Are you an existing policy holder?

Patient access requests for medical records

Rights of access

A patient’s right to delivery of medical records arises by virtue of one or a combination of the following:

  • General medical ethical principles
  • Data protection legislation
  • Freedom of information legislation

If a request doesn’t invoke the provisions of Data Protection or Freedom of Information legislation, then a GP has a general duty to deliver copies of the records in compliance with the Medical Council Guide to Professional Conduct and Ethics primarily by virtue of long established principles of medical ethics. Paragraph 33.5 of the Medical Council Guide to Professional Conduct and Ethics (8th Edition) states:

“33.5 Patients have a right to get copies of their medical records except where this is likely to cause serious harm to their physical or mental health. Before giving copies of the records to the patient, you must remove information relating to other people, unless those people have given consent to the disclosure.”

A request for access to medical records pursuant to Data Protection legislation is subject to a limited exemption contained in The Data Protection (Access Modification) (Health) Regulations, 1989 (as amended by the Data Protection Act 2018) which is similar to that contained in the Medical Council’s Guide, namely that the patient is not entitled to access if it would be likely to damage the ‘physical or mental health of the data subject’.

The FOI Acts (FOI) 1997- 2014 grant individuals a right of access to personal records concerning the individual, which are held by public bodies. Although a GP practice is not a public body, the HSE is and so FOI applies to medical records held by GPs in relation to patients who are medical card holders because the GP holds those patients’ records as custodian on behalf of the HSE.  FOI does not apply to the records of private patients.

Notwithstanding the above, we would advise that where GPs receive requests for GMS patients’ records, they should consider these requests themselves, unless the requester has expressly referenced FOI legislation and the records are very complex/lengthy.  The reasoning here is that a GMS patient is entitled to request their records directly from a GP under ethical/data protection principles in any event and so the GP should facilitate requests where possible.

Consent in writing

As an initial step, it is best practice to seek the consent of the patient and have it placed on the patient’s file. Good practice dictates that you always insist on a written request for records. Although this is strictly not required for a general private patient request, under FOI and Data protection legislation the request is not valid unless it is in writing. An email request is considered to be a request in writing.

Capacity and best interests

Before sending on the records to a patient you should be satisfied that the patient has the capacity to make the request and if so, that the request is actually being made by them. It’s not unknown for a family member to purportedly make the request in a patent’s name with the intention of intercepting the records. We recommend verifying the request by telephone as it is unlikely that you will have a specimen signature to compare. It also allows you an opportunity to talk to the patient and satisfy yourself of the patient’s capacity. If for any reason you doubt the patient’s capacity, you should insist that the patient attend the practice for a brief consultation before release. By doing so a GP can assess both whether the patient has capacity and whether or not it is in the patient’s best medical interests to receive the records. For example, in some circumstances, it may be harmful for a patient who has mental health issues to have direct access to their medical records and you are required in the best interests of the patient to deny access to the records if that is the case (harm test referenced above).

Review before delivery

We advise that before you release copy records to a patient you review the records carefully and consider each request on a case-by-case basis. If you have any queries in relation to a request for a copy of a patient’s medical records you can contact the advisory team at Medisec.

Consideration should be given to the purpose for disclosure and as to whether the patient wishes all records to be sent or whether a smaller subset of records would suffice and also if redactions are required. The Medical Council Guidelines require that information about other persons be removed from the records unless their consent is sought and obtained before disclosure. The requirement to redact parts of the records will have to be considered on a case-by-case basis and a GP needs to consider whether the redaction would defeat the purpose of the request for disclosure. By way of example, some notes may have been made on the patient’s records of a conversation between the GP and another family member concerning the patient.

The disclosure of this information without the consent of the third party mentioned is in breach of both the Guidelines and may also be a breach a duty of confidentiality to that other person which is implied by law. On the other hand the information about a third party contained in the records may be very relevant in a family law dispute where allegations of domestic abuse were reported to and documented in the records by a GP. A GP needs to consider the best interests of his patient in each case and make a clinical decision as to whether the information should be redacted. If you have any queries in relation to a redaction of a part of a patient’s medical records you can contact the advisory team at Medisec.

Insofar as delivery of the records may involve disclosing a consultant’s letters or documents, we also recommend as a matter of courtesy, that informing the consultant of the pending disclosure before the records are actually released in copy form.

If the patient’s records contain reports on the patient’s mental health, we recommend that the GP contacts the relevant author to confirm that they are satisfied for the records to be released and that they could not cause harm to the patient’s mental health. Perhaps a note to the effect that records will be released to the patient after a certain date, unless the author has returned with specific objections to their release would permit you to move forward with the request and at the same time involve the relevant author in the decision.

Always retain the original records within the practice and make sure that complete legible copies of the records are provided. We recommend that a GP should document carefully his decision-making process separate to the consultation records but nonetheless retain these notes in the patient’s file.

