Health and care records are confidential so you can only access someone else's records if you're authorised to do so.
To access someone else's health records, you must:
- be acting on their behalf with their consent, or
- have legal authority to make decisions on their behalf (power of attorney), or
- have another legal basis for access
A request for someone's health and care records should be made directly to the health and care organisation that provided the treatment, such as:
- GP surgery
- hospital
- optician
- dentist
- care home
This is known as a Subject Access Request (SAR), as set out by the Data Protection Act of 2018.
Many healthcare providers have SAR forms that you can complete and return by email or by post.
Here is an example of an SAR form on the North Bristol NHS Trust website.
You will need the patient or service user's written consent if you wish to access their record.
Where written consent is not possible, other arrangements will be necessary.
Under the Data Protection Act, requests for access to records should be responded to as soon as possible, and within 1 month at the latest.
A healthcare provider can refuse to supply some of your request if, for example:
- it is likely to cause serious harm to the physical or mental health of any individual
- the information you have asked for contains information that relates to another person
If your request is rejected, or you have a complaint about the process, you can complain to the healthcare provider.
If you are still not satisfied, you can make a complaint to the Information Commissioner's Office.
If a person does not have the mental capacity to manage their own affairs and you are their attorney, you can apply for access to their health and care records.
This would apply, for example, if you have a Lasting Power of Attorney with authority to manage their property and affairs.
The same applies to a person appointed to make decisions about such matters by the Court of Protection in England and Wales.
A person with parental responsibility will usually be entitled to access the records of a child who is aged 11 or younger.
Children aged 12 or older are usually considered to have the capacity to give or refuse consent to parents requesting access to their health records, unless there is a reason to suggest otherwise.
Although British Medical Association guidance says that every reasonable effort must be made to encourage the child to involve parents or guardians.