Subject Access Requests (SARS)
If you wish to see or have a copy of the information we hold about you, you can make a Subject Access Request or SAR by completing the Subject Access Request (SAR) form.
Note: Please be aware when emailing information to the Practice that we cannot guarantee the security of this information whilst in transit, and that by using this facility you are accepting the risk. If you choose to email us, we recommend that you do not include sensitive information with the body of the email.
Your request should specify you are making a request to access your own information, by clearly marking your request ‘subject access request’. Providing us with sufficient information will enable us to locate your required information in a timely manner. Please date your request and provide:
- Your full name, including any aliases, if relevant;
- Your up-to-date contact details, date of birth and NHS number if available;
- A comprehensive list of what personal information you want to access, based on what you need;
- Details, such as relevant dates/time periods, episodes of treatment, etc.
Where necessary, we may require acceptable proof of identification and address consisting of one item from List A and one from List B:
- A - Birth certificate, marriage certificate, passport or driving license;
- B - Bank/Building Society statements, recent utility bill, tax certificate, letter from Department of Work and Pensions.
All requests will be recorded and normally responded to within 30 days. If your request is complex or considered excessive, we may require extra time to consider your request which may take up to an additional two months. However, we will inform you if this is the case.
In most circumstances we will not charge to fulfil your request however, a reasonable fee may be charged for the administration of the request in certain instances, for example, if we think your request is manifestly unfounded or excessive or where further copies of information are requested.
The Practice is the data controller for the health records of patients registered with us. Where an individual is not currently registered with a GP or is deceased, then these records are held by NHS Wales Shared Service Partnership (NWSSP). Please visit the NWSSP website for further information.
The form is available to download here and can either be returned to the practice in person or emailed to Enquiries.yrhenorsaf@wales.nhs.uk
If you require a more specific letter with regards to certain diagnosis and treatments, these requests come under the remit of our Private Services and are not covered by a simple SAR request; these services are not covered under our contract with the NHS and therefore attract charges. These charges are required to be paid up front upon receipt of your request; our reception team will advise at the time your request is made.
Subject Access Requests (SARs) and children
A child can exercise their own data protection rights so long as they are deemed competent to do so. Generally, children aged 13 and over, are considered competent to make a SAR unless there is information to suggest otherwise. If the child (of any age) does not have sufficient understanding to exercise their rights themselves, you may allow a person with parental responsibility to exercise the child’s right to make a SAR.
If a SAR is made on behalf of a child who is deemed to lack capacity to act on their own behalf, information may be sent to a person with parental responsibility. However, this is not a decision that should be made automatically. In all cases the best interests of the child should be considered. It is possible to restrict information going to a parent where it is not considered to be in the best interests of the child, for example, where there are “do not disclose” notes on the child's record.
Third party Subject Access Requests
Individuals can authorise third parties (for example, solicitors) to make a SAR on their behalf. Health and care providers releasing information to solicitors acting for their patients and service users should ensure they have the individual’s written consent.
It is important to draw a distinction between SARs (made by someone acting on the patient’s behalf) and requests made under the Access to Medical Reports Act (AMRA). Requests under the AMRA are made by a third party who is not necessarily acting on the patient’s behalf - for example, an insurance company. If the request from the solicitor is for a copy of the patient and service user’s health record (or extracts of the record) it is deemed to be a SAR. If the request is asking for a report to be written, or it is asking for an interpretation of information within the record, this request would go beyond a SAR. It is likely that such requests will fall under the AMRA framework for which fees can be charged.
