The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 give individuals (“Data Subjects”) rights to accessing information held about them held by organisations (“Data Controllers”). GDPR places obligations on data controllers to handle and manage information in a specific way. GDPR relates specifically to information relating to living individuals.
The Access to Health Records Act 1990 (AHRA) deals with the disclosure of deceased persons’ health records. Under the AHRA when a person dies, their personal representative, executor, administrator, or anyone having a claim resulting from the death, has a right to apply for access to the deceased’s health records. Where the record indicates that the deceased person did not wish their information to be disclosed, this must remain so unless a court order is obtained. The deceased patient’s health record access is provided on the basis of the request under AHRA as common law of confidentiality remains after a person is deceased.
ABOUT THIS FORM
All requests for personal information must be in writing, this form aims to make the process easier for you if you want to make a request for information that The Orthodontic Practice at Battersea (“the Practice”) holds about you or a deceased individual then please complete this form.
Under GDPR, this is called a Subject Access Request (SAR). Under the AHRA this form can also be used to request information about a deceased patient’s health records.
For us to release records we need to have proof of ID and assure ourselves of the legitimacy of the request. , the Practice is not obliged to comply with a request unless we are supplied with such information as we may reasonably require satisfying ourselves of the identity of the requestor. There is no fee to pay for a first request. Subsequent requests may carry a charge.
STATUTORY DEADLINE
We will respond to your request within the statutory calendar month upon receipt of valid proof that you have legitimate rights to access the data.
HOW TO COMPLETE THE FORM
Section 1: Details of the data subject (patient)
This section must be completed for all applicants. Please complete all details relating to the data subject (person about whom the information is requested)
Section 2: Details of the person acting on behalf of the data subject (representative)
This section should only be completed when the application is being submitted on behalf of the data subject on the authority of the data subject. The section must also be completed if the request is for access to a deceased patient’s health records.
Section 3: Relationship of requestor to data subject
This section must be completed when application is submitted on behalf of the data subject or when requesting access to deceased patient’s health records. (If required)
Section 4: Description of the information requested
This section must be completed by all applicants. You need to specify the records/information you wish to access, providing as much details as possible. If we require further details about the information that you request, we will contact you.
Section 5: Declaration
This section must be completed by all applicants and divided in 3 parts
- Part A should be completed by the data subject or legal parent/guardian
- Part B should be completed when the applicant has been provided authority by the data subject—for example, if request is being submitted on behalf of a patient; we need to see proof of this.
- Part C should be completed when the applicant is requesting health records of a deceased patient
Section 6: Supporting documents and identification
Supporting identification documents must be provided for your request to be processed.
