ACCESS TO INFORMATION REQUESTS
As an organisation holding NHS commissioned contracts, we have a duty to share information about how our services are run and the information we hold on our patients. The below options set out the ways in which you can access or make a request for information.
MAKING A SUBJECT ACCESS REQUEST (SAR)
Requests to see records and other related information about yourself are known as 'Subject Access Requests'. You have a right to get a copy of the information that is held about you.
Who can request this information?
· The named individual
· The personal representative of an individual (such as someone holding Power of Attorney)
· The parent/legal guardian of a child
When requesting information on behalf of another person, if the individual has capacity, we may need to still obtain their consent to process the request.
What personal information is held about me?
A health and care record contains information about the mental or physical health of a patient and will contain information supplied by the patient, healthcare professionals and others involved in a patient’s healthcare and will include such things as:
· When you saw a healthcare professional
· Details of clinical findings, care and advice given by the health professional
· Care and treatment options discussed with you and any decisions made
· Details of any action health professionals have taken and the outcome of this
Who is my personal information shared with?
Personal information is held securely within health and care records and will only be shared with healthcare professionals and support staff who have a legitimate right to access your records for the purpose of providing healthcare or administrative services for you.
There will be circumstances when your health and care record can be shared with other people but there will be strict rules in place around when this occurs to give you the reassurance that your records are not accessed or shared inappropriately. Such circumstances may include:
· Where you have given your consent in writing for someone else to access your records
· If you are not able to give consent and are not capable of managing your own affairs – in which case the person responsible for managing your affairs will normally have the right of access
· In the case of a child, the parent(s) will normally have the right of access although this is at the discretion of the organisation holding the record
· Following your death, then your personal representative or the person managing your affairs will normally have the right of access to relevant parts of your health and care record
There may also be certain other rights of access laid down in law, where a legitimate request has been made as part of a criminal investigation or to safeguard your best interests.
Am I able to see or receive a copy of my personal information?
Yes, you have the right to access health and care or personal information about you that is recorded manually, on a computer, or other storage means by Taurus Healthcare. However, there are certain exemptions to this.
How much does it cost to access my information?
In most cases this information can be provided free of charge unless your request is manifestly unfounded or excessive, particularly if it is repetitive when an administrative cost may be made.
Applying to access your health and care records
If you want to see or view a copy of your health and care records you don’t have to give a reason but should make your application in writing, providing as much information as possible to help us locate the records. To ensure we are sharing your records lawfully, you will need to verify your identity.
You can make your request by using the form below or by emailing directly:
Please email or return the completed form to the Quality Team via quality.taurus@nhs.net or by post:
Taurus Healthcare Limited
Suite 1, Berrows Business Centre, Bath Street, Hereford. HR1 2HE
Please note if sending by email that we cannot guarantee the security of your email whilst in transit to us.
What ID do I need to show?
Your application will need to be accompanied by copies of at least two official documents that relate to the person making the request (we do not need to see the originals). Below is a list of examples of these documents, however, this is not exhaustive of all options so if you are unsure on this, please do not hesitate to contact us.
One document confirming your name:
· Full driving license
· Passport
· Birth certificate
· Marriage or civil partnership certificate
· NHS identity badge
One document confirming your address:
· Utility bill
· Bank statement
· Credit card statement
· Benefit book
· Pension book
Where appropriate, examples of documents that confirm you are allowed to act on behalf of the person you are making the request for:
· Health and welfare lasting power of attorney;
· Court of protection order appointing you as a personal deputy for the personal welfare of the subject
· Full birth certificate of the child
· Full certificate of adoption
· Parental responsibility order
· Signed declaration from the subject
Can access be denied or restricted?
There may be exemptions in certain situations where we may decide to withhold certain information, for example:
· When we are not satisfied that the applicant is acting with the patient’s permission
· Where we believe releasing the information may cause serious harm to the physical or mental health of the patient or any other individual
· Where the record contains third party information about another individual and we do not have their permission to share this.
How long will it take to receive my records?
We aim to provide your records within one calendar month of receipt of all the information we need to locate your records. If your records are complex or numerous and we envisage it may take longer than this, we will inform you.
What happens next?
Once we have received your request and ID, we will locate the health and care records, prepare the required copy, and obtain authority to release them from the appropriate health professional and then make arrangements for you to receive a copy of your health and care record, usually by secure email.
Leaflets
· Privacy Information for Adults
· Privacy Information for Children
· Taurus Healthcare Privacy Notice – Patients
MAKING A REQUEST TO ACCESS MEDICAL RECORDS OF A DECEASED INDIVIDUAL
Access to a deceased persons information is not dealt with under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as these laws refer to data about living individuals, or any data protection law, past or present.
This will be an access request under the Access to Health Records Act 1990 (AHRA). This Act provides certain individuals with a right of access to the health records of a deceased individual created after 1st November 1991. However, there is still an ethical obligation to respect a patient’s confidentiality beyond death.
Who can request access to the records of a deceased individual?
The Access to Health Records Act provides certain individuals with a right of access to the health records of a deceased individual. These individuals are defined under Section 3 (1) (f) of that Act as:
· the patient’s personal representative (A personal representative is the Executor or Administrator to the deceased person’s estate, evidenced by a copy of the will, Grant of Representation or Letters of Administration) or
· any person who may have a claim arising out of the patient’s death
Can access to these records be declined?
Taurus Healthcare can refuse the request if, in the view of the clinician and/or Data Protection
Officer, exemptions apply.
