SARS-Subject Access Request
How to request a copy of your health and care information
You have a legal right to ask for a copy of the personal information a health or care organisation holds on you. This is known as making a Subject Access Request (SAR). You may also give permission to someone else, such as a family member or your solicitor, to make the request on your behalf.
How to request a copy of your health and care information?
1.Complete the Subject Access Request Form and return it to the Practice.
2.Provide Proof of identification:
- Driving licence, passport, birth/marriage certificate
- Proof of relationship – for example, you may need proof of parental responsibility when requesting information about a young person (for example the young person’s birth/adoption certificate with the requestor’s name, or a parental responsibility agreement or court order)
- Proof of authority – an agent (such as a solicitor) will need to prove they are acting on the person’s behalf. For example, this may be through a letter of consent signed by the individual.
How long it take?
The Practice should get back to you with the information within one month of receiving your form. However, if the request is complex, they can extend that time to 3 months. They will tell you if this is the case and will let you know when they expect to be able to reply to you.
What about SARs relating to young people?
Where a young person is competent
A young person can exercise their own data protection rights as long as they are deemed competent to do so. Generally, young people aged 13 and over are considered competent to make a SAR unless there is information to suggest otherwise.
Hence, a SAR made by a parent or other third party on behalf of a young person aged 13 or over, will (in most cases) need the consent of that young person.
Likewise, there may be information to suggest a young person under 13 has adequate understanding to be considered competent to make a SAR.
Where a young person is competent, they can still agree that a request is made on their behalf by those with parental responsibility.
Where a young person is not competent
If a young person does not have sufficient understanding to exercise their rights themselves, a person with parental responsibility can exercise the young person’s right to make a SAR.
Where a person with parental responsibility is requesting information about a young person who lacks capacity to act on their own behalf, the Practice will verify that the person does, in fact, hold parental responsibility for that young person – see proof of verification.
It is possible to restrict information going to a parent where it is not considered to be in the young person’s best interests. For example, where there are “do not disclose” notes on the young person’s record.
What if the request is from someone with registered lasting power of attorney (LPA) for health and welfare for the individual?
A person with a registered lasting power of attorney (LPA) is authorised to make a SAR on the individual’s behalf. A person with a registered LPA for health and welfare is someone who has been appointed by the individual to manage their health and wellbeing affairs when they no longer have capacity to do so themselves. It is also reasonable to assume that an attorney with authority to manage the property and financial affairs of an individual has the appropriate authority to make a SAR on their behalf.
The Practice may also allow a person without an LPA to make a SAR on behalf of someone without capacity if they can provide evidence to show that they are acting in the individual’s best interests, for example to support benefit claims or social care provision.
What about SARs made by third parties?
Individuals can authorise third parties (for example, solicitors) to make a SAR on their behalf. Health and care providers releasing information to solicitors acting on behalf of their patients and service users should ensure they have the individual’s written consent.
The request should be treated as if it came directly from the individual. There are very few circumstances when a health and social care provider will be able to lawfully decline such requests. The Practice still required to validate the consent in order to make sure it has come from the correct individual, and it have enough information to understand what they were consenting to.