Dáil Éireann Debate, Wednesday - 13 June 2018
138. Deputy Thomas P. Broughan asked the Minister for Health his plans to change the law to allow persons timely and free access to their medical records in view of the fact that persons may have to make a request under data protection legislation (details supplied); and if he will make a statement on the matter. [25887/18]
View answerI am fully supportive of individuals being able to access their own personal medical records routinely and administratively (that is on a non-statutory basis) from data controllers in health services except where there are exceptional circumstances justifying a restriction of access Such access should be provided in a timely manner and without any cost to the individual.
Alternatively, individuals may, should they wish, invoke their statutory rights of access under the Data Protection Act 2018 and the Freedom of Information Act 2014.
Under the subject access provisions of the new General Data Protection Regulation and the recently enacted Data Protection Act 2018, data controllers should respond to an individual access request within one month of receipt of the request. In limited circumstances, the response period may be extended to two months, where requests are complex or comprise a number of requests. An individual’s access to his or her medical records may be restricted where the data controller believes that access is likely to cause serious harm to the physical or mental health of the data subject. No fee is payable where the request is by an individual to access his/her personal records. However, where a controller believes a request is manifestly unfounded or excessive, they may either charge a fee for administrative costs in dealing with the request or refuse to act on the request. The burden of demonstrating why a request is manifestly unfounded or excessive rests on the health service provider.
Access to one's medical records may also be made under the Freedom of Information Act 2014 if the records are held by a public body within the meaning of the Act. The FOI Act applies to the HSE and to voluntary hospitals as well as to a number of health agencies. It does not apply to private hospitals. It applies to records kept by GPs in relation to patients who are medical card holders but not to the records of private patients. The HSE is considered to hold the records of medical card holders for FOI purposes. Under the FOI Act, an individual’s access to his or her medical record can be restricted where the body holding it believes that to give access might be prejudicial to physical or mental health, well-being or emotional condition of the individual. However, where that view is taken the body, access may still be possible through a health professional having expertise in relation to the subject-matter of the record. No fees are applicable where the request involves access to an individual’s own personal records. FOI bodies have 20 working days to process such requests.
I would also highlight to the Deputy the Medical Council’s Guide to Professional Conduct and Ethics (8th Edition) which states that patients have a right to get copies of their medical records except where this is likely to cause serious harm to their physical or mental health.
I am firmly of the view that patients should have timely access to their personal medical records with no additional cost or administrative burden and will be keeping this matter under review.
