Requests for personal data
Summary, the law, and other guidance
This online portal has been designed to assist individuals, and/or their representatives, to access copies of the information held about them by Nottinghamshire Healthcare NHS Foundation Trust (‘the Trust’). Service users and those authorised to act on the behalf of others can use this portal to submit ‘Subject Access Requests’ or requests for information relating to someone that has died. The Trust’s Information Governance team (including the Access to Information team) will monitor this portal to ensure that requests are responded to and actioned as appropriate.
Subject Access Requests
Article 15 of the UK General Data Protection Regulation (UK GDPR) gives individuals, and/or their authorised representatives, the right to access copies of the information that an organisation holds on them – with some exemptions. These requests are known as Subject Access Requests (SARs). There is no charge for SARs; except in certain circumstances - such as if you have already received a copy of the requested information – any cost will be based on administrative fees.
Before the Trust can process a SAR, we need to ensure that we have verified the applicant’s identity and, for representatives, that they have the necessary written consent, or other legal basis, to act on behalf of the individual. Once a valid request is received, and ID and/or a legal basis for sharing has been verified, the Trust should respond to requests within one calendar month; this deadline can be extended by a further two calendar months in some circumstances.
Before responding to SARs, there are exemptions that the Trust has a duty to consider, such as the duty to protect the confidentiality of ‘third parties’. More information regarding SAR exemptions can be found on the website of the Information Commissioner’s Office here.
Requests relating to people who have died
The Access to Health Records Act 1990 says that we can release copies of medical records to a patient’s ‘personal representative’ after their death (for example, someone with ‘Letters of Administration’ or is the executor of a will), or when an individual has a claim arising from a patient’s death. To ensure we’re compliant with the law, we would need a copy of the document that evidences you are a ‘personal representative’, or if you have a claim arising from their death then we’d need to know more about the claim so that we only consider releasing relevant information.
We can still consider your request if you were close with the person before they died, however in this case it’s really important that you tell us as much as you can about your relationship with the patient and why the information is required.
How to make a request
You can make a request for copies of personal data by creating an account and logging into the portal. There are six forms to choose from, the guidance below will help you select the one most appropriate for you:
Form 1 - Requesting a copy of your own information - Patients or service users.
This form should be used to request a copy of your own medical information. You’ll need to provide copies of (pictures are fine) two forms of photographic identity documents so that we can verify your identity.
Please note this form should not be used for patients of the Nottingham Centre for Transgender Health (please see ‘Form 4’ guidance below)
Form 2 - Requesting a copy of information relating to someone else (Solicitors and other professional bodies).
This form should be used by solicitors’ firms and other professional bodies. You’ll need to provide us with a copy of the patient’s written consent or identify another legal basis for us sharing the information.
Form 3 - Requesting a copy of information relating to someone else (family members, friends, advocates etc – NOT solicitors).
This form should be used by family members, friends, advocates etc, to request information about someone else. This form should not be used by solicitors – solicitors should use Form 2.
You’ll need to provide copies of (pictures are fine) two forms of photographic identity documents so that we can verify your identity. You’ll also need to provide us with a copy of a document which entitles you to the requested information – such as signed patient consent, a court order, Lasting Power of Attorney for Healthcare, etc.
Form 4 - Nottingham Centre for Transgender Health - Requesting a copy of your own information.
Patients of the Nottingham Centre for Transgender Health should use this form – the request will only be seen by members of the Information Governance team that have received training in relation to the Gender Recognition Act 2004. You’ll need to provide copies of (pictures are fine) two forms of photographic identity documents so that we can verify your identity.
Form 5 - Requests relating to people who have died.
This form can be used to request copies of the medical records relating to someone who has died. You’ll need to provide copies of (pictures are fine) two forms of photographic identity documents so that we can verify your identity. You will also need to provide us with evidence that you meet the criteria outlined under the Access to Health Records Act 1990 (see above), or provide us with additional information as to your relationship with the patient.
Form 6 - Requesting a copy of your own information – Employment information.
You can use this form if you are currently, or have been, employed by the Trust and would like to request a copy of your employment records. You’ll need to provide copies of (pictures are fine) two forms of photographic identity documents so that we can verify your identity.
User guide
Please find a user guide here.
Get Started Online
Using this portal is the most efficient way of submitting a request for personal data. Please use the link below to create an account with the portal and submit your request. We will acknowledge receipt of your request as soon as possible.
There is no requirement to use this online portal, you can also make a request by emailing AccesstoInformation@nottshc.nhs.uk, by calling 0115 969 1300 Ext 10444, or by writing to:
Information Governance, Duncan MacMillan House, Nottingham, NG3 6AA