Home > Topics > Ethical Practice > Data Protection Act 1998 > Patient Access to Records

Patient Access to Records

EthicalSince 1990 [1], patients have had the same rights of access to their computerised health records (and radiographs) as their manual records.

Under the Data Protection Act 1998 (DPA) [2], individuals have a right to have a copy of the personal information held about them on computer and in manual filing systems. This is known as the right of subject access. Parents also have rights to access their children’s records if it is in the child’s interest. Although the age of legal capacity in Scotland is 16 years [3], younger children can have sufficient capacity and maturity to have an input into decisions that affect them. The DPA recognises this and allows a young person of 12 years or more in Scotland, with sufficient capacity and maturity, to exercise their rights under the Act. The ‘data controller’ (i.e. the dentist) must make a judgement if a child or parent requests records. A solicitor can request access with the consent of his client.

Appoint someone in the dental team to deal with subject access requests made under the DPA.

If you receive a subject access request:

  • deal with the request promptly and no later than 40 days following receipt;
  • ask for the request for access to dental records to be made in writing;
  • verify the identity of the person making the request because the right of access is to one’s own personal information only;
  • verify whether the patient just wants to see their record or whether they would like a copy; you can charge a fee in some cases (see below for details);
  • be prepared to offer an explanation of what is written in the record to make it understandable to the patient.

NB: There are some circumstances where you do not need to supply personal information and some circumstances where you do not need to give information about other people. Contact the Data Protection Helpline [4] for further advice. You might also wish to consult with your defence organisation prior to releasing records.

Charging for responding to subject access requests

  • If the patient records are paper or a mixture of paper and computer records, and the patient just wants to look at them, no fee may be charged if the records have been added to during the past 40 days. If the records haven’t been added to in this time, a maximum fee of £10 may be charged.
  • If the patient wants a copy of any part of their records, a maximum fee of up to £50 may be charged. The cost depends on the size of the records and whether there are documents such as x-rays to be copied.
  • If records are held solely on computer, a maximum fee of £10 may be charged to allow the patient just to see their records or to give the patient a copy of their records.

Sources of Information

  1. Access to Health Records Act 1990. (1990) www.legislation.gov.uk/ukpga/1990/23/contents
  2. Data Protection Act 1998 (1998) www.legislation.gov.uk/ukpga/1998/29/contents
  3. Age of Legal Capacity (Scotland) Act 1991. (1991) http://www.opsi.gov.uk/acts/acts1991/ukpga_19910050_en_1
  4. (UK) Information Commissioner’s Office