Right to Access

Right to Access

Compliance with Individual Rights
Patient personal data belongs to the individual/ the patient, and individuals/patients have a number of rights to their personal data.

This practice has voluntarily adopted the ICGP recommendations on the requirements of “processing of Patient Personal Data: A Guideline for General Practitioners”
We have put the following procedures in place to protect and support the individual/patient’s rights as detailed below

Right to Access

Under Article 15 of GDPR, the patient, whether GMS or private, has a right to access a copy of their medical record. This practice will always provide a copy of a patient’s medical record on receipt of a signed request or authorisation form. The access request will be carried out as soon as possible, and no later than 30 days after the access request. No fee will be charged for providing a copy of this medical record.

If a GMS patient submits a FOI request for their medical record the request should be submitted to the HSE and the HSE should then authorize the practice to release these records.

As per GDPR legislation, an individual can only make an Access Request for their own personal data. Legal Guardians can also make a request on behalf of a child, however, once a child is capable of understanding their rights to privacy and data protection, the child should make this request in their own name. THIS IS NOT AGE DEPENDENT therefore we reserve the right to process these requests on an individual basis as revealing medical information of a child who is capable of making decisions themselves will in most cases constitute a breach of Data Protection Acts.

For example: 

A legal guardian has requested access to their 16 year old child’s medical record.

An individual can only make an Access Request for their own personal data. Legal guardians can also make an access request on behalf of a child. However, once a child is capable of understanding their rights to privacy and data protection, the child should normally decide for themselves whether to request access to data and make the request in their own name (this is not age dependent). The digital age of consent is 16,  therefore any request to access for a child aged 16 and older should have the consent of the child, with the exception of Section 54 as outlined below.

Revealing of medical information of a child who is capable of making decisions themselves will in most situations constitute a breach of the Data Protection Acts if undertaken without the consent of the child capable of making their own decisions.

The right to access may be restricted, as per Section 54 of the Data Protection Bill 2018, if the disclosure of the record to the patient ‘would be likely to cause serious harm to the physical or mental health of the data subject’. In a situation where access is denied, the practice will advise the patient of the reason for the restriction either at the time access is denied or as soon as is advisable thereafter.

In addition, only the part of the medical record likely to cause harm will be withheld, the rest of the medical record will be released in the usual way.

The patient has a right to appeal the restriction to the Data Protection Commissioner.

Right to Rectification

Under Article 16 of GDPR, the patient has the right to obtain rectification of inaccurate patient data which is factually inaccurate. However, this is not an unqualified right and depends on the circumstances of each case (reference Irish Data Protection Commissioner case study 1 of 2007). A relevant dispute resolution may be addressed by the addition of a 17 supplementary statement in the patient record.
For example, a patient may believe that a diagnosis of ‘Depression’ in their clinical record is inaccurate. This was the opinion of the GP at a point in time. The patient has the right for a note to be inserted in their clinical record that they disagree with the GP’s diagnosis made at that time, but the contemporaneous record and clinical diagnosis by the GP does not have to be deleted or erased.

Right to Erasure: Article 17 of GDPR
All GP Practices have a requirement under Medical Council rules to keep medical records and also have a right to defend medico-legal claims, under Article 23.1(g) the right to erasure of medical records is not an absolute right and restrictions may apply. This type of request will be examined on a case-by-case basis in this practice.

Right to Restriction of Processing Article 18 of GDPR
In the unlikely event that a patient of ours is in dispute with one of our GP’s the patient has a right to request that their medical record be locked or archived so that further processing of, or changes to, the record do not occur.
In this event, continuing medical care by the GP cannot take place while this medical record is locked. Requests from patients to restrict processing should be in writing and signed.

Right to Data Portability
If you decide at any time and for whatever reason to transfer to another practice we will facilitate that decision by making available to your new doctor a copy of your records on receipt of your signed consent from your new doctor.
We will need written consent from every individual in your family. As per GDPR legislation, an individual can only make an Access Request for their own personal data. Legal Guardians can also make a request on behalf of a child, however, once a child is capable of understanding their rights to privacy and data protection, the child should make this request in their own name.
These records will be sent electronically through Healthmail to your new GP.  If this is not possible we will then register post them to your new GP. We have a no post policy unless as stated above. We will not email them or save them to a usb stick/cd or similiar device.
For medico-legal reasons we will also retain a copy of your records in this practice for an appropriate period of time which may exceed eight years.

Right to Object
All patients have a right to object at any time to processing of personal data for direct marketing purposes, however this practice does not carry out any direct marketing campaigns.
Automated Individual Decision-making, Including Profiling
GPs do not base decisions solely on automated processing, and the point of view of the patient is central to any decision making in the provision of medical care.