Rights of access to clinical records


This article was originally published in 2013. For up-to-date advice on this topic, please see our more recent guidance and advice articles.

GP practices need a consistent approach to requests for clinical records from patients and their representatives, says Dr Shelagh Turvill, our medico-legal adviser.

A patient's legal right to apply for access to their medical records has long been established but practices are not always confident about how they should respond, particularly when the request is from a third party or if the patient has died.

They are not alone. The Information Commissioner's Office (ICO) says that "many organisations still need to improve their processes for dealing with [access] requests". As well as publishing a code of practice on responding to requests for personal information, the ICO is now reviewing the information organisations provide on their websites about access requests. It plans to publish its findings next year.

If you are a data controller, we advise you to check that your practice's policy on records access is easily accessible on the practice website and available to any patient on request. This is in line with the Care Quality Commission's Essential standards of quality and safety (for England only) which says that those using a service should be confident that "they, or others acting on their behalf …can access, and where appropriate, contribute to the record".

Here are some of the areas that your access policy needs to cover to help ensure your practice complies with its legal and ethical obligations (and avoid complaints). We also recommend you regularly review the policy and ensure staff understand and follow the procedures it sets out.

Records ownership

Patients do not own their medical records and are not entitled to keep the originals but under the Data Protection Act 1998, they do have the right to view their records and have copies of them.

Who makes the request?

In most cases this will be the patient but you will still need to confirm their identity to ensure you do not breach patient confidentiality.

If a third party submits an access request on behalf of a patient (such as a solicitor), they should be asked for evidence of their authority to act for the patient. This includes the patient's written consent or the necessary legal authority, for example a certificate of Lasting Power of Attorney. Where someone with parental responsibility submits a request for the records of a competent child, the child's consent should be sought.

Access limitations

Access can be limited or denied if it would be "likely to cause serious harm to the physical or mental health or condition of the data subject or any other person", unless it is information of which the patient is already aware. In such cases, there must first be an assessment by the doctor responsible for the person's clinical care and we advise you to make a record of this in case the person requesting access later makes a complaint to the ICO or applies for a court order. In circumstances like this, you can seek advice from our medico-legal advice line.


You should respond to subject access requests within 40 days of receiving them or sooner if possible.


You can charge a maximum of £50 for copies of paper records or £10 for electronic records (including postage). Ensure patients are aware of charges before proceeding. However, it should be free for patients to inspect medical records which are held manually if they have been updated in the last 40 days.


If a copy of the record is requested, this should be sent by secure means such as recorded delivery.

If the patient or their representative wants to directly inspect the records, it's sensible to consider whether this should be supervised by a health professional or administrator to protect the confidentiality of other records.

The extent of disclosure

You can 'black-out' part of the record or withhold specific documents which relate to third parties, unless you are able to get consent from the person named. Information about the patient written by other healthcare professionals involved in their treatment may be disclosed. This can be a complex area and you can seek advice from our medico-legal advice line before proceeding with the request.


You will need to make a reasonable adjustment for disabled patients who find it impossible or unreasonably difficult to make a subject access request in writing, for example, by accepting their verbal request.

The ICO also expects you to help patients understand the contents of their records. For example, you may need to spell out acronyms and be prepared to explain diagnoses and treatments in more detail.

Correcting factual errors

Patients can question the content of their records but an entry should not be amended simply because they do not agree with or like it. If factual corrections are made, it should be immediately obvious who made the amendment and the time and date it was changed.

Requests relating to deceased patients

These usually relate to concerns about the treatment the patient received (if you suspect this is the case then contact our medico-legal advice line), an insurance company investigation or where there is a dispute about the patient's will and their testamentary capacity.

Rights of access to the records of deceased patients are covered by the Access to Health Records Act 1990 and the Access to Health Records (Northern Ireland) Order 1993 rather than the Data Protection Act 1998. The right to make a request under the Act applies to the deceased's personal representative, the executor or administrator of their estate, or any person who may have a claim resulting from their death. Applicants should be required to make their request in writing, providing evidence of their identity and in support of their claim.

Other access requests will need to be considered on a case-by-case basis, bearing in mind the patient's right to confidentiality extends beyond their death. If the patient had previously asked that access should not be given, a note should have been made on their records and their wishes should usually be respected. However, in many cases the patient will not have left any indication of their wishes and you will need to make a judgement based on the content of the record, the reason and source of the request, and your knowledge of the patient's wishes. It's also important to consider the extent of the disclosure. For example, where the applicant has a claim arising from the patient's death, access should be limited to relevant information. As with other medical records, the practice may need to withhold information if it might cause serious harm to an individual or if it relates to a third party other than a health professional who has not consented.

Call our medico-legal advice line

Our medico-legal team are on hand to advise you with queries regarding disclosing records.

Call 0800 716 646 or email us at advisory@themdu.com

Lines are open 9am-5pm Monday to Friday. We provide an on-call service for medico-legal emergencies or urgent queries 24 hours a day, 365 days a year.

This article originally appeared in the print version of inpractice December 2013 issue entitled 'Rights of access'

Previous article Next article

This page was correct at publication on . Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.