The Data Protection (Access Modification) (Health) Regulations, 1989 prohibit a person who is not a health professional from disclosing health data to an individual without first consulting the individual’s doctor, or “some other suitably qualified health professional”. This is only one of a number of reasons why it is inappropriate to delegate decisions relating to access a member of your administrative staff. Making sure third party information is redacted, is another. Some likely scenarios concerning access requests are worth considering:

Scenario 1

You receive a request from a solicitor seeking records under Data Protection Legislation in respect of a patient who you know is in long-term residential care. You are not sure if the patient has capacity to sign the form of authority received.


The patient is entitled to her records under Data Protection Legislation. You are entitled to evidence that your patient has capacity and may either directly or through the solicitor seek evidence of capacity such as from the Residential Centre’s doctor. If the patient doesn’t have capacity, you may still consider the request from next of kin (parent, guardian, sibling etc), provided you are satisfied that the patient’s best interests require disclosure and you obtain a written consent from the next of kin concerned.


If necessary, in circumstances where there is no capacity, ask the solicitor to explain in detail the reasons why access to the records is required. As the records are obviously going to be considered by third parties, consider if the purpose of release can properly be made by the disclosure of certain parts of the patient’s records only. Document carefully your decision-making process separate to the consultation records but still in the patient’s file.

Scenario 2

As a GP, you prepare reports based on GP records for a company. You have received the records from the employee’s solicitor at the request of the company with a request to prepare a report. After delivery of your report to the company, you receive an FOI request from the patient for all information that you hold concerning the patient.


Ensure a full form of consent to the examination and report to the company is obtained from the patient in writing before proceeding with the initial report. Make sure the patient understands the full implications of the consent such as type of report, who will receive it and the type of information that it will contain. If you discover an issue with the patient’s health previously undiscovered, immediately report this to the patient’s own doctor.

FOI is not applicable to this request, as this work is not carried out under the GMS scheme. You should suggest to the solicitor that he might wish to consider a request under ethical/data protection principles. Take no further action until you receive a valid request under one of the aforementioned heads.

Before disclosure, check to see if a legal privilege arises with respect to the report. If the report is prepared for the company in contemplation of or in furtherance of a court action, it will probably attract litigation privilege. If so, you can remove the report from the records before releasing.

You are not required to notify the company of the request as you are the data controller and data processor under Data Protection Legislation. If you consider the records may contain information over which the company could claim legal privilege, you may have to contact the company to explore this matter further. If the legal privilege referred to above does not apply and you have an ongoing working relationship with the company, you may wish to advise them as a matter of courtesy, that the request for a copy of the report has been received from the patient. This will need to be considered on a case by case basis.

If the legal privilege referred to does not arise you must then consider your overriding duty to ensure that disclosure of the records would not damage the physical or mental health of the individual;

Redact any confidential information given by third parties, notify consultants whose reports /letters appear on the records of your intention to disclose, if appropriate, consult with any psychiatrists and seek their advice and consent before disclosing the records;

Once satisfied with the above, you are required to send the records.

Document carefully your decision-making process separate to the consultation records retaining these notes in the patient’s file.

Scenario 3

Your patient has been treated for schizophrenia for many years. You receive a request in writing from the patient requesting their medical records without delay.

You must first consider the patient’s capacity to consent to the release of their records. Ask the patient to attend to discuss the reasons for the release of the records. You have a duty to listen to your patient and involve the patient in the discussions about their records. Decide if the patient has the capacity to request the records by determining their level of understanding and objectives.

If the patient lacks capacity, ascertain if anyone has legal authority to make decisions on behalf of the patient. For example, if the patient has been made a Ward of Court (or someone has been appointed in the role of Assisted Decision Maker), the Committee of the person of the Ward or the Assisted Decision Maker will have that authority and you should refer the matter to them for their consent. If in any doubt, contact the General Solicitors Office.

If the patient lacks capacity, before deciding whether to release the records or not, you must still consider if it is in the best interests of the patient to release the records by contacting his treating psychiatrist seeking his advice on whether to release the records and contacting any other relevant medical professionals involved in the patient’s care and persons close to him/her for their views.

If satisfied that the patient has capacity, you must decide if the release of the records would put the patient or others at serious risk of harm. You should contact his treating psychiatrist for his/her view regarding delivery of the records. Before delivering the records make sure to redact third party information and let the patient’s consultants know about the intention to release the records.

Document carefully your decision-making process separate to the consultation records retaining these notes in the patient’s file.


The contents of this publication are indicative of current developments and contain guidance on general medico legal queries. It does not constitute and should not be relied upon as definitive legal, clinical or other advice and if you have any specific queries, please contact Medisec for advice.

Subscribe to our marketing list!
We respect your privacy.