General Information

All manual and computerised health records about living people are accessible under the General Data Protection Regulation (GDPR) 2018 and the UK Data Protection Act 2018. Access must be given equally to all records regardless of when they were made. 

A health record exists to provide an account of a patient’s contact with the healthcare system. Health records consist of information relating to the physical or mental health or condition of an individual made by a health professional in connection with the care of that individual. 

When new patients register and we receive any paper records from a previous GP we scan them onto the electronic system.  

The information is most commonly recorded in electronic form, however, some records are in a manual form or a mixture of both. ‘Information’ covers expressions of opinion about individuals as well as facts. Health records may include notes made during consultations, correspondence between health professionals such as referral and discharge letters, results of tests and their interpretation, X-ray films, videotapes, audiotapes, photographs, and tissue samples taken for diagnostic purposes. They may also include reports written for third parties such as insurance companies.


Subject Access Requests (SAR)

A request by a patient, or a request by a third party who has been authorised by the patient, for access under the GDPR (and DPA 2018) is called a subject access request (SAR).  Individuals have a right to apply for access to health records irrespective of when they were compiled. To access your records at Newburn Surgery you will need to complete a SAR.

You can collect this form from reception or download the Subject Access Request form.
The form must be fully completed and failure to do so may result in delays in us getting your records to you.


Please note...

Below you will find information on how records can be accessed. We take keeping your data safe seriously and we strongly advise you to read the important information that follows. There is a lot to read, however, we explain fully how we are bound by legislation to make decisions regarding your data and also what you are entitled to access when it comes to your medical records. 


How to apply for access

SARs can be made electronically, in writing or verbally. 

Electronically: We would encourage patients to access their records online via SystmOnline.If you are not already registered for online access please speak to reception staff. If the request is made electronically access should normally be given in electronic format. 

Where patients request the medical record to be emailed to them we strongly recommended you reconsider due to the risk 
of unauthorised interception of the data as you are receiving your data via unencrypted means to a non-NHS email address.

If you do insist we will need to document each patient’s agreement (expressed in writing or via email) to receive their data via
unencrypted means.

It is acceptable if the patient requests, to use a USB stick or a CD as alternative electronic formats , however, these are to be supplied by the patient.

In Writing: You can also make a request in writing or

In person at reception, however,  you will need to come to the surgery to complete the SAR form (or download from website and bring it in).

We will need to verify your identity before giving you access to records. 

The form must be completed in full before we can deal with the request. The form should be given to reception staff who will ensure all the details are correct. We will then start the process and aim to have the request completed in the timeframe (see below).


How long will it take? 

Once the request has been received and verified we must provide the individual with a copy of their data without undue delay, and at the latest within 28 days from the date of the request.

  • Sometimes, additional information is needed before copies can be supplied. In such cases, the 28-day time limit will begin as soon as the additional information has been received.
  • The 28-day time-limit can be extended for two months for complex or numerous requests where we need more time to collate and supply the data. Individuals should be informed about this within 28 days and provided with an explanation of why the extension is necessary



Who can apply for access?

Patients with capacity have a right to access their own health records via a SAR (see below). Patients may also authorise a third party such as a solicitor to do so on their behalf. Competent young people may also seek access to their own records. It is not necessary for patients to give reasons as to why they wish to access their records. 


Children and young people under 18

Where a child is competent, they are entitled to make or consent to a SAR to access their record.

  • Children aged over 16 years are presumed to be competent. 
  • Children under 16 years in England, Wales and Northern Ireland must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR. However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records.

When assessing a child’s competence we are bound to explain the issues in a way that is suitable for their age. Where, in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR.

Where a child is considered capable of making decisions about access to his or her medical record, the consent of the child must be sought before a parent or other third party can be given access via a SAR.


Parental Responsibility

Not all parents have parental responsibility.

  • In relation to children born after 1 December 2003 (England and Wales), 15 April 2002 (Northern Ireland) and 4 May 2006 (Scotland), both biological parents have parental responsibility if they are registered on a child’s birth certificate. 
  • In relation to children born before these dates, a child’s biological father will only automatically acquire parental responsibility if the parents were married at the time of the child’s birth or at some time thereafter. If the parents have never been married, only the mother automatically has parental responsibility, but the father may acquire that status by order or agreement. 
  • Neither parent loses parental responsibility on divorce. 
  • Where more than one person has parental responsibility, each may independently exercise rights of access.
  • If a child who lives with his or her mother and whose father applies for access to the child’s records, in such circumstances there is no obligation to inform the child’s mother that access has been sought.
  • Where a child has been formally adopted, the adoptive parents are the child’s legal parents and automatically acquire parental responsibility. 


Next of kin

Despite the widespread use of the phrase ‘next of kin’, this is not defined, nor does it have formal legal status. A next of kin cannot give or withhold their consent to the sharing of information on a patient’s behalf. As next of kin they have no rights of access to medical records. 



  • A patient with capacity can authorise a solicitor acting on their behalf to make a SAR. Health professionals releasing information to solicitors acting for their patients should ensure that they have the patient’s written consent.
  • Solicitors must provide the patient’s written consent. The consent must cover the nature and extent of the information to be disclosed under the SAR (for example, past medical history), and who might have access to it as part of the legal proceedings. Where there is any doubt, health professionals should confirm with the patient before disclosing the information.
  • Should the patient refuse, the solicitor may apply for a court order requiring disclosure of the information.

We will not send original notes and records to patients or solicitors (or any other external parties) because of the potential detriment to patient care should the records be lost. 


Can access be refused?

There are several reasons we may refuse.

  • Information will not be disclosed if it is likely to cause serious physical or mental harm to the patient or another person.
  • If it relates to a thrird party who has not given consent (where the thrid party is not a health care professional who has cared for the patient)
  • If a third party has requested information and the patient has not consented.
  • By order of the courts 
  • In the case of children's records, disclosure is prohibited by law e.g. adoption records.  
  • Also if a request is ‘manifestly unfounded or excessive’, for example, because it is repetitive, access can be refused (or a fee can be charged). 


Will a fee be charged?

Generally not, unless the the request is "manifestly unfounded" or "excessive", which is expected to be a rare occurrence.

If you have any queries please contact the Practice Manager in the first instance. 

Where access has been refused we will give you an explanation as to why this decision was made and you do have the right to make a complaint to the Information Commisioner's Office (ICO).

This is the ICO website

You can write to the ICO at the following address or contact by telephone.

Information Commissioner's Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113
Fax: 01625 524510

Updated Jan 2020

Website AccessibilitySurgery NewsContact the PracticeFind us on FacebookConditions and TreatmentsFind Local Services

NHS 111

111 is the NHS non-emergency number. It’s fast, easy and free. Call 111 and speak to a highly trained adviser, supported by healthcare professionals.

Patient Survey

How likely are you to recommend this Surgery to friends and family if they needed similar care or treatment?  Please spend 2 minutes to take the Friends and Family Test.


The NHS website. Take control of your health and wellbeing. Get medical advice, information about healthcare services and support for a healthy life.

Patient UK

Patient is one of the most trusted medical resources online, supplying evidence based information on a wide range of medical and health topics to patients and health professionals.

Top of Page