ACCESS TO PATIENT HEALTHCARE RECORDS UNDER THE DATA PROTECTION ACT 1998 & THE ACCESS TO HEALTH RECORDS ACT 1990

Transcription

1 ACCESS TO PATIENT HEALTHCARE RECORDS UNDER THE DATA PROTECTION ACT 1998 & THE ACCESS TO HEALTH RECORDS ACT 1990 Relevant to: All staff who receive requests for access to healthcare records. Purpose of guidance: To ensure that all requests for access to healthcare records are processed in accordance with the Data Protection Act, the Access to Health Records Act 1990 and the Department of Health Guidance for Access to Health Records Requests (February 2010). To ensure that patients are given correct information regarding their rights under the Data Protection Act To ensure that all information provided against requests is appropriate and provided in accordance with statutory timescales. National Definitions: Data Protection Act 1998: An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information [16 th July 1998] Access to Health Records Act 1990: An Act to establish a right of access to health records by the individuals to whom they relate and other persons; to provide for the correction of inaccurate health records and for the avoidance of certain contractual obligations; and for connected purposes.[13th July 1990] Personal Data: data which relate to a living individual who can be identified from those data and other information which is in the possession of, or likely to come into the possession of the data controller. Processing: means obtaining, recording or holding the information, and carrying out any operation on the information. Data Controller (Data Protection Act ) / Holder of the record (Access to Health Records Act): East Kent Hospitals University NHS Foundation Trust. Health Professional: Registered medical practitioners, dentists, opticians, physiotherapists, nurses, psychologists, chiropodists, health visitors etc. Reference Material: Data Protection Act 1998 Access to Health Records Act 1990 Information Security Policy 1

2 The Patient Record THE DATA PROTECTION ACT 1998 All identifiable records concerning the patient are accessible under the Data Protection Act 1998, including: Written record Letters Laboratory reports Computerised record X-rays Scans Photographs Audio/visual record Health Records have the following functions Supporting patient care Assisting in the day to day management of patients Assisting evidence based practice Assisting managerial decision making of importance to the NSH as a whole Assisting in audit Assisting in the advancement of clinical effectiveness Assisting in clinical governance framework Who has the right to access? 1. The patient 2. The patient s representative with the patients consent 3. Anyone authorised in writing by the patient e.g. police, relatives 4. In certain circumstance, a person making a claim as a result of a patient s death. Who has the duty under the Act? Because in many situations the patients record will be compiled by many health professionals the Act provides for access to be given by the holder of the healthcare records after consultation with the appropriate health professional(s), normally the practitioner who was or is responsible for the clinical care of the patient to which the application refers. However, it has been agreed between South Coast Audit, the Information Governance Steering Group and Health Records Committee that individual health professional(s) consent is not required for each request. If the patient is deceased and the patient s representative or a person who may make a claim arising out of the death requests access, this is permissible under the Access to Health Records Act All these requests must be made in writing to the Health Records Access Team 2

3 If an inpatient, or someone attending outpatients, asks to see his/her record: It is anticipated that in most cases a patient will orally request access to the healthcare records in the course of treatment (as an inpatient or outpatient) and the health professional responsible for that episode of treatment may wish to hand the healthcare records to the applicant. This request will not constitute an application under the Act. The health professional making that record can show what he/she has written but nothing more unless he/she is in charge of the period of care. He/she cannot show any other aspect of the patient s previous or ongoing care if that care is under another health professional. Should you receive a letter or telephone call from the patient, solicitor or anyone asking for access to healthcare records please; Send the letter or put the telephone call through to the Health Records Access Team. Other applications not covered by the above must be in writing with application form (Appendix 2 or 3) duly completed, and are to be dealt with as detailed on the attached procedure (Appendix 1). All formal requests will be dealt with by the Health Records Access Team unless:- 1. A court order other then by Kent County Council is made against the Trust or; 2. It is clear that litigation is being taken against the Trust. In both instances requests are to be dealt with by Trust Legal Department. Note: Where litigation is only implied requests will be dealt with by the Health Records Access Team If a patient believes that data recorded about them is incorrect they may use their Right of Rectification, Data Protection Act This document is attached as Appendix 4. 3