Access shall not be given under section 3 (2) to any part of a health record:
(a) which, in the opinion of the holder of the record, would disclose:
i. information likely to cause serious harm to the physical or mental health of any individual
ii. information identifies a third party without that person’s consent unless that person is a health professional who has cared for the patient
iii. Information that in life the patient asked to be kept confidential.
How long will it take to receive copies of the requested records?
Once Taurus Healthcare has the relevant information, we should comply with the request promptly and within 21 days where the record has been added to in the last 40 days, and within 40 days otherwise.
What happens next?
Once we have received your request and documentary evidence, we will locate the health and care records, prepare the required copy, and obtain authority to release them from the appropriate health professional and then make arrangements for you to receive a copy of your health and care record, usually by secure email.
How to submit a request to see health records
A request for access should be made in writing to Taurus Healthcare ensuring that it contains
sufficient information to enable the correct records to be identified. Requestors may wish to specify particular dates or parts of records which they wish to access.
The request should also give details and evidence of the requestor’s right to access the records e.g., a copy of the will, Grant of Representation or Letters of Administration.
NHS England proves appropriate advice and guidance on access to health and care records following the death of an individual.
An application to access your records can be completed by using the form below or by emailing directly:
· Access to Deceased Patient Records Application Form
Please email or return the completed form to the Quality Team via quality.taurus@nhs.net or by post:
Taurus Healthcare Limited
Suite 1, Berrows Business Centre, Bath Street, Hereford. HR1 2HE
Please note if sending by email that we cannot guarantee the security of your email whilst in transit to us.
MAKING A FREEDOM OF INFORMATION (FOI) REQUEST
The Freedom of Information Act 2000 gives people the right to request information held by public organisations. This allows us to be more open and transparent about our organisation, who we are, what we do, who we work with and where we spend money.
Before you request information
Before submitting a new request for information it's important to check whether the information you seek is already available. If you request information that is already published, we will refer you to the published source.
Our disclosure log outlines some of the Freedom of Information requests we have received and responded to. We routinely publish anonymised responses to FOI requests where these are of general nature and are of public interest.
· View our Freedom of Information - Disclosure log
Who can request information?
Everyone has the right to ask to see recorded information held by public authorities.
What can I request?
You can seek any recorded information that you think Taurus Healthcare may hold.
If you ask for environmental information, your request will be handled under the Environmental Regulations (EIRs). Environmental information includes things like carbon emissions or the environment’s effect on human health.
If a member of the public wishes to see information that Taurus Healthcare holds about them, such as their health or medical records then a subject access request should be made. Access to personal data cannot be requested via an FOI request.
How to make a request under the Freedom of Information Act
You are encouraged to check our FOI disclosure log to see if the information you require is already available.
If you haven’t found what you are looking for, you may wish to use our FOI Request Form. You can then submit your request by email or in writing:
· Email: quality.taurus@nhs.net
· Post: Taurus Healthcare Limited, Suite 1, Berrows Business Centre, Bath Street, Hereford. HR1 2HE
Other Information
· Ensure that you include a contact name and address in your request. This can be a physical or email address, so we know where to forward your response to.
· Try to include as much detail as possible, in your request, about the information you require. This helps us when processing your request.
· Taurus Healthcare cannot accept a verbal request for information in these circumstances.
· Please be aware that the Act operates an appropriate cost limit. Therefore, if the time and resource taken to provide your information exceeds that limit Taurus Healthcare can apply a charge to your request or issue a written refusal notice.
For further details on the Freedom of Information Act 2000, exemptions, the appropriate cost limit and more please visit the Information Commissioner’s website.
Timeframes
Taurus Healthcare must ensure its compliance with the duty to confirm or deny and to provide the information requested within twenty working days of a request in accordance with section 10 of the Act.
If the information requested by the applicant incurs a charge or a fee and the applicant has paid this within three months of receiving the fees notice, the working days in the period from when Taurus Healthcare issued the fees notice to when the fee is received by Taurus Healthcare will be disregarded for the purposes of calculating the twentieth working day following receipt. In essence, once the applicant has been requested to pay a fee the twenty working day clock is paused until the fee is paid.
If Taurus Healthcare chooses to apply an exemption to any information or to refuse a request as it appears to be vexatious or repeated, or exceeds the appropriate limit for costs of compliance, a notice shall be issued within twenty working days informing the applicant of this decision (refusals will be in accordance with section 10.0).
COMPLAINTS WITH REGARD TO RECORDS ACCESS
Taurus Healthcare has procedures in place to enable complaints about access to records requests to be addressed.
All complaints about access to records and subject access requests should be referred to the
Head of Information Governance (siro.taurus@nhs.net) and the Data Protection Officer, Paul Couldrey, PCIG Consulting Limited (couldrey@mac.com) in the first instance.
If the issue remains unresolved, you have a right to make a complaint through the NHS Complaints Procedure.
The applicant can complain to the commissioner of the service which is the Herefordshire and Worcestershire Integrated Care Board (ICB).
Both Taurus Healthcare and the ICB will require written consent from the person who the complaint relates to, or from a legal guardian. The reason for this is to comply with patient confidentiality requirements.
You as the patient or applicant may not wish to make a complaint through the NHS Complaints Procedure and instead, take your complaint direct to the Information Commissioner’s Office (ICO) via their website (www.ico.org.uk) or by telephone 0303 123 1113, if you believe the organisation has not complied with your request in accordance with the appropriate legislation.