Accessing your medical records

Legal rights and access to medical records

Who do medical records belong to?

To the patient.

Do I need a reason to obtain a copy of my medical records?

No.

Who holds my medical records?

Your GP physically holds your GP records. However if you are the holder of a medical card, the HSE is the body legally responsible for your records. If you are a private patient with your GP, they are legally responsible for your records.

Your hospital notes and records are kept by the administrative body that manages the hospital. Most hospitals, public or private, will have a medical records department that will deal with all requests for medical records. If your hospital is a public hospital, the HSE are the body responsible for your records, if your hospital is a private hospital, then that hospital is the body responsible for your records.

What legislation deals with access to medical records generally?

The Data Protection Act, 2018 and the GDPR apply to both public and private medical bodies and professionals. The  Freedom of Information Act 2014 applies only to public bodies such as the HSE, public hospitals and GP’s where the records relate to patients with medical cards.

The Data Protection Act 2018 and the GDPR do not apply where the patient has died. In such instances, the Freedom of Information Act 2014 applies.

How do I get a copy of my medical records?

You must write to your GP, HSE, health care provider or hospital seeking a copy of the records.  Under the Data Protection Act, 2018 you will be making a subject access request (SAR) for the records.

If you are applying under the Freedom of Information Act 2014, you make the application under that legislation.

In all instances you will be expected to give your full name and address, your date of birth, the nature of the records you require and for what period, proof of your identity (passport or driving licence) and how you want the records to be copied to you i.e. in hard copy or electronic form. Most GP’s and hospitals have a website which sets out in more detail what documentation is required to enable you to access your medical records. Many have a pro forma consent form already prepared which can be downloaded and completed.

Do I have to pay for my records?

Normally, no fee is payable.

How long must I wait for the records?

If the request is under the Data Protection Act, 2018 then you can expect the records within one month. If the matter is complicated then an extension of a further two months can be given.

If the request is under the Freedom of Information Act 2014, you can expect a decision as to whether you are entitled to the records within 20 working days of the request albeit getting a copy of the actual records can take longer.

Can my request be refused or not fully granted?

Yes, under the Data Protection Act, 2018 where:

• information can identify another individual
• information provided by another individual in confidence about the patient
• information likely to cause serious harm to the physical or mental health of the patient, if it was disclosed

Yes, under the Freedom of Information Act 2014 where:

• healthcare professionals believe that information in the records is likely to cause serious harm or distress to you or another person
• details about third parties are included in the records. These details will have to be deleted

Do I have a right of appeal if my request is refused or not fully granted?

Yes, if the request has been made under the Data Protection Act, 2018 then you can appeal to the Data Protection Commission.

Yes, if the request has been made under the Freedom of Information Act, 2014, the appeal is to the Internal Reviewer named in the letter refusing the request. This appeal must be made within 4 weeks and a decision given within 15 working days. A further appeal is to the Office of the Information Commissioner. Time limits apply.

How can I get my child’s records?

You will have to show that you are the parent or guardian of the child in question. The child’s consent may also be necessary even if the child is under the age of 18 if they have the capacity to consent. The record keeper must have regard as to whether the disclosure of the records is in the best interests of the child.

Can I obtain the records of a dead relative?

Persons entitled to apply are:

• The personal representatives named in a grant of representation in respect of the deceased’s estate
• A person appointed by the court or statue to administer the deceased’s affairs
• The spouse/former spouse or partner/former partner or next of kin of the deceased. In this instance, the record holder will have to consider if the deceased did not wish for any or part of their information to be disclosed

What is the difference between the Data Protection Act 2018 and the Freedom of Information Act, 2014?

The key difference between these two laws is their scope and purpose. The Freedom of Information Acts are designed to give the public the right to access information held by public bodies, including health service providers. It allows individuals to request access to information about themselves or another person, subject to certain exemptions.

On the other hand, the Data Protection Act 2018 is focused on protecting individuals' privacy rights and ensuring that personal data is processed fairly and lawfully. This law gives individuals the right to access any personal data that an organization holds about them, including their medical records. However, unlike the Freedom of Information Acts, the Data Protection Act 2018 only applies to personal data held by private organizations or public bodies acting in a commercial capacity.

In summary, while both the Freedom of Information Acts and Data Protection Act, 2018 can be used to request medical records in Ireland, the Freedom of Information Acts are focused on accessing information held by public bodies, while the Data Protection Act 2018 is focused on protecting individuals' privacy rights and ensuring that personal data is processed lawfully.

Unless you are applying for access to medical records for a deceased person, in our opinion it is more straightforward to apply for your records under the Data Protection Act, 2018 using a subject access request.

Can my solicitor obtain my medical records?

Yes. You will have to sign a written authority prepared by your solicitor to the health professional concerned that allows access to your records. You will normally also have to give copy photographic ID as well.

Will my solicitor have to pay for my records?

The same rules and fees that apply to you apply to your solicitor. Your solicitor is acting as your agent.

If there is a power of attorney, can my attorney access my medical records?

That depends on the nature of the power of attorney. If the power of attorney gives your attorney power to access and copy your medical records, then they will be disclosed to your attorney. The health professional concerned will likely ask for sight of the power of attorney. The same rules that would have applied to you re such disclosure, will apply to your attorney.

What happens if my records are disclosed to someone without my authority?

Such unlawful disclosure will be in breach of the GDPR and the Data Protection Act, 2018. This is a serious matter and you can make a complaint to the Data Protection Commission. You will also have a right of action for damages against the person or body who made the unlawful disclosure.

However, there are specific instances where it can be lawful to disclose records without your consent:

• where required by law
• where required by a court order
• where necessary to protect the public from serious harm, for example, the protection of vulnerable adults
• where required for monitoring certain health conditions
• monitoring of death

In some of these instances, records will be anonymized.

Who are the Kearney Law Group?

Kearney Law are a legal firm that only does personal injury law. We are passionate about our work and are easy to talk to. Our commitment to our clients makes us excel in what we do. We are tech savvy and use software platforms to ensure your case is dealt with expeditiously and professionally.

We only do personal injury law and are experts at it.

For further assistance please ring us at 01 4853560 or email us on [email protected] or fill in our contact form

The content of this blog is provided for information purposes only and does not constitute legal or other advice. No solicitor/client relationship or duty of care or liability of any nature shall exist or arise between Kearney Law and you and Kearney Law refer you to the Disclaimer on its website.

In contentious business, a solicitor may not charge or calculate fees or other charges as a percentage or proportion of any award or settlement.