Accessing health records and personal information

Can I see the information held about me and my child? 

Under Article 15 of the General Data Protection Regulations (GDPR) and Data Protection Act 2018 you have the right to receive a copy of the personal information about you as a patient or your child. Please download and complete the application form.

How does it work?

Right to Access (Subject Access Requests) Article 15 GDPR

• All data subjects, or someone acting on their behalf, can request a copy of their personal data held by Alder Hey Children’s NHS Foundation Trust (the Trust).
• Young people with the capacity, have the legal right to access their own health records and can allow or prevent access by others, including their parents. In England, anyone aged 13 or over is legally presumed to have such capacity (it is aged 12 or over in Scotland). They would not be given access to information that would cause them serious harm or any information about another person without the other person’s consent.
• Alder Hey has one calendar month to provide the personal data requested. If the personal data being requested is complex or there is significant personal data to review, then Alder Hey is able to extend this period by a further two months. Alder Hey will notify the requestor of the extension to the timeframe and explain why this is necessary within one calendar month of receipt of the initial request.

Accessing Information about a deceased person – Access to Health Records Act 1990 (AHRA)

• Health records are normally held for 10 years after the date of death.
• The AHRA provides certain individuals with a right of access to the health records of the deceased individual. These are defined by the Act as “the patient’s personal representative and any person who may have a claim arising out of the individual’s death.”
• A personal representative is the executor or administrator of the deceased individual’s estate. Proof of your authority to access the record will be required.

Can Alder Hey withhold any information?

Yes. There are circumstances where Alder Hey is entitled to withhold information:

• If third-party data is included in the personal data being requested this will be redacted unless we have consent from the third party to release their personal data.
• Alder Hey may on occasion be unable to provide access to personal data held if the release is likely to be detrimental to health or cause harm. These circumstances would be reviewed on a case-by-case basis.
• If the disclosure would put at risk a criminal investigation or catching an offender.

Is there a charge?

Alder Hey must provide a copy of the personal data free of charge. However, we can charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive. Alder Hey may also charge a reasonable fee to comply with requests for further copies of the same personal data. The fee will be based on the administrative cost of providing the personal data.

Rights of rectification/erasure of information held

What are the rights of rectification?

Under Article 16 of the GDPR individuals have the right to have personal information corrected if it is inaccurate or incomplete.

Contemporaneous records will not be altered or amended unless the information is proven to be incorrect or misleading as to any matter of fact. Where there is a difference of opinion between the maker/holder of the record and the person (or their legal representative if the person is under 13 years of age or lacks capacity) to whom the information relates then an addendum should be added to the record, at the point where the information is being contended, indicating that the person has challenged the accuracy of the information and their reasons for this.

What is the right to erasure?

Under Article 17 of the GDPR individuals have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.  Generally, this right is not available within health care data due to the information we process often being essential to the provision of care.

How do I make a request for information to be rectified or erased?

If you would like to make a request for data held about you or your child to be rectified or erased, we require you to make your request in writing, outlining the data in question and your reasons for making the request, to the Access to Health Records Team who will process the request and respond within one calendar month.