Access to health and staff records

You can access some of your hospital information through the Trust Patient Portal (Zesty) and the NHS App.

The patient portal is a secure online service that allows you to view some outpatient appointment details, letters, messages from your care team, allergies, questionnaires and some test results. If you are already registered for the NHS App, you can use the same NHS login to access the Patient Portal, although this may only show part of the information available.

Patients are usually invited to register when an outpatient appointment is booked or changed. Please note that the portal and NHS App may not contain your full record, so if you need a complete copy of your records or older information, you should still make a subject access request.

You can find more information about the Trust Patient Portal on the Trust website by searching for Patient Portal on the Kingston and Richmond NHS Foundation Trust website. The website also includes separate pages on Registering for the Patient Portal, Logging in to the Patient Portal and Using the Patient Portal if you need help getting started.

If you would like to use the NHS App, you can download it free of charge to a smartphone or tablet, or use NHS App services on a computer.

To get started, search online for Downloading the NHS App on the NHS website. You will need to create an NHS login if you do not already have one.

You will usually need your email address, a phone number and some personal details to confirm who you are. If you are aged 13 to 15, you may need to contact your GP surgery before you can use some NHS App services.

1. Requests for living patients are handled under UK GDPR and the Data Protection Act 2018. Requests for deceased patients are handled under the Access to Health Records Act 1990.
2. The following people can request patient records:

• the patient
• someone acting for the patient, such as:
  • someone with the patient’s written consent
  • a parent or guardian for a child under 13, or with the young person’s consent if they are 13 or over
  • an attorney named in a valid Lasting Power of Attorney for Health and Welfare
  • a court-appointed deputy under the Mental Capacity Act
  • the personal representative of a deceased patient, usually the executor of the estate
  • someone with a legal claim arising from the patient’s death

Timescales

We aim to provide records within one month of receiving your request and any identity documents we need. Please allow enough time if you need them for an appointment.

We cannot usually provide copies while a patient is in hospital because the records are still needed for care.

If another healthcare provider needs your records for your care, it is usually quicker for them to request the records directly from the service treating you. This includes X-rays, MRI scans and CT scans.

Fees

There is normally no fee for a subject access request. We may charge a reasonable fee or refuse a request if it is clearly unfounded, excessive or repeated. If this applies, we will write to you and, where possible, help you narrow your request.

We may ask for proof of identity to protect your confidentiality. We will only ask for information that is reasonable and proportionate, and we may also request supporting evidence where needed. Please see Appendix A for full details.

There is normally no fee for a subject access request. We may charge a reasonable fee or refuse a request if it is clearly unfounded, excessive or repeated. If this applies, we will write to you and, where possible, help you narrow your request.

To help us provide the right information as quickly as possible, please tell us exactly what you need. Being specific helps us find the correct records more quickly and avoids unnecessary searches.

For example, you can ask for your full health record, a particular episode of care, records from a specific clinic or service, admission or discharge information, copies of clinic letters, operation notes, test results, maternity records, therapy records, or information from a particular date or time period.

If you are asking for CCTV footage, please tell us the date, time and location as closely as possible. For example, you may want footage from a particular entrance, reception area, ward or corridor, or footage showing your arrival, departure or a specific incident. This helps us find the correct footage more quickly and may reduce the time needed to process your request.

If the request is too broad and locating, reviewing and redacting the footage would exceed the legal cost limit (18 staff hours), we may ask you to narrow your request, for example by providing a shorter time period, a more specific location or a particular camera.

Please note that CCTV is usually kept for a limited time, so it is important to contact us as soon as possible. Any footage released will usually need to be redacted to protect other people’s privacy.

The Trust will provide a copy of the requester’s personal data held within the health record, including diagnostic recordings such as CTG traces, ECG printouts and other monitoring outputs where these are held by the Trust.

All relevant clinical information recorded about the trace (for example observations, summaries and care notes) will be included within the records we disclose. A copy of the trace itself will not be necessary in most cases.

If you are asking for traces, please tell us the type of trace you need and the date or time period you want. For example, this might include cardiotocography (CTG) traces, fetal monitoring records, ECG traces or other monitoring printouts linked to a particular appointment, admission, labour or episode of care. Please include the clinic or service if you know it.