4 THE ACCESS TO HEALTH RECORDS ACT 1990 FOR DECEASED PERSONS ONLY. GUIDANCE FOR STAFF The above came into effect on 1 November These guidelines are to be followed by members of staff when receiving access requests of a deceased patient. Definitions: Holder of the record Health professional East Kent Hospitals University NHS Foundation Trust Registered medical practitioners, dentists, opticians, physiotherapists, nurses, psychologists, chiropodists, health visitors, etc. APPLICATION FOR ACCESS Should applicants request assistance with an explanation for any medical terms or abbreviations which are not clear to them or request help with understanding entries which may be difficult to read for language or disability reasons the Access to Patients Records team will request the information / explanation or clarification from the relevant clinician / Directorate. This information should be provided to the applicant within 21 days of the request. Who has access? The deceased patient s personal representative, executor or administrator. Any person who may have a claim arising out of that person s death. Who has the duty under the Act? Because in many situations the patients healthcare record will be compiled by many health professionals the Act provides for access to be given by the holder of the healthcare record after consultation with the appropriate health professional(s), normally the practitioner who was or is responsible for the clinical care of the patient to which the application refers. Application forms are available from the Access to Health Records team at QEQM Hospital, Margate. Applications must be in writing using Appendix 3 application form. The applicant must provide evidence to support their request as detailed on the application form. 4

5 Implications of not following the process: If the access requirements of patients and/or their representatives are not addressed within the boundaries of the statutes, the Trust can be liable for enforcement action under the Data Protection Act 1998 or a court order following action under the Access to Health Records Act Monitoring process: All requests are logged by the Health Records Access Team. Monthly indicators produced and monitored by Health Records Committee. Exceptions: None Useful contacts: Access to Health Records Team / / Access to Health Senior Administrator Information Governance Manager Legal Manager Health Records Service Manager: Ext / Health Records Operational Managers: Ext / / Health Records Business Administrator: Ext / Produced by: Health Records Services Manager Distributed: Trust-wide via SharePoint Date Approved: June 2012 Approved by: Health Records Committee Job Title of signatory: Lead Nurse and Chief Officer Date last reviewed: March 2013 Review date: June 2015 Person responsible for review: Health Records Services Manager 5

6 Procedure for the supply of healthcare records made under The Data Protection Act 1998 or The Access to Health Records Act 1990 APPENDIX 1 Request is received from the individual, their legal representative or Government bodies including other NHS providers for copies of healthcare records under the Data Protection Act 1998 (DPA) or the Access to Health Records Act 1990 (AHRA). Request is recorded on Access to Records data base and spread sheet. Government bodies Consent is provided if applicable to Access to Records. If information is not obtainable by Health Records then required information is requested i.e. X-Rays from Medical Imaging Access database updated. Healthcare record(s) are copied/scanned and dispatched via recorded delivery or when appropriate, faxed or ed. Access database and spread sheet updated No charges are raised Is the request from the individual, legal representative or Government body? Individual Application form (Appendix 2 for applications made under the DPA and Appendix 3 for applications made under the AHRA) and a letter explaining the charges are sent to the applicant.. Application form and payment for DPA requests are returned to the Access to Records department. Healthcare records are located and consent for release is obtained. If information is not obtainable by Health Records then required information is requested i.e. X-Rays from Medical Imaging Access database and spread sheet are updated. Legal representative Application & consent is provided to Access to Records. If information is not obtainable by Health Records then required information is requested i.e. X-Rays from Medical Imaging Access database and spread sheet areupdated. Note If within the application it states litigation is being taken against the Trust then the application is forwarded to the Legal Department. Healthcare record(s) are copied/scanned and dispatched via the DX courier service or recorded delivery. The Finance Department are informed and an invoice sent to the legal representative for payment. Access database updated. 6

7 DPA Was the application made under the Access to Records Act or Data Protection Act? AHRA Healthcare record(s) are copied/scanned applicant s payment is deposited with the Finance department and a receipt obtained. Access database and spread sheet are updated. Healthcare record(s) are copied/scanned and the applicant is informed of the cost by phone. Once payment has been received it is deposited with the Finance department and a receipt obtained. Access database and spread sheet are updated. Are copied/scanned healthcare records being collected in person or sent by Collected A date and time of collection is agreed with the applicant who are advised to provide photographic proof of their identity using an approved form of identification, i.e. Driving Licence or Passport. Where an applicant is unable to provide photographic proof of identity a birth certificate and 2 utility bills showing both the clients address and dated within 3 months of the original correspondence must be produced. Sent by courier Copied/scanned healthcare records and a receipt of payment are sent to applicant via recorded delivery. Written confirmation of receipt will be provided (Appendices 6 and 7) Access database and spread sheet are updated. Written confirmation of receipt will be provided (Appendices 6 and 7) Access database updated. Provision of information for all applications made under the Data Protection Act 1998 and the Access to Records Act 1990 is 40 days from receipt of completed applications forms and applicable fee. The exception is when an application has been made under the Access to Records Act 1990 and the application subject has entries recorded within their healthcare records within the previous 40 days from when the application made. Under these circumstances provision of all information is 21 days from receipt of completed applications forms and applicable fee. 7

