultation: ‘Draft - do not print’. Restrict the visibility of the consultation.
- Inform the Caldicott Guardian. Send them a task, add medical reports team as a recipient, include the date & name of draft. Also send them a message on Teams to notify them of the task.
- Make the Caldicott Guardian aware of the timescale of the request so that they can prioritise.
After the Caldicott Guardian approves the SAR, send it to the patient. Normal SARs do not need to be reviewed by GPs and can be sent directly to the requestor. 👇
Sending the SAR
Generally, completed SARs are sent via email, unless the patient / third party has specifically requested otherwise (e.g. they have asked for us to send a physical copy via post, or to leave a physical copy at Reception to collect).
Make sure that you add the relevant SNOMED code when the SAR is sent:
- 2129861000000118 – Copy of clinical record given to patient (if collected from surgery)
- 2129901000000113 – Copy of clinical record sent to patient (if emailed)
- 2129941000000111 – Copy of clinical record sent to solicitor
- 2129821000000114 – Copy of clinical record sent to insurance company
- Right of access - ICO
- How to deal with a request for information: a step-by-step guide | ICO
- Access to health records - BMA
- Further information on what you may want to redact in a SAR → What other exemptions are there? | ICO
- Medical Reports