The Medical Council explains that:
- patients have a right to get copies of their medical records except where this is likely to cause serious harm to their physical or mental health
- before giving copies of the records to the patient, you must remove information relating to other people, unless those people have given consent to the disclosure.
There are two key pieces of legislation which give patients a right of access to their own medical records - the Freedom of Information Act 2014 (and its predecessors), and the Data Protection Act 2018 (which incorporated into Irish Law the General Data Protection Regulation).
Freedom of Information Act
The Freedom of Information (FOI) Acts apply to public and prescribed bodies, including the HSE. They also apply to GP records relating to medical card holding patients. They do not apply to private hospitals or to a GPs' private patient records. Applications for records made under the Freedom of Information Acts should be made to the HSE, which is the holder of the records.
In theory, anyone can access almost any record held by a public body. In practice, a patient's medical records (as 'personal information') will generally only be released to that patient, or to another person with the patient's consent, or if there is an overriding public interest. A request for disclosure of medical records may be refused if disclosure might be detrimental to the requester's physical or mental health.
Access to the records of minors and deceased persons is provided for under the FOI Act 1997. Guidance notes published by the Minister of Finance expand on what the Act says
Access to records by parents/guardians
The guidance notes explain that records may be made available to the parents or guardians of minors and persons with a disability. In the latter case, where the person with a disability is an adult, the guidance only applies if the person to whom the records relate lacks capacity to act for themselves and exercise their own rights.
Those who make the decision about any request should have due regard to the best interests of the person to whom the records relate - disclosure may not be appropriate if it would be contrary to a patient's best interests. They should, for example, consider what the patient's views are likely to be and whether disclosure could be harmful to them.
While it may fall to an organisation to determine whether disclosure is appropriate, individual clinicians familiar with the records and the patient's circumstances are likely to be asked for their views.
Access to the records of deceased persons
The guidance notes refer to three categories of person who may request information about a deceased person.
- The personal representative (the executor or administrator of the deceased's estate).
- A person appointed by the courts or by statute (for example, if the estate had been taken over by a state agency).
The right of access would be the same for the person in either category, as would have been the case for the patient, if they were still alive.
- The spouse/former spouse, or partner/former partner, or next of kin of the deceased.
In the third category, the ongoing obligation of confidentiality should be weighed against the potential benefit of sharing relevant information with the requester. The guidance notes expand on factors to be considered.
Again, a clinician familiar with the patient may be asked for their input into whether the information should be shared.
Data Protection Act 2018
In the Guide to Professional Conduct and Ethics for Registered Medical Practitioners (Amended) 8th Edition 2019, the Medical Council requires doctors to "comply with data protection and other legislation relating to storage, disposal and access to records" and to "understand the eight rules of data protection".
The DPA, which applies only to the records of living persons, gives all patients (private patients and medical card holders) the right to obtain copies of their medical records. There are a number of possible exemptions to the general right of access. In the context of medical records, the most relevant are:
- information which can identify another individual (commonly known as third part data)
- information provided by another individual in confidence about the patient
- information likely to cause serious harm to the physical or mental health of the patent, if it was disclosed.
While it will fall to the relevant organisation to comply with a request for records, individual clinicians may be asked for their views, particularly in relation to the likelihood of harm if the information were to be disclosed.
Others acting for a patient - a solicitor or insurance company, for example - can access records under the DPA, with patient consent.
If you are asked for your views about disclosing medical records to a patient (or someone else) under the above provisions of the Freedom of Information or Data Protection Acts, and if you are unsure about how to proceed, contact the MDU.
This page was correct at publication on 08/03/2021. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.