Your health records and subject access requests

This is called the right of access. You can find out more about getting copies of your information on the Information Commissioner’s Office website. 

Please note: The Integrated Care Board does not hold or access identifiable patient care records, if you wish to access information or records regarding your treatment please direct your request to the hospital or your GP Practice directly as the ICB does not hold these records. 

To get a copy of personal information held about you by the ICB, you can contact the ICB and make an ‘access request’.

Who can make a request? 

Any individual can make a Subject Access Request (SAR). This can be for yourself or another person. You can also nominate a representative (such as a solicitor, relative or someone else you trust) to apply on your behalf.

Requests to access information or records relating to someone who has died have different regulations and requirements.  

How to request access to records

Making a request for your own health records 

The Integrated Care Board does not hold or access identifiable patient care records, if you wish to access information or records regarding your treatment please direct your request to the hospital or your GP Practice as the ICB does not hold these.

If you are making a request for your own health records please tell us:

• your name, address and postcode
• any relevant case reference numbers 
• the type of information or documents you want to look at including any relevant dates 
• any preferences you have for the way you would like us to send the information to you (for example, hard copy, large print or by email) 
• proof of your identity such as a copy of photographic identification such as a driving license or passport and proof of address such as utility bill. This is so that we can be sure that the person requesting records is the data subject.

You can also nominate a representative (such as a solicitor, relative or someone else you trust) to apply on their behalf. In this case, there must be a valid consent signed by the individual who authorises the release of information to the representative. 

Making a request for access to records for a child for whom you have parental responsibility 

The Integrated Care Board does not hold or access identifiable patient care records, if you wish to access information or records regarding your treatment please direct your request to the hospital or your GP Practice as the ICB does not hold these.

If you have parental responsibility for a child, you have a statutory right to apply for access to your child’s health records.  

So that we can establish parental responsibility we may need you to show us the child’s birth certificate, or a certified copy of this.  

If the child is of an age capable of giving consent, he or she must give consent.  

As stated above, we would prefer this request to be in writing. 

Making a request on behalf of another adult 

The Integrated Care Board does not hold or access identifiable patient care records, if you wish to access information or records regarding your treatment please direct your request to the hospital or your GP Practice as the ICB does not hold these.

If you are making a request for access to records on behalf of another adult, we will need: 

• the name of the person whose records you are requesting 
• a copy of their photographic identification 
• their signed consent for you to act on their behalf. If the person lacks capacity to provide their consent, you will need to provide a copy of Power of Attorney for Health and Wellbeing 
• a copy of your photographic identification. 

Other types of request

Police requests for information, should be made according to your own police force’s policy and process. However, we require the request to be made via the NPCC Request to external organisation for the disclosure of personal data to the Police Form. This must be co-signed by a rank of inspector or above and be specific on detail and legal basis of the request. 

Exceptions to responding to a request for information 

Limited access

Under current legislation we can limit access to a person’s records in certain cases. For example: 

• If we believe the information could be detrimental to the requester’s wellbeing, we may refuse the request in part or whole 
• If a third party has provided information in confidence, and the information was given on the basis that it would not be shared, these parts of the record would not be released 
• If the data subject has requested that information is not disclosed.

Exceptions

There are occasions and reasons where an organisation does not need to respond to a subject access request, these are called exceptions. Such exceptions include instances where a request is manifestly unfounded or manifestly excessive. We will also not routinely provide information that has been released under a previous subject access request, where we do this will incur a fee.  

Due to the nature of the information the organisation holds we would envisage the period between requests for release be a minimum of three months. Where repeat requests are made more frequently than three months apart, we may consider these excessive. 

When you can expect to hear from us  

Once we have received proof of your identification and consent (where necessary) we will respond within one calendar month, providing the requested information.  

Very occasionally we may not be able to provide the information you are requesting within this time frame. If this is the case we will let you know. If you are requesting information for someone else, we will keep them informed too.   

Receiving the information  

When the information is ready, we will contact you to discuss the most appropriate way to send it to you. This can be electronically via email, by special delivery or you can collect it in person.