With rising divorce rates, it is increasingly common for GP practices to receive requests from estranged parents for disclosure of medical records, or other confidential information, regarding their child.
All such requests must be handled sensitively and correctly. Either parent might take issue with a disclosure or a refusal to disclose and make a complaint as a result.
It is important for doctors to be sure of the law and their rights and responsibilities when responding to such a request. These are the factors to take into account.
Anyone with parental responsibility for a child has a right to seek access to that child's medical records. Parental responsibility is defined in the Children Act 1989 as 'all the rights, duties, powers, responsibilities and authority which by law a parent of a child has in relation to the child and his property'.
Birth mothers automatically have parental responsibility; so do married fathers. However, in both cases, this can be removed by the court.
When the father is not married to the child's mother, his parental responsibility will depend on when the child was born. Unmarried fathers who are named on the birth certificate automatically have parental responsibility if the child was born on or after:
- 1 December 2003 in England and Wales
- 4 May 2006 in Scotland
- 15 April 2002 in Northern Ireland.
Unmarried fathers who are not named on the birth certificate do not have automatic parental responsibility. However, they can acquire parental responsibility if they obtain a Parental Responsibility Agreement from the child's mother, or a Parental Responsibility Order from the court.
Step-parents and civil partners can acquire parental responsibility in the same way as unmarried fathers.
Parents do not lose parental responsibility if they divorce. However, it can be restricted by the court. If a child is adopted, the birth parents will lose parental responsibility for their child.
Representatives of the local authority have parental responsibility for a child who is in care.
A child's testamentary guardian, special guardian or other person given a residence order also has parental responsibility.
See also our quick guide to parental responsibility.
The child's capacity to consent
Although someone with parental responsibility can seek access to a child's medical records, the child may have the capacity to decide for himself or herself whether they want the information to be disclosed. The GMC's guidance 0-18 years explains doctors should take into account the views of a child who has capacity to be involved in such decisions.
Usually, the parents will have the child's best interests at heart and the doctor should then encourage the child to involve them in their care and allow them access to the records.
A child or young person with capacity has the legal right to access their own health records, and to allow or refuse* access by others, including their parents.
In assessing whether a young person has capacity, a doctor must ensure that the child understands the nature, purpose and possible consequences of agreeing to, or refusing, disclosure.
To have capacity to make a specific decision, the young person must be able to:
- understand, retain, use and weigh the information they are given
- communicate their decision.
Capacity does not entirely depend on the child's age. It rests more on their ability to understand and weigh up options.
In England and Wales, a young person of 16 and over can be presumed to have capacity to consent. Below this age, they may have capacity, depending on their maturity.
In Scotland, a child over 12 years old is presumed to have capacity to consent, although they could achieve capacity earlier or later than this.
The child's best interests
GMC guidance states that a doctor may allow someone with parental responsibility to access a child's medical records if the child or young person consents, or if he or she lacks capacity and it does not go against the child's best interests.
However, the guidance also says: 'If the records contain information given by the child or young person in confidence you should not normally disclose the information without their consent'.
It may also be justifiable to disclose confidential information about the child to a third party who does not hold parental responsibility providing this is clearly in the child's best interests.
Should you tell the other parent?
When one parent asks the practice to disclose information about the child, there is no obligation to seek consent from the other parent, or to tell the other parent that you have received the request.
However, it may be wise to make sure the other parent is aware of the request, so that you can take into account any objection they may make and the reasons for it.
Proof of parental responsibility
If you feel there is any doubt that the person making the request has parental responsibility for the child, you can ask to see a copy of the child's birth certificate and/or the parents' marriage certificate, or a letter from the person's solicitor confirming their parental responsibility status.
Remember that it is possible for parental responsibility to have been removed after the date of these documents.
Third party information
Third party information may appear in the child's records. Before disclosure, you should consider seeking consent from the third party. If you cannot obtain consent, the information may need to be anonymised or appropriately redacted.
Data protection law allows data controllers limited discretion to disclose third party information.
Generally, if you cannot comply with a request to see the records without disclosing information relating to another individual who can be identified from that information, then you may comply with the request if:
- the third party has consented to the disclosure; or
- it is reasonable in all the circumstances to comply with the request without the consent of the third party.
* You might receive a request to override a competent child’s refusal to share the content of their clinical records in the public interest. If this happens, members are advised to contact the MDU.
Questions and answers
I don't know the estranged father. Do I need proof of identity?
You have a responsibility to satisfy yourself that the person requesting access has the right to do so, on the basis of having parental responsibility. This may require you to ask to see proof of identity, and/or evidence of parental responsibility.
