Data Protection Act – Patients’ Rights

The right of access to personal data is described in the Data Protection Act 1998 (DPA). It states that a Data Subject (i.e. the patient, or the patient’s nominated representative e.g. a solicitor) having submitted a request in writing and paid the appropriate fee (see below), is entitled to be provided within 21 days with a copy of the Personal Data (i.e. the medical records/notes) held about him or her. The Act requires that a copy of the data must be supplied in permanent form unless the supply of such a copy is not possible, would involve disproportionate effort, or the Data Subject (the patient or solicitor) agrees otherwise.

The general rights as set out in the DPA are modified by two orders. The Data Protection (Subject Access Modification)(Health) Order 2000 provides that information need not be disclosed if it would be likely to cause serious harm to the physical or mental health of the Data Subject or any other person and describes the mechanisms for ensuring that decisions as to whether to disclose or withhold information are taken by the appropriate health professional. The Data Protection (Subject Access) Fees and Miscellaneous Regulations 2000 provides that whereas the normal maximum access fee that may be charged is £10, for health records a fee of up to £50 may be charged for paper notes and £10 for computerised records.