8 Procedure for patient viewing of healthcare records under The Data Protection Act 1998 or The Access to Health Records Act 1990 Request is received from applicant to view healthcare records. Application form (Appendix 2 for requests made under the DPA and Appendix 3 for requests made under the AHRA) and a letter explaining potential charges are sent to applicant. Application form is returned to the Access to Records department. Healthcare records are located and consent for release is obtained. Are there entries in the healthcare record from the previous 40 days? Yes No Applicant is not charged a search fee of Applicant will be charged a search fee of after viewing of their healthcare records. A venue, date and time of appointment is arranged with the applicant. Applicant is advised of any charges they will/may incur. All details are confirmed in writing to the applicant. Applicants attending their appointment must provide photographic proof of their identity using an approved form of identification, i.e. Driving Licence or Passport. Where an applicant is unable to provide photographic proof of identity a birth certificate and 2 utility bills showing both the clients address and dated within 3 months of the original correspondence must be produced. NB - If the applicant is a current inpatient or has a future outpatient appointment, a viewing of the healthcare records can be arranged during treatment. If neither is possible or acceptable, an application form (Appendix 3) will need to be provided to the applicant to complete and return to the Access to Records department 8

9 Should applicants request assistance with an explanation for any medical terms or abbreviations which are not clear to them or request help with understanding entries which may be difficult to read for language or disability reasons the Access to Records team will request the information / explanation or clarification from the relevant Clinician / Directorate. This information should be provided to the applicant within 21 days of the request. DPA Are copies of applicants healthcare records required? Was the application made under the Access to Records Act or Data Protection Act? AHRA Are copies of applicants healthcare records required? Yes No No Yes If copies of the healthcare records are requested there will be a maximum of fee inclusive of any search fee collected from applicant. Written confirmation of receipt will be provided see Appendices 5 and 6. If applicable, search fee of is collected from applicant. Written confirmation of receipt will be provided see Appendices 6 and 7. If copies of the healthcare records are requested then applicants will be charged at 25p per sheet copied exclusive of any search fee collected from applicant. There is no maximum fee. Written confirmation of receipt will be provided see Appendices 5 and 6. Applicant s payment is deposited with the Finance department and a receipt of payment is obtained. 9

10 APPENDIX 2 To avoid delay, please read and complete all sections of this form. Application for Access to Personal Information under the Data Protection Act Applicants requesting to either view or collect copies of healthcare records must provide photographic proof of their identity using an approved form of identification, i.e. driving licence or passport. Patient s Name: Previous Name (if applicable): Address: Postcode: Daytime Telephone No: Date of Birth: Details of information required: The Act allows access to all information held by the Trust. Please detail below the episodes of care you require Access to, giving as much information as possible. Hospital Number (if known) Hospital Inpatient Episodes Date of Admission Consultant s Name Outpatient Episodes Date of Attendance Consultant s Name Other Episodes (e.g. A&E, physiotherapy) Additional Information 10

11 Details of Applicant (if different from above) Name: Address: Postcode: Telephone Number: Declaration This section must be completed by the applicant. Please identify in which respect you are applying for access. I declare that the information given by me is correct to the best of my knowledge and that I am entitled to apply for access to the health record referred above under the terms of the Data Protection Act I am the patient I have been asked to act by the patient and attach the patient s written authorisation I am acting in loco parentis. (1) the patient is under the age of 16 and is incapable of understanding the request (2) understands and has consented to my making the request Please delete as appropriate. Signed: Date: 11

12 Certification - NOT TO BE COMPLETED BY A RELATIVE/PARTNER This section must be completed as proof of the applicant s identity. It will not be possible to process this application unless this section has been completed. I (insert full name) certify that the applicant (insert name) has been known to me as (insert in what capacity, e.g. employee, client, friend, patient etc.) for years, and to the best of my knowledge and belief, the facts stated above are correct. Signed: Date: Address: Telephone Number: WARNING You are advised that the making of untrue statements in order to help secure access to personal information to which the applicant is not entitled is a criminal offence. Completed forms are to be returned to: Access to Health Records Office Health Records Services Queen Elizabeth the Queen Mother Hospital St Peters Road Margate CT9 4AN 12

