Under the GDPR / Data Protection Act 2018, you have the right to make a request to see or obtain copies of the information the organisation holds about you. This is referred to as a subject access request (SAR). Under the Act you are entitled to be told if any personal information is held about you, and if it is, to be given:
- a copy of the information in permanent form, if requested
- an explanation of any technical or complicated terms, for example, medical terminology or abbreviations
- an explanation of where we got your information from
- a description of the information, the purposes for processing the information, who we are sharing the information with, if anyone, and how long we will be keeping the information
- information on the safeguards in place for any data being transferred outside of the European Union
- an explanation of the logic involved in any automated decisions (if you have specifically asked for this)
- information regarding your other rights under the GDPR / Data Protection Act 2018.
Please note that the ICB can only respond to SARs for information for which we are the data controller and we cannot access or provide information held by other NHS bodies. Please see below in ‘What information does the ICB hold about me?’ for more details.
What information does the ICB hold about me?
As discussed on our ‘How we use your information’ page, for the majority of the ICB's work, we do not need to use personal/confidential data and wherever possible, anonymised data is used for our purposes.
However, please see the ICBs Record of Processing Activity (ROPA) for full details of when personal identifiable data is used in the ICB and our legal basis for doing so.
Please note that the ICB does not routinely have access to patient health records and where it does use health records for direct care purposes (such as to assess and deliver NHS Continuing Healthcare packages of care) the information held will be limited.
A request for information from medical records has to be made the data controller of that information - this is normally the organisation that provided your treatment, for example, your GP practice, hospital, optician or dentist.
To view or access a copy of your records please email: kmicb.ig@nhs.net, giving as much detail as possible on the record(s) you wish to access.
We will ask you for proof of your identity and proof of your address. The organisation then has one month to respond to your request, from receipt of the above information.
You may be able to access the records of your child/children. However, if a clinician has stated he/she believes your child/children to be competent to make their own decisions, then you will not have an automatic right of access. If this is the case, any requests for copies of your child’s records will need to be with the consent of your child. To apply for access, please use the procedure above.
We are obliged to comply with requests within one month from the date your request is received. If clarification of your request is needed, the one month period does not start until that is received.
The organisation will provide a copy of your information free of charge. However, we can charge a reasonable fee when a request is manifestly unfounded or excessive, particularly if it is repetitive. We may also charge a reasonable fee to comply with requests for further copies of the same information. This does not mean the organisation will charge for all subsequent access requests. The fee will be based on the administrative cost of providing the information.
You can be refused access to your records or part of them if:
- your healthcare provider/clinician thinks you or someone else could be harmed as a result of the disclosure,
- the information relates to, or was provided by, a third party (that is someone other than yourself) and they have not given their permission for their comments to be shared with you.
Where requests are manifestly unfounded or excessive, in particular because they are repetitive, the organisation can:
- charge a reasonable fee taking into account the administrative costs of providing the information; or
- refuse to respond.
Where the organisation refuses to respond to a request, we will provide a full explanation as to the reasons why to the individual, informing them of their right to complain to the Information Commissioner's Office and to a judicial remedy without undue delay, at the latest within one month.
Should you be unhappy with the outcome of your request, you should in the first instance contact us to discuss your request and any ongoing concerns you may have.
You are also free to contact the Information Commissioner’s Office directly in the event you remain dissatisfied whose contact details are included within the questions and complaints section below.
Under the Access to Health Records Act 1990, you may request access to the records of a person who has died if you are the executor of their will, or if you have a claim on them. However, if the person stated in their will they do not wish anyone to have access, their wishes must be upheld.