Requests for copies of health records

In the UK, data protection is governed by the General Data Protection Regulation (GDPR) 2018, and the Data Protection Act (DPA) 2018.

This legislation, together with the Access to Health Records Act 1990, entitles individuals to access personal data such health records (or that of another individual with explicit consent/evidence of lawful authority).

A request for copies of health records is commonly known as a Subject Access Request (SAR) however, it should be remembered that all patients, alive or deceased, and irrespective of age, are entitled to a duty of confidentiality of their health records.

We therefore have stringent protocols in place to ensure we do not make a disclosure of confidential patient health records to someone who cannot verify their identity or authority to be in receipt of these records.

Whilst a SAR can be made verbally or in writing, and no specific form is required, SAR’s must be supported by valid ID for the requestor. In addition to this, a SAR made for access to another individuals health records also requires evidence of the requestors lawful authority to be in receipt of that individual’s confidential health records.

We therefore recommend that you complete the appropriate form as explained below to prevent a SAR being rejected, or incurring any delays in our ability to assist you.

Once we are in receipt of a completed SAR, which must include the appropriate ID and supporting evidence of lawful authority as necessary, we have 30 days/one calendar month to disclose the requested health records. However, if the SAR is complex, this period can be extended by up to two further months. If this should be necessary, we will contact you within the statutory timeframe to advise of this.

Please note we can only disclose health records for which we are the Data Controller (i.e. they are our health records to share); for example, we cannot disclose GP records or the health records of care and treatment you received from another healthcare provider. In those instances, you must make a SAR directly to those organisations.

We are required to process a SAR free of charge, but a reasonable fee may be applied to cover administration costs if the SAR is excessive or repetitive. We disclose the requested health records via our secure portal; once disclosed, you have 30 days to download the records and then they will be removed. If you do not download the records within this timeframe, you will need to make a new SAR.

If you would prefer to have the requested health records posted to you instead, ensure this is clearly stated in your SAR and that you have given us your full postal address; however, please note we do not post copies of radiology images as these maybe significant in volume and printing radiology images affects their quality.

Accordion

If you have been a patient of our Trust (East Sussex Healthcare NHS Trust), you can apply for a copy of records of care and treatment we have provided you. Please follow this link Login – Portal, register with our secure portal (or use your existing log in credentials if you have made a SAR to us before), and select the “Request For My Own Health Records” form.

In order to satisfy our duty to data protection and patient confidentiality, you must ensure you provide the correct ID as stated in the form. If you do not provide the correct ID, this will delay our ability to assist you.

If you are the relative of someone who has been a patient of our Trust (East Sussex Healthcare NHS Trust), you can apply for a copy of records of care and treatment we have provided them on their behalf. Please follow this link Login – Portal and register with our secure portal (or use your existing log in credentials if you have made a SAR to us before), and select the “Relative Request For Patient Health Records” form.

In order to satisfy our duty to data protection and patient confidentiality, you must ensure you provide the correct ID as stated in the form for yourself as requestor, together with evidence of your lawful authority to be in receipt of the patients confidential health records as follows:

  • If the patient is alive and has capacity, we require a signed letter from them giving us their consent to make confidential health record disclosures to you (please note we may also ask for additional information to verify the patients ID);
  • If the patient is alive but does not have capacity to give us their consent, we require a document evidencing your lawful authority to act as their personal representative; this is often achieved by way of you being named an Attorney in the patients Lasting Power of Attorney;
  • If the patient is deceased, we require a document evidencing your lawful authority to act as their personal representative; this is often achieved by way of you being named an Executor in the patients Will, or given authority in a Grant of Probate or Letters of Administration; or
  • If the patient is under the age of 16, we require a document evidencing your parental responsibility for the child; this is achieved by way of the child’s full birth certificate naming you as parent or an adoption certificate naming you as the adoptive parent.

If you do not provide the correct ID and/or evidence of your lawful authority to act as the patients personal representative, this will delay or prohibit our ability to assist you. If you cannot provide the required documentation, then please contact our SAR Team at esh-tr.SAR@nhs.net to discuss the matter.

If you are a business, for example, a solicitor, insurance company, or medical expert reporting service, acting on behalf of someone who has been a patient of our Trust (East Sussex Healthcare NHS Trust), you can apply for a copy of records of care and treatment we have provided them. Please follow this link Login – Portal and register with our secure portal (or use your existing log in credentials if you have made a SAR to us before), and select the “Business Request For Patient Health Records” form.