We will provide information electronically in a commonly used format wherever possible. Where a trace is held only in paper or large-format form, we will take reasonable and proportionate steps to locate it and to provide a copy where this can be done to an acceptable standard.

If the trace cannot reasonably be digitised or copied (for example, because it is very large/fragile, copying would significantly reduce legibility, or the effort required would be disproportionate), we will explain the limitation and offer an appropriate alternative to provide meaningful access, such as arranging for you (or your authorised representative) to view the original record.

Before records are released, we may ask the relevant clinician to review them. This helps us make sure that sharing the information would not cause serious harm to the patient or another person, and that we do not disclose information about other people where we are not allowed to do so.

Radiology images such as X-rays, CT scans and MRI scans are usually sent through our secure Image Exchange Portal. We will email you a link and send a PIN by text message. If you do not have a mobile phone, please give us a second email address so we can send the PIN there instead. Please check your inbox and junk folder. You will have 14 days to download the images. These copies are not for diagnostic use.

Other patient records are usually shared through our secure AMS portal. We will email you a link and secure access code. You will have 14 days to download your records or via secure email.

If you would prefer another form of disclosure, please let the team know when you make the application.

To protect confidentiality, we must be satisfied that you are the person named in the records or that you have the right to act for them. Please send the identity documents listed above with your application.

You have the right to see the information we hold about you. Sometimes parts of your records may be hidden or removed before we send them. This is called redaction. We only do this when we need to protect your privacy, someone else’s privacy, or where the law allows us to withhold information.

• To protect other people’s privacy. Your records may include information about another person, such as a family member, another patient or a member of staff not directly involved in your care. We may remove that information before sharing your records.
• If information was given in confidence. Sometimes someone shares information with healthcare staff on the understanding that it will not be shared more widely. In some cases, we may need to withhold that information.
• If sharing the information could cause serious harm. Very rarely, an appropriate healthcare professional may decide that seeing some information could cause serious harm to you or to someone else.
• Because of legal or safeguarding reasons. In some situations, the law may prevent us from sharing certain information, for example where there are safeguarding concerns or an ongoing investigation.

Redaction may appear as blacked-out text, blank spaces, or missing pages or sections. We will explain this in our response where appropriate.

If you think something in your record is wrong, you can ask us to correct it. Please contact the IG Team at krft.ig@nhs.net

If you are unhappy with how we handled your request, please contact our Data Protection Officer at krft.ig@nhs.net. You have the right to complain to the Trust, and you also have the right to complain to the Information Commissioner’s Office.

We will only use the information you provide to process your request. We keep request records in line with the Records Management Code of Practice. At present, this is 3 years after the request is closed, or 6 years if there is an appeal, after which the records are securely destroyed.

We will only keep your ID for as long as we need it to check your documents. It will then be deleted from our secure email system.

You should let us know if you disagree with something written on your file. You may not always be able to change or remove the information. However, we will correct factual inaccuracies and may include your comments in the records.

If you wish to access information about a deceased person who has been under the care of the Trust, please use the subject access process as above.

Your application will be processed under the Access to health records 1990.  GDPR and any subsequent data protection legislation only applies to living individuals.

To help us find and retrieve information for you, please state exactly what information you require, and provide the following details of the deceased:

Name, date of birth, date of death and last known address of deceased

This information is necessary to help us confirm if we hold records relating to the deceased and locate them for you.

Before we are able to release records about a deceased person, we will need:

• confirmation that the individual is in fact deceased, such as grant of probate or death certificate.
• proof of entitlement – one of the following:
  • grant of probate and certified copy of the last will & testament or
  • letters of administration – if the deceased died intestate

We need to identify that you are the personal representative of the deceased person or that you have a claim arising out of the patient’s death, to ensure that you are entitled to information about them. Please note that the rights of access to information passes to the personal representative on death.

Please also supply us with one form of identification for yourself, showing your name and current address. Acceptable examples of identification are drivers licence or passport.

If your request is through a solicitor who is acting for you, then we require a signed authority from them.

• Please complete the form here

We are unable to provide specific reports from doctors and other medical staff for Department for Work and Pensions (DWP) PIP applications. The Trust does not hold this information in a readily accessible form, and to complete reports and respond to specific questions can take a significant amount of time.

However, you may request a copy of your medical records if you feel this may help your case – please contact the Information Governance team: krft.ig@nhs.net.

A copy of your medical records can be provided to you, free of charge.