Under the GDPR / Data Protection Act 2018, you have the right to make a request to see or obtain copies of the information the organisation holds about you. This is referred to as a subject access request. Under the Act you are entitled to be told if any personal information is held about you, and if it is, to be given:
- a copy of the information in permanent form, if requested
- an explanation of any technical or complicated terms, for example, medical terminology or abbreviations
- an explanation of where we got your information from
- a description of the information, the purposes for processing the information, who we are sharing the information with, if anyone, and how long we will be keeping the information
- information on the safeguards in place for any data being transferred outside of the European Union
- an explanation of the logic involved in any automated decisions (if you have specifically asked for this)
- information regarding your other rights under the GDPR / Data Protection Act 2018.
To view or access a copy of your health records please email: kmicb.ig@nhs.net, giving as much detail as possible on the record(s) you wish to access.
We will ask you for proof of your identity and proof of your address. The organisation then has one month to respond to your request, from receipt of the above information.
The organisation is able to extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, the organisation will inform you within one month of the receipt of the request and explain why the extension is necessary.
As noted above, the organisation holds limited health information about you where it can use this for direct care purposes. You may also need to contact those NHS organisation(s) where you are being, or have been treated.
Further information on data subject access requests can be found via the Information Commissioner's Office (ICO). More information about how we use your information can be found here.
You may be able to access the records of your child/children. However, if a clinician has stated he/she believes your child/children to be competent to make their own decisions, then you will not have an automatic right of access. If this is the case, any requests for copies of your child’s records will need to be with the consent of your child. To apply for access, please use the procedure above.
We are obliged to comply with our obligations promptly, within one month from the date your request is received. If clarification of your request is needed, the one month period does not start until that is received.
The organisation will provide a copy of your information free of charge. However, we can charge a reasonable fee when a request is manifestly unfounded or excessive, particularly if it is repetitive. We may also charge a reasonable fee to comply with requests for further copies of the same information. This does not mean the organisation will charge for all subsequent access requests. The fee will be based on the administrative cost of providing the information.
You can be refused access to your records or part of them if:
- your healthcare provider/clinician thinks you or someone else could be harmed as a result of the disclosure,
- the information relates to, or was provided by, a third party (that is someone other than yourself) and they have not given their permission for their comments to be shared with you.
Where requests are manifestly unfounded or excessive, in particular because they are repetitive, the organisation can:
- charge a reasonable fee taking into account the administrative costs of providing the information; or
- refuse to respond.
Where the organisation refuses to respond to a request, we will provide a full explanation as to the reasons why to the individual, informing them of their right to complain to the Information Commissioner's Office and to a judicial remedy without undue delay, at the latest within one month.
Should you be unhappy with the outcome of your request, you should in the first instance contact us to discuss your request and any ongoing concerns you may have.
You are also free to contact the Information Commissioner’s Office directly in the event you remain dissatisfied whose contact details are included within the questions and complaints section below.
Under the Access to Health Records Act 1990, you may request access to the records of a person who has died if you are the executor of their will, or if you have a claim on them. However, if the person stated in their will they do not wish anyone to have access, their wishes must be upheld.
To request access to a person who has died’s records please email kmicb.ig@nhs.net.