Easy read information
Under GDPR and any associated data protection legislation, every living individual has the right to obtain a copy of their personal information held by us. This process is called a Data Subject Access Request, and the person whose records are being requested is the Data Subject.
Under the General Data Protection Regulation (GDPR) and any associated data protection legislation, every living individual has the right to obtain a copy of their personal information held by us. This process is called a Data Subject Access Request, with the person whose records are being requested being the Data Subject.
Health records contain information about your healthcare. They are made by doctors, nurses or other health professionals and can include:
- details about you, for example your date of birth, address, next of kin, gender, language, ethnicity, faith and/or any disability.
- hand-written clinical notes
- electronic clinical notes
- letters to and from other health professionals including GP referrals
- laboratory reports and results
- imaging scans such as x-rays
- printouts from monitoring equipment
- photographs and other recordings
The Trust can only respond to requests for copies of health records held by the Royal Liverpool and Broadgreen University Hospitals including Liverpool University Dental Hospital.
Staff and/or other Records
Other records including Personnel Records, e-mails etc. that we hold about you can also be requested through a Data Subject Access Request, under the terms of GDPR and any associated data protection legislation.
How to apply
The Subject Access Office is not able to offer a ‘drop in’ service, if a personal visit is necessary a prior appointment must be made (Please see contact details below).
To help us to deal with your application you are asked to use the correct Request form. This will help us deal with your request more speedily and accurately as it contains guidance on the information you need to tell us about.
There are two different application forms which can be downloaded here:
If you require a printed version of either of the application forms, or require assistance in completing the application form please contact the Subject Access Office by e-mail: SAR@rlbuht.nhs.uk or by telephone: 0151 706 2681
Completed application forms can be returned by email or post.
(The Royal Liverpool and Broadgreen University Hospitals Trust uses encryption to protect email traffic. If your email provider does not support encryption, you should be aware that any emails or forms you send to us may not be protected in transit..)
Postal Address: Subject Access Request Office
Patient Access Department
You can also hand deliver completed applications at the main reception of the Royal Liverpool University Hospital, Prescot Street, Liverpool, L7 8XP.
Please complete the relevant form and remember to tell us the period of time which you require the information to cover e.g. Admission from 01/04/2018 to 08/04/2018, ED Attendance on 01/04/2018 etc.
There is no requirement for you to give a reason why you wish to access the record which we hold but the information is helpful in providing you with an appropriate and speedy response.
A person acting on the behalf of the data subject, e.g. a relative, a carer, a solicitor etc. may apply for a copy of the records which we hold, but must have obtained informed, explicit and written consent from the data subject, have lasting Power of Attorney, or be an Independent Mental Capacity Advocate (IMCA). Such a request would be dealt with in exactly the same way as a request from the Data Subject themselves. The applicant will be given access to the information that would otherwise have been made available to the Data Subject.
If there is any doubt as to whether the Data Subject has the mental capacity to give consent, the Trust must refer to the Mental Capacity Act 2005. The mental capacity assessment and outcome must be recorded. If the Data Subject is assessed as lacking mental capacity to give consent, the record holder and/or the Caldicott Guardian will consider whether:
- Releasing the information would be lawful, seeking legal advice if necessary
- The applicant is acting in the best interests of the data subject
If a decision is taken to release the information, then the reasons leading to the decision will be recorded
You must complete the section of the application form containing the written consent of the Data Subject (or their legal representatives) for the release of information.
Please ensure you enclose a copy of your identification:
- Driving License
- Bus Pass
- Other form of formal photographic identification
Please do not send your original identification to us in the post
Access to the health records of deceased persons
GDPR does not have any provision for access to the health records of the deceased this is governed by the Access to Health Records Act 1990. Please note:
‘The duty of confidentiality obligations by health professionals continues beyond death’ Guidance for Access to Health Records Requests, February 2010, DH.
Who can apply for copies of a deceased person records?
