Rights to Access Medical Records
The Data Protection Act 2018 enshrined GDPR into UK law
Under the DPA 2018, patients have the right to request access to their own medical records under a Subject Access Request without charge, including situations where they give consent for a third party such as a solicitor or insurer to access the data.
Key points to bear in mind are:
- GDPR applies to both digital and paper records
- Information is subject to confidentiality obligations that already exist, e.g. between a doctor and patient
- GDPR only applies to living people, but the Access to Health Records Act (AHRA) extends to deceased individuals