As GPs we hold vast amounts of information about our patients. Modern electronic medical records contain material that can be valuable to third parties, as well as to patients. Whether we like it or not, GPs are the gatekeepers for that information. We must allow our patients access to their medical records and ensure their personal details are kept out the reach of unauthorised persons.
Until 1990, the handling of patients' notes was governed by fairly loose guidance on confidentiality and consent. Today, there is well-defined legislation that governs how this information should be handled.
The BMA and GMC have, for many years, encouraged informal access for patients to their records, and doctors have always had the capacity to share with their patient the records that they have made about them. It was not until the Access to Medical Records Act 1990 that patients throughout the UK were given the statutory right to see their health record. This right of access for people to see their records applied only to material held on paper.
The Data Protection 1998 extended the right of access to records held on computer and came into force on 1 March 2000. The act also abolished the stipulation of the earlier act that right of access was only to records made after November 1990.
While 'competent' patients can apply for access to their own records, it is an infrequent occurrence. This might be because most patients realise that they are not in a position satisfactorily to interpret clinical details.
More often, a third party - usually a legal representative - will apply on the patient's behalf with the patient's consent.
Parents can have access to their child's records if it in the child's interests. People appointed by a court to manage the affairs of mentally incapacitated adults may gain access to the patient's notes if it is necessary to fulfil their duties.
There are exemptions to the right of access. Information must not be disclosed if it is likely to cause serious physical or mental harm to the patient or to another person. Access must be refused if the information relates to a third party who has not given consent for disclosure. This applies where the third party is not a health professional who has cared for the patient. Because of this it is vital to check the health record carefully before releasing it.
The key issue is informed consent - in other words that the patient understands the implications of the information being released. Once satisfied that consent is valid, it is vital to ensure that the patient will not come to serious physical or mental harm if the information is divulged. This includes checking that the record does not include details about another person who has not consented to disclosure.
If a patient wishes to see their medical record but does not want a copy, you can charge a maximum of £10. However, if material has been added to the record in the previous 40 days, the patient can see their whole record free of charge. The practice is legally obliged to provide patients with a copy of their notes and can charge a reasonable fee - capped at £10 for records held wholly on computer, and £50 for any that are part electronic and part on paper.
Requests for access to the records of deceased patients are usually in relation to wills or complaints about the patient's treatment. These fall into two categories: those made by an agent acting in the patient's interests (usually a legal representative) and those made by other parties (for example, the police, employers or insurers).
Exemptions are essentially the same as for a living patient. If you are aware that the patient made a stipulation about access to their records before their death, you are obliged to comply.
- Dr Kimber is a GP in Littlehampton, West Sussex and a member of West Sussex LMC
- Ask the Experts, page 50
- Access to patients' notes is governed by the Data Protection Act 1998 - not the Freedom of Information Act 2000.
- The legislation applies to paper records and to information held on computer.
- A GP's duty of confidentiality extends beyond the patient's death.
- Fees for access and record copies can be charged but are subject to strict legal limits.
- Practices should develop a clear protocol to ensure that records are carefully checked before information is released.
- For more information about data protection legislation, visit the Information Commissioner's Office website at www.ico.gov.uk.