In order to satisfy our duty to data protection and patient confidentiality, you must ensure you provide evidence that demonstrates you, your client or your client’s litigant friend has the lawful authority to give us consent to make disclosures of confidential health records to you as follows:

  • If your client is our patient, we require a signed consent form; or
  • If you are acting for your client’s litigant friend on behalf of or relating to a patient with no capacity, is deceased or is under the age of 16, then we require evidence of their lawful authority to act as the patients personal representative; this is often achieved by way of the client’s litigant friend being the patient’s Attorney in a Lasting Power of Attorney, named as an Executor in the patients Will if the patient is deceased, or a full birth certificate naming the client’s litigant friend as parent (if the client is under the age of 16).

Our Trust operates across a number of acute hospital sites and community locations, but holds one central medical record for each patient; you do not need to make a separate SAR for each of our hospitals/locations, nor do you need to make a separate SAR for different record types; one SAR, listing all required records, will suffice and reduce unnecessary administration.

Please also ensure the patient has received care and treatment from our Trust before submitting your SAR; other healthcare providers may operate from our acute sites or shared community locations, and there are a number of NHS Trust’s and healthcare providers across East Sussex, but we cannot access or disclose their records, nor do we hold the patients GP records. You will need to make a SAR directly to those organisations.

If you do not provide the correct documentation as stated above, this will delay or prohibit our ability to assist you. If you cannot provide the required documentation, then please contact our SAR Team at esh-tr.SAR@nhs.net to discuss the matter.

We appreciate that not everyone has the means or ability to make a digital SAR. If you would prefer to make a SAR using our paper form then please download the form below, complete it in full, and post it to the address shown enclosing copies of the correct ID.

Request for Copies of Health Records

If you cannot download or print off the form, please contact our Patient Advice and Liaison Service (PALS) at esh-tr.patientexperience@nhs.net and they will post one out to you.

Accordion

Please note there may be times when we are required not to show you parts of a requested health record. This will only happen if this is information that might relate to another patient, or if a healthcare professional considers that seeing the information might be harmful to you.

The Trust also complies with the NHS England “Records Retention and Disposal Schedule”. The key things to note which affect your SAR are:

  • The health records of deceased patients are destroyed after eight years. This eight year period is a legal requirement; it allows sufficient time for the relatives to find out any information regarding their family members’ health care leading up to their death. There are some exceptions to this rule;
  • Maternity health records are kept until the child of the patient is 25 years old;
  • The health records of deceased paediatric patients are kept for 25 years; and

If a patients cause of death is found to be suicide, health records are kept for 25 years.

If you are, or have been, a substantive member of staff here at East Sussex Healthcare NHS Trust (ESHT), you can apply for copies of your Employment or Occupational Wellness records under the General Data Protection Regulation (GDPR) 2018, and the Data Protection Act (DPA) 2018 if you need them.

Employment Records

At present, any request for copies of employment records will still need to be made on the paper HR-SAR form. Please download the form below, complete it in full, and post or email it back ensuring you provide the correct information and/or ID. HR will not be able to make any confidential disclosures to you until they can validate your identity and employment with the Trust.

Subject Access Request (SAR)

In the meantime, we are building a new digital HR-SAR webform to facilitate these requests and hope to launch this in early 2027.

Please do not use this form if you require copies of your Occupational Wellness records; you should refer to the section below.

Occupational Wellness Records

If you require copies of confidential records in relation to one of the following employment matters, then you can make an online application:

– Occupational Health
– Trauma Risk Management (TRiM)
Please follow this link Login – Portal and register with our secure portal (or use your existing log in credentials if you have made a SAR to us before), and select the “Occupational Wellness SAR Form”.

You should complete the form in full by answering all questions, and ensure you upload the correct ID to avoid any delay in our ability to assist you. The Occupational Wellness Team will not be able to make any confidential disclosures to you until they can validate your identity and employment with the Trust. Please also note the legislative timescales for processing your Occupational Wellness SAR do not begin until we have this information and ID.

Once validated and as with patient health record SAR’s, we have 30 days/one calendar month to disclose the requested records. However, if your request is complex, this period can be extended by up to two further months. If this should be necessary, we will contact you within the statutory timeframe to advise of this.