Understanding access to medical records, and the appropriate processes and guidelines around doing so, is a key aspect of any clinician's work. As the regulator for doctors in the Republic of Ireland, the Medical Council explains that:

patients have the right to get copies of their medical records. Where the contents of this record may pose a risk of serious harm, access can be restricted.

There are two key pieces of legislation that give patients a right of access to their own medical records the Freedom of Information Act 2014 (and its predecessors), and the Data Protection Act 2018 (which incorporated the General Data Protection Regulation into Irish law).

Freedom of Information Act

The Freedom of Information (FOI) Acts apply to public and prescribed bodies, including the HSE. They also apply to GP records relating to medical card holding patients. They do not apply to private hospitals or to a GP's private patient records. Applications for records made under the Freedom of Information Acts should be made to the HSE, which is the holder of the records.

In theory, anyone can access almost any record held by a public body. In practice, a patient's medical records (as 'personal information') will generally only be released to that patient, or to another person with the patient's consent, or if there is an overriding public interest. A request for disclosure of medical records may be refused if disclosure might be detrimental to the requester's physical or mental health.

Access to the records of minors and deceased persons is provided for under the FOI Act 1997. Guidance notes published by the Minister of Finance expand on what the Act says.

Access to records by parents/guardians

The guidance notes explain that records may be made available to the parents or guardians of minors and persons with a disability. In the latter case, where the person with a disability is an adult, the guidance only applies if the person to whom the records relate lacks capacity to act for themselves and exercise their own rights.

Those who make the decision about any request should have due regard to the best interests of the person to whom the records relate - disclosure may not be appropriate if it would be contrary to a patient's best interests. They should, for example, consider what the patient's views are likely to be and whether disclosure could be harmful to them.

While it may fall to an organisation to determine whether disclosure is appropriate, individual clinicians familiar with the records and the patient's circumstances are likely to be asked for their views.

Access to the records of deceased persons

The guidance notes refer to three categories of person who may request information about a deceased person.

The personal representative (the executor or administrator of the deceased's estate).
A person appointed by the courts or by statute (for example, if the estate had been taken over by a state agency).

For the above, the right of access would be the same for the person in either category, as would have been the case for the patient, if they were still alive.
The spouse/former spouse, or partner/former partner, or next of kin of the deceased.

In the third category, the ongoing obligation of confidentiality should be weighed against the potential benefit of sharing relevant information with the requester. The guidance notes expand on factors to be considered.

Again, a clinician familiar with the patient may be asked for their input into whether the information should be shared.

Data Protection Act 2018

In the Guide to Professional Conduct and Ethics for Registered Medical Practitioners (9th Edition, 2024), the Medical Council requires doctors to "comply with data protection and any other legislation and regulations relating to maintenance, storage, disposal and access to records".

The DPA, which applies only to the records of living persons, gives all patients (private patients and medical card holders) the right to obtain copies of their medical records. There are a number of possible exemptions to the general right of access. In the context of medical records, the most relevant are:

information which can identify another individual (commonly known as third part data)
information provided by another individual in confidence about the patient
information likely to cause serious harm to the physical or mental health of the patent, if it was disclosed.

While it will fall to the relevant organisation to comply with a request for records, individual clinicians may be asked for their views, particularly in relation to the likelihood of harm if the information were to be disclosed.

Others acting for a patient - a solicitor or insurance company, for example - can access records under the DPA, with patient consent.

If you are asked for your views about disclosing medical records to a patient (or someone else) under the above provisions of the Freedom of Information or Data Protection Acts, and if you are unsure about how to proceed, contact the MDU.

Access to records in the Republic of Ireland

Related articles

Paying too much for your indemnity?