Show Side Menu
Login to SystmOnline
Friends & Family Test
Southend East PCN
Domestic Abuse
Follow Us On Facebook
Southend University Hospital
Call 111 - When it is less urgent than 999

Subject Access Request

Patients have a right of access to their health records under the General Data Protection Regulation (GDPR) coming into place in May 2018. Any request for access to health records must be made in writing or verbally by the patient. These requests will be processed within one calendar month.

Please ask our reception team for further information.



Patients have the right and opportunity to request access to their medical records, their data and any supplementary information held by Central Surgery; this is commonly known as a data subject access request (DSAR). Data subjects have a right to receive:

  • Confirmation that their data is being processed
  • Access to their personal data
  • Access to any other supplementary information held about them

Best ways to access for medical records

Online Service Access

The General Data Protection Regulation (GDPR) states that “Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data.’

Signing up to the Surgery secure Online service will provide patients with electronic data held in their medical records such as demographic, ethnicity, problems & diagnosis, procedures, medication, vaccinations, results, values allergies and sensitivities.

Please visit the Practice Reception Team to undertake an identity check before being granted access to your records.

In paper form

In addition, patients may request paper copies of their health records, requests can be made by email to or speak to our reception team. However, patients may request access to their health records informally.

DSAR application form and Verification of identification

Regardless of the preferred method of access, patients and authorised third parties must initially complete a DSAR form. In order for us to process and verify all requests from Data subjects, you must submit a Data Subject Access Request (DSAR) form; The DSAR form is available to download on the practice website. Click here to download the Application form

Alternatively, a paper copy of the DSAR form is available from reception. In addition to the DSAR form we are permitted to ask for evidence to identify the data subject, usually by using photographic identification, i.e. a driving licence or passport.

Timeframe to respond to a DSAR

In accordance with the GDPR, patients are entitled to receive a response within the maximum given time frame of one calendar month from the date of submission of the DSAR. In order to ensure full compliance regarding DSARs, Central Surgery will adhere to the guidance provided in the GDPR. In the case of complex or multiple requests, the data controller may extend the response time by a period of two months. In such instances, the data subject must be informed and the reasons for the extension given.


There may be occasions when the data controller (Central Surgery) will withhold information kept in the health record, particularly if the disclosure of such information is likely to cause undue stress or harm to you or any other person. Or when the record has information relating to a third party.

Free of Charge with exceptions

Under the GDPR we are no longer able to routinely charge for providing copies of patients’ records with some exceptions.

If you don’t have access to the Surgery Online Services, we will provide a copy of the information free of charge, as per the GDPR rules. However, we may charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive.

We may also charge a reasonable fee to comply with requests for further copies of the same information. We understand that this does not mean that we can charge for all subsequent access requests.

Declining a request

The data controller (Central Surgery) can decline requests but when it decides not to take action on the request of the data subject, it will inform the patient of this decision without delay and at the latest within one month of receipt of the request.

Patients and Third Party requesting access to records

Requests may or may not be received from the following:

Competent patients may apply for access to their own records or authorise third-party access to their records.

Children and young people may also apply in the same manner as other competent patients and Central Surgery will not automatically presume a child or young person has capacity under the age of 16. However, those aged 12 or over are expected to have the capacity to consent to medical information being disclosed.

Parents may apply to access their child’s health record so long as it is not in contradiction to the wishes of the competent child.

Individuals with a responsibility for adults who lack capacity are not automatically entitled to access the individual’s health records. Central Surgery will ensure that the patient’s capacity is judged in relation to particular decisions being made. Any considerations to nominate an authorised individual to make proxy decisions for an individual who lacks capacity will comply with the Mental Capacity Act in England and Wales and the Adults with Incapacity Act Scotland.

Next of kin have no rights of access to health records.

Police are not able to access health records without first obtaining a court order or warrant. However, health professionals at Central Surgery may disclose relevant information to the police if the patient has consented or if there is overriding public interest.

Solicitors and insurance companies in most cases will provide the patient’s signed consent to release information held in their health record. Central Surgery will ensure that patients are fully aware of the information being provided to the solicitor who is acting for that patient.

Central Surgery will ask solicitors to use the appropriate form when requesting information.

Deceased patients retain the right of confidentiality. There are a number of considerations to be taken into account prior to disclosing the health record of a deceased patient. Such considerations are detailed in the Access to Health Records Act 1990. Under the terms of this Act, Central Surgery will only grant access if you are either:

  • a personal representative (executor of the deceased person’s estate), or
  • someone who has a claim resulting from the death

The medical records of the deceased will be passed to Primary Care Support England (PCSE) for storage. Central Surgery can advise you of who you need to contact in such instances. PCSE will retain the GP records of deceased patients for ten years, after which time they will be destroyed. PCSE have provided an application form which can be used to request copies of a deceased patient’s record.

In the cases of any third-party requests, Central Surgery will ensure that the patient has consented to the disclosure of this information by means of a valid signature of the patient.

Data controller

Central Surgery is the data controller. Should you have any questions relating to accessing your medical records, please ask to discuss this with the Practice Manager.

Review: May 2019

Local Services, Let