The personal representative (executor or administrator of the estate) of the deceased or any person who may have a claim arising out of the patient’s death may apply for access.
Where an application is being made on the basis of a claim arising from the deceased’s death, applicants must state the reason the records are needed to support the claim.
For a personal representative/legal executor a copy of the Grant of Probate (if you are the Executor of the will), or a copy of the Grant of Letters of Administration (if you are the Administrator) must be provided to us.
Evidence of right to access and identification is required for all applications
For a relative with a claim against the estate arising from the death of the deceased person, a statement to say why you should have access to the health record must be provided within your application. This would help us to assess your ‘right to access’ if you indicate a very broad outline of your concerns. Any information released will only relate to the claim or potential claim.
Duty of confidentiality
Access is not allowed if the patient indicated while alive that they did not wish their information to be given to a particular person(s). Consideration will also be given to expectations that information created or given in confidence at the time of treatment and/or care would remain protected.
There are no fees to view or for obtaining a copy of the Information we hold about you.
When the written application has been received containing all the information needed to process the request, then this must be completed within one month. If the request is complex or numerous then this period can be extended by a further two months. If this is the case then we will contact you to explain why the extension is necessary.
Review and consent from health professional
For Health Records, before information is released, the Senior Health Professional with responsibility for the patient will authorise the release of records.
There are certain circumstances where information can be withheld from a subject access request. Access can be denied or limited where:
- The information might cause serious harm to the physical or mental health or condition of the patient, or any other person
- Provision of access would disclose information relating to, or provided by a third person who had not consented to disclosure
- The Trust is not obliged to inform that information has been withheld
Generally, a person with parental responsibility has the right to apply for access to a child’s health record; however there may be exceptions to this.
How we supply the information to you
Supplying records is customarily provided electronically either on password protected CD and sent by Royal Mail post or via secure email. Passwords for CDs will be sent separately to you via email or post.
The subject Access Team cannot comment or guide on the content of records. If you have a query, a discussion with the Trust’s Data Protection Officer may be recommended to advise you about talking to a suitable health professional / manager.
Information is provided directly from the data systems and cannot be retyped by the Subject Access Team as this may compromise the integrity and accuracy of the information held.
Some information within the record may be obscured / removed from the copy. For more information about this please see the section on Withholding Information.
Disputed or inaccurate information
Once you receive your record, if you believe any information recorded is inaccurate, you have the right to have the information corrected. If you dispute the accuracy but the person who has created the information e.g. Clinician, manager etc. maintains the information is correct, the information will remain unchanged but a note will be added to the record, recording the nature of the dispute.
There may be exceptional circumstances when information should be amended or removed, agreement will always be sought from the Trust’s Caldicott Guardian (Health Records) and/or the Data Protection Officer (non-Health Records), alongside robust evidence of the decision making around removal of information.
Examples where information may be removed or amended are:
- Information not about the Data Subject, and/or may put them or others at risk
- A Data Subject has asked for the amendment and this has been agreed by the person who created the information e.g. Clinician, Manager etc.
If you would like to challenge the information we hold about you, please contact the Data Protection Officer (please see contact details in the Complaints and concerns section below).
Subsequent Data Subject Access requests
The Trust does not have to comply with a subsequent request if we have already complied with an identical or similar request by the same individual, unless a reasonable interval has elapsed. In deciding what a reasonable interval is, the nature of the data, why the data is used and the frequency with which the data is altered will be taken into consideration.
Complaints and concerns
An individual has the right to make a complaint under the Trust’s Complaints Procedure. If you have a complaint about how we have handled your request or regarding the Information we hold about you, please contact the Data Protection Officer by e-mail: DPO@liverpoolFT.nhs.uk
An individual also has the right to make a claim for judicial review if you think you have been directly affected by an unlawful act or decision of an NHS body or local authority.
The Information Commissioner’s Office is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals:
The Information Commissioner
Wycliffe House, Water Lane
Telephone: 01625 545700