13 APPENDIX 3 To avoid delay, please read and complete all sections of this form. Application for Access to the Health Records of Deceased Patients under the Access to Health Records Act, Applicants requesting to either view or collect copies of healthcare records must provide photographic proof of their identity using an approved form of identification, i.e. driving licence or passport. Patient s Name: Previous Name (if applicable): Address: Postcode: Date of Birth: Details of information required: The Act allows access by the patient s personal representative and any person who may have a claim arising out of the patient s death, to the relevant part of the deceased patient s health record. Please detail below the episodes of care you require access to, giving as much information as possible. Hospital Number (if known) Hospital Inpatient Episodes Date of Admission Consultant s Name Outpatient Episodes Date of Attendance Consultant s Name Other Episodes (e.g. A&E, physiotherapy) Additional Information 13

14 Details of Applicant Name: Address: Postcode: Telephone Number: Declaration This section must be completed by the applicant. Please identify in which respect you are applying for access. I declare that the information given by me is correct to the best of my knowledge and that I am entitled to apply for access to the health record referred above under the terms of the Access to Health Records Act, I am the deceased patient s personal representative and attach confirmation of my appointment. I have a claim arising from the patient s death and wish to access information relevant to my claim on the grounds that:.... and I understand that the right of access is restricted to information relevant to any such claim. Signed: Date: 14

15 Certification - NOT TO BE COMPLETED BY A RELATIVE/PARTNER OF APPLICANT This section must be completed as proof of the applicant s identity. It will not be possible to process this application unless this section has been completed. I (insert full name) certify that the applicant (insert name) has been known to me as (insert in what capacity, e.g. employee, client, friend, patient etc.) for years, and to the best of my knowledge and belief, the facts stated above are correct. Signed: Date: Address: Telephone Number: WARNING You are advised that the making of untrue statements in order to help secure access to personal information to which the applicant is not entitled is a criminal offence. Completed forms are to be returned to: Access to Health Records Office Health Records Services Queen Elizabeth the Queen Mother Hospital St Peters Road Margate CT9 4AN 15

16 APPENDIX 4 1 STATEMENT BY PATIENT REGARDING ENTRY IN HEALTHCARE RECORD Data Protection Act Extract from NHS Executive Data Protection Act Protection and Use of Patient Information. Rights of rectification If the data subject believes that data recorded about them are inaccurate the person may apply to the court, for an order, or to the Information Commissioner* for an enforcement notice, either of which may require that the inaccurate data, and any expression of opinion based on it, is rectified, blocked or destroyed. However, where the data is inaccurate but accurately records information given by the data subject or another person the Court or the Commissioner may instead order that the record should be supplemented by a statement of the true facts as approved by the court/commissioner. Should the Trust agree with the data subject s request it would not be necessary for the data subject to follow the above procedure(s). However, if the data subject (patient) declines to follow either of the above procedures, and the Trust is not in agreement with their request, this document will be placed in the relevant section of the health record. Relevant Entry (Patient to copy here) Comments patient wishes recorded Signed: Date: Placed in Health Record by: Designation: Date: * Information Commissioner s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Tel: Fax: A photocopy of this document is to be given to the patient. 16

17 APPENDIX 5 Access to Records Health Records Services East Kent Hospitals University Foundation NHS Trust Queen Elizabeth the Queen Mother Hospital St. Peters Road Margate Kent CT9 4AN Tel: Fax: DX MARGATE 90 CT Date: Patient No: I confirm that I have received a CD of x-rays relative to healthcare records for *the above patient / myself. * Delete as appropriate. Name: Address: Postcode: Telephone Number: NB: Applicants collecting copies of healthcare records must provide photographic proof of their identity using an approved form of identification, i.e. Driving Licence or Passport. Where an applicant is unable to provide photographic proof of identity a birth certificate and 2 utility bills showing both the clients address and dated within 3 months of the original correspondence must be produced. 17

18 APPENDIX 6 Access to Records Health Records Services East Kent Hospitals University Foundation NHS Trust Queen Elizabeth the Queen Mother Hospital St. Peters Road Margate Kent CT9 4AN Tel: Fax: DX MARGATE 90 CT Date: Patient No: I confirm that I have received copies of healthcare records for *the above patient / myself. * Delete as appropriate. Name: Address: Postcode: Telephone Number: NB: Applicants collecting copies of healthcare records must provide photographic proof of their identity using an approved form of identification, i.e. Driving Licence or Passport. Where an applicant is unable to provide photographic proof of identity a birth certificate and 2 utility bills showing both the clients address and dated within 3 months of the original correspondence must be produced. 18