Access to health records is governed either under the Data Protection Act 1998 or the Health Records Act 1990.

Access to records of living individuals is under the Data Protection Act. Health records in this context are defined as any records of information about the physical or mental health of an individual made by or on behalf of a health professional in connection with care of that individual.

Health records can be computerised or manual. Under the data protection provisions a charge of £10 is the maximum for computerised records only. A maximum of up to £50 can be charged in relation to a mixture of computerised and manual records.

An individual can request copies of their own medical records and they are entitled to apply to access to the total health record. Requests should be made in writing or by email to the person who has control (usually the GP practice manager or records manager for a hospital).

Generally (though not always) records are provided within a period of up to 40 days. There is no need to provide any reason as to why access has been requested.

Withholding records or failing to provide copies
Under limited circumstances access to some or all health records can be withheld. It can be denied or limited if the person who controls the records judges that the information in them may cause serious harm to the physical or mental health condition of the person involved or any other person. There are also restrictions in respect of any information relating to or provided by a third person who has not consented to that disclosure. However the person who makes the decision to withhold must be prepared to justify those decisions.

Unfortunately, whilst record holders are free to inform individuals of the fact that information has been withheld and the reason for that decision they are not obliged to do so.

Although there is a general obligation to provide copies of the records, this is not always the case. If it is not possible to supply a copy of the material sought for some reason or the cost of so providing it would be wholly disproportionate (where there are numerous records spread at various places) then the obligation to provide a copy may be waived. Costs alone would not be sufficient grounds to refuse to provide a copy.

Inaccurate information and complaints about entries in records
Inaccurate information in medical records can be challenged. Firstly an individual can make an informal approach to the particular health professional concerned in an attempt to have the health records amended. However, this is unlikely to be successful and therefore a complaint should be pursued under the NHS complaints procedure.

If this is unsuccessful, a further complaint can be made to the information commissioner who can rule that erroneous information is rectified, erased or destroyed. However, this is extremely rare. Further information of this can be obtained from the commissioner for information at Wycliffe House, Water Lane, Chesire, SK9 5AF.

In certain circumstances access and inspection of the records will be supervised and that is as a decision for the person controlling the records in conjunction with any healthcare professional.

Illegible or poorly written records should be translated and explained.

Records of the deceased
If records are sought in relation to somebody who is now deceased the Access to Health Records Act applies. A patient personal representative or executor can make a claim for access again in writing but it should also give details of the applicant's right to access records, ie. why they are seeking to do so. Those records are generally kept separately from the GP or practice and will therefore have to be accessed and returned to the GP who will then review them and make a decision as to whether access would be appropriate.

Fees in relation to the records of deceased people can be extremely expensive. £10 can be charged for access to health records themselves but copying and posting the records can be charged at a reasonable rate. In those circumstances copy records can sometimes cost several hundred pounds.

Records from a deceased individual should be kept for a minimum of up to 10 years. Records from a hospital generally are kept for about 8 years following the end of any treatment. It is quite usual after that stage for records to be routinely destroyed.