The father is also a patient at the practice. The mother says he doesn't have parental responsibility though he insists he does. Can we ask the mother to provide proof that the court has withdrawn his parental responsibility?
Your priority is to act in the best interests of the child at all times. Where you have reason to doubt that an individual currently has parental responsibility, it is advisable to seek evidence. If the mother says it has been removed by the court, then you can ask the mother to show you evidence of this.
The father wants us to let him know every time the child attends the surgery. Do we have to comply with his request?
A father with parental responsibility has a right to request access to the records, but the practice is not obliged to inform him each time the child attends, and should encourage the parents to communicate with each other, in the interests of their child. However, you could consider a compromise, in the best interests of the child, by asking the father to request an update at intervals, or by providing him with a summary of attendances at timely intervals. This would be particularly appropriate if the child spends time in the care of the father, and has ongoing health issues.
The father has just been released from prison. The mother thinks he may use disclosure of their young child's records to find out where she lives. She feels vulnerable to physical attack. If he contacts the surgery, what can we say?
Although a father with parental responsibility has a right to request disclosure of his child's records, information should be withheld if disclosure would be contrary to the best interests of the child or if disclosure could lead to serious harm or be unreasonable to a third party. It would be entirely reasonable to remove the registered address from any copy records disclosed in this situation.
- Does the person requesting information have parental responsibility for the child? If in doubt, ask to see a copy of the child's birth certificate and/or parents' marriage certificate, or a solicitor's letter.
- Do you have the child's consent? Applies to young people with capacity only.
- Would it be contrary to the child's best interests to disclose? Applies to young people lacking capacity.
- Have you considered informing the estranged partner?
- Is there third party information in the records? If so, you should consider obtaining consent from the third party.
- If no consent can be obtained from the third party, can the information be anonymised or appropriately redacted?
- The child's GP should be involved in the decision about whether or not to disclose.
- All decisions should be recorded in the medical notes.
A practice manager received a call from a man claiming to be the father of a 10-year old patient. He asked to see the child's records. The child lives with her mother, but according to the caller, stays with him every other weekend. The caller sent in a copy of the child's birth certificate, which shows him to be the father. The practice manager rang the MDU advisory helpline to ascertain whether they need permission from the girl's mother to disclose the records.
At the age of 10 it is unlikely that the child will have capacity to make a decision about who has access to her records, but this is a matter that should be considered by the practice and it could be an important factor in the case of an older child.
The next key question is whether the father has parental responsibility. If he has, then he has a right to request the records. As the child lacks capacity, it would then be for the child's GP to decide whether disclosure would be in her best interests. It would be advisable to let the mother know about the request and what you intend to do, but this is not a requirement.
If the father does not have parental responsibility, the mother's consent to disclosure should be sought. If she declines, then her reasons should be considered, but it may be in the child's best interests to disclose relevant information to the father, as he has responsibility for the child every other weekend.
The father may not automatically have parental responsibility even though his name is on the birth certificate. In the case of a child born before 1 December 2003 (in England and Wales), being named on the birth certificate does not necessarily mean the father has parental responsibility, if he has never been married to the mother. However, he could have acquired parental responsibility through the courts, through a parental responsibility agreement with the mother, or by subsequently marrying. The practice might therefore wish to ask him to provide further evidence – a court document or letter from a solicitor – before considering whether to disclose.
A GP received a letter from solicitors acting on behalf of the father of a 13-year old patient with cystic fibrosis. The letter requested disclosure of the child's medical records. The father was in the process of divorcing the patient's mother who didn't want the father to contact his daughter, on the grounds that he was unable to care for the child properly as he did not understand the girl's condition.
The GP believed the patient had a mature understanding of her condition, and that it would be helpful for the father to see the records. She rang the MDU for advice.
The MDU adviser explained that even though the parents were divorcing, the father would still have parental responsibility for his daughter. He would have the same rights as the mother to request access to the child's medical records.
However, there is no absolute right for parental access to records. Rather, this would be determined by what is in the best interests of the child. If the child has capacity, she can usually allow or prevent access to her records by others, including her parents.
In Scotland, anyone aged 12 or over is legally presumed to have such capacity, while in England the age is 16 years. However, capacity depends more on a patient's ability to understand and weigh up options than on age.
The adviser suggested that the GP might see the patient on her own, to assess her capacity and to explore her views about sharing information with her father. All discussions should be fully documented in the child's records.
This guidance was correct at publication 21/05/2018. It is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.