For the past year we have helped our clients navigate countless requests for full medical records from solicitors, with consent from the patient. Since the solicitor is acting as a ‘proxy’ for the patient, they are classed as Subject Access Requests (SARS).
Noise around SARs is most commonly around costs or burden. Our concerns here are around who is making the request, proper consent and proportionality
Let’s suppose we have a 48-year-old female who was in an accident and broke her leg three months ago; in order to represent her effectively the Solicitor will assert that they need access to the full medical record. Let’s suppose this female above in her lifetime has had measles, vaccinations, miscarriage, pregnancy, cancer, mental health problems, sexual health concerns. The fact is that in most injury claims, the entire medical record is not necessary.
Of course, it’s not just her solicitor that will have access to all this very personal information; there are colleagues, paralegals, a medical reporting company, the defendant, the defendants’ solicitors, court officials…the list goes on.
As a controller, the GP practice has an obligation to ensure that disclosures are proportionate and that they discharge their duties with a view to protecting patient rights including their right to be protected from interference with their privacy. The access rights are intended for data subjects – to support their understanding of data processing and to hold Controllers accountable.
Our advice to customers until now has been to contact the patient and advise them of exactly what ‘full medical record’ means and that they have a right to narrow the request to information that is relevant to the case.
The reaction from solicitors has been largely one of strong objection. They need everything. They simply cannot represent the patient without it.
What an awful quandary for patients, you may lose the opportunity to seek legal redress and therefore compensation. Not always a helpful windfall – often critical funding to cover the cost of being injured.
Solicitors often add to their form “if there is anything you don’t want us to see, tell us about it.” You can see how that works right? I don’t want you to know I had a termination….
A patient recently wrote saying “my solicitor is adamant he needs it all and whilst I’m not sure it is necessary; I feel I have no choice”. ‘Freely given’ consent? Appropriate use of subject rights? We don’t think so.
In the past, the ICO have written to the insurance sector, recommending that they cease abusing subject access rights to serve their own commercial purposes. They must have a proportionate report and trust that the information provided has been tailored for their request. In this instance, solicitors do not have lawful consent and are not seeking proportionate information. We have raised our thoughts with the ICO and await some formal guidance. Watch this space!
