[DAYS_LEFT] days left of your Medeconomics free trial

Subscribe now

Your free trial has expired

Subscribe now to access Medeconomics

GDPR: Can patients amend their records?

With the General Data Protection Regulation (GDPR) about to come into force, practices could find themselves fielding more queries from patients concerned about the contents of their medical records. The MDU's Dr Carol Chu explains patients' rights.

Patient records support clinical decision-making and continuity of care, as well as having an important medico-legal purpose in the event of a complaint or claim. It is in the interests of GPs, practices and patients to accurately document what took place during a consultation, including all relevant information, from history and differential diagnosis, to the patient's concerns and expressed wishes.

However, there will inevitably be instances where the record of a consultation or episode of treatment could be upsetting for a patient or where they disagree with their GP’s clinical opinions.

GDPR

The MDU regularly receives queries from GP members about this issue. Growing public awareness about the rights of ‘data subjects’ and the enactment of the General Data Protection Regulation (GDPR) on 25 May 2018 means that practices need to know their legal obligations in these situations. 

In fact, the basic principles of GDPR are similar to those set out in the Data Protection Act 1998 and so most GPs will already be largely compliant. However, the new legislation requires greater transparency from organisations who hold personal data and makes the rights of data subjects much more explicit, including the right to correct inaccuracies (Article 16 of the GDPR).

Managing requests for rectification

Practices need to respond appropriately when patients (or their representatives) exercise their legal rights. The Information Commissioner’s Office (ICO) addresses this in its Guide to the GDPR1 which is summarised below:

  • Requests for rectification can be made verbally or in writing.
  • Requests can be made to any part of an organisation rather than a specific person.
  • A request should be considered valid as long as the individual has challenged the accuracy of their data and has asked you to correct it. There is no need for individuals to reference the GDPR.
  • It is good practice to have a policy for recording details of requests and to check you have understood them. The ICO recommends keeping a log of verbal requests.
  • You cannot charge a fee to comply with a request for rectification unless the request is manifestly unfounded or excessive when it is possible to charge a ‘reasonable fee’ for the administrative costs. However, you must be able to justify your decision (it’s a good idea to seek advice from your MDO in these circumstances). There is no definition of what constitutes a manifestly unfounded or excessive request or a reasonable fee.
  • You must act upon the request without undue delay and at the latest within one calendar month of receipt. This may be extended by a further two months when the request is complex but you must keep the requestor informed.

Amending medical records

Patients should be able to report factual inaccuracies or question the content of the records but they do not have the right to alter their contents because they are upsetting or they disagree with them.

In its FAQs for small healthcare organisations,2 the ICO notes that the right of rectification does not mean that doctors are required to remove their clinical opinions.

It says: ‘It is often impossible to conclude with certainty…whether a patient is suffering from a particular condition. An initial diagnosis (or informed opinion) may prove to be incorrect after more extensive examination or further tests. Individuals may want the initial diagnosis to be deleted on the grounds that it was, or proved to be, inaccurate. However, if the patient’s records accurately reflect the doctor’s diagnosis at the time, the records are not inaccurate, because they accurately reflect a particular doctor’s opinion at a particular time. Moreover, the record of the doctor’s initial diagnosis may help those treating the patient later.’

You should restrict processing personal data while you are verifying the record’s accuracy whether or not the patient has exercised his/her right to restrict processing.

You cannot alter a record that is an accurate representation of the situation at the time the note was written, however you can make an additional note to record that the patient disagrees with the opinion.

If a factual correction is necessary, such as a misspelt name or incorrect date of birth, it must be obvious who made the amendment and when (computerised records usually create an audit trail).

Refusing requests

If you refuse a request for rectification, you must explain why to the patient and tell them of their right to complain to the practice and/or the ICO.

The ICO also recommends keeping a note, indicating that the patient challenges the accuracy of the information in the records and their reasons for doing so.

Ultimately, a patient's record should be complete and accurate to ensure they receive appropriate care.

Informing other organisations

If you have disclosed the personal data to others, such as secondary care, you should contact the recipients, if possible, to inform them of any amendments to the data.

  • Dr Chu is a medico-legal adviser at the MDU
Read more

References

  1. ICO. Right to rectification, accessed 5 April 2018.
  2. ICO. General Data Protection Regulation (GDPR) FAQs for small health sector bodies, accessed 5 April 2018.

Have you registered with us yet?

Register now to enjoy more articles
and free email bulletins.

Sign up now
Already registered?
Sign in

Database of GP Fees



Latest Jobs