Subject access requests (primary care)

This module has been updated to reflect the GMC's 'Good medical practice' (2024) guidance.

This e-learning module is part of our series on information governance and will help you recognise and understand how to deal with subject access requests from patients, although many of the principles in the module are applicable for subject access requests from employees.

By the end of this module, you should:

• be able recognise a subject access request from a patient
• know when a patient's right to access their records applies
• know the timescales for responding to requests
• understand how to handle subject access requests from third parties
• identify and know how to redact (remove) third-party information from records before disclosure.

This course is aimed at GPs, practice managers, senior administrators and anyone else who has responsibility for handling subject access requests. The practice is likely to be a data controller of both patient data, and of other personal data such as personal data related to the practice's function as an employer.

The module uses examples and interaction questions to guide you through and help consolidate your learning, with a short quiz at the end to check your knowledge and understanding.

Not a member?

Find out more about the benefits of membership and how to join.