Access to Information

A For service users

In general

General Medical Council advice to members recommends a very high standard of openness towards patients, as a matter of ethical standards. It says You should not withhold information necessary for decision making unless you judge that disclosure would cause the patient serious harm – and this is not so if the concern is merely that the patient would become upset or decide to refuse treatment.

The guidance also recommends the use of visual and other aids to explain complex aspects of clinical diagnosis or prognosis; meeting the language and communication needs of patients; considering the tape recording of a consultation, exploring probabilities of success or risks, etc; advising of counselling and patient support groups where relevant; giving adequate time for reflection before a decision is required, and mentioning procedures for reviewing the decision later.


With regard to information about death of patients, the guidance suggests that if a patient under 16 has died, the medical professional must explain to the best of his or her knowledge the reasons for and the circumstances of the death to those with parental responsibility for the child. It goes on to suggest that if an adult patient has died, the medical professional should provide this information to the patient’s partner or next of kin, unless it is known that the patient would have objected.

The NHS ombudsman would take into account breach of both these pieces of guidance, in deciding whether appropriate professional standards have been adhered to.


Individual Health and Social Services Records

The NHS and social services authorities are expected to know how an application for access to records should be handled, the exemptions where access can be denied, and about the appeals system to the Data Protection Commissioner or the courts about access rights.

In recent years, authorities have generally adopted policies of client access to records and openness in recording, covering matters such as access procedure, disclosure and destruction of personal information, the description of notified purposes for which information may be passed on (which all authorities are obliged to submit to the Information Commissioner), and manual record keeping.

Under the Access to Health Records Act 1990 – ss3 – 7 people were entitled to see their health records unless certain concerns are held by the doctor in charge. In so far as the 1998 Data Protection Act now replaces that older Act, some critics think it has made the situation less clear rather than more so. So commentators expect human rights challenges based on article 8 of the Convention to be likely to strengthen the arguments for a generous interpretation of the Act, and the common law.


What is a health record?

The definition of a s68 health record is not completely without ambiguity. It includes information relating to the physical or mental health or condition of an individual, but it has to be made by or on behalf of a health professional in connection with the care (including the examination, investigation diagnosis as well as treatment) of that person. It therefore covers anything created by someone working in the NHS, but not psychotherapists, and not complaints staff.

Refusal of access

The DPA contains over 30 reasons for refusing access requests, but none will really prevent access to one’s own health and social services records. Wholly exempt grounds include Legal professional privilege, Adoption records and Human fertilisation and embryology information.

Partial exemption covers personal data consisting of information as to the physical or mental health or condition of the data subject. It is exempt, if it is processed by a court in relation to family law and youth justice proceedings.

Exemption is given to the extent that release would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person. Any affected third party can be asked to consent, and if so, access must be granted.

The Data Protection (Subject Access Modification) (Social Work) Order 2000 provides that personal data for purposes of social work are exempt from subject access provisions where the disclosure to the data subject would be likely to prejudice the carrying out of social work, by causing serious harm to the physical or mental health or condition of the data subject or another person – eg where disclosure would prejudice a child protection or adult protection plan.

A similar Modification for Health has been passed, which means that the authority must not disclose information about physical or mental health or condition to the patient, without first consulting an appropriate health professional, such as a GP or psychiatrist.

Handling a request for access

The Act allows departments 40 days in which to respond to requests for access to personal data. A written request and a fee are required. Where complying with a request could result in the disclosure of information about another, or which could identify another person as the source of the information, then only so much of the information is to be disclosed as is possible without revealing the identity of the third party. The information may only be disclosed with the consent of the other person, or where it is reasonable in all the circumstances to comply with the request without consent.

Where data requested contains details of an individual~s mental or physical health, such data must not be disclosed until after consultation with and approval has been obtained from the appropriate health professional.

When refusing access to information, Authorities must tell subjects the reasons for refusal, distinguishing between relying on an exemption, and not being able to obtain the consent of another person whose identity would be disclosed.

Remedies for refusal of access

A person refused access to health information can complain to the Information Commissioner who must conduct an assessment of the decision process and can issue enforcement notices. Also the NHS complaints process can be used; and there is a special procedure in the Code of Practice on Openness in the NHS, involving the chief executive, and then complaint to the Ombudsman. Finally, one may apply to the High Court or County Court for an order enforcing rights of access under the DPA or AHRA. If the information sought is outside the subject access rights, a person could still complain to the Ombudsman or commence a judicial review or a Human Rights Act claim against the body refusing access.


Access to third party information – reasonableness as a ground for disclosure without consent

In the processing rules applicable to data and sensitive personal data, there is one very large exception to the need for consent before disclosure of health records. Authorities may grant access to information if it is reasonable in all the circumstances to do so, without consent, bearing in mind what has been done to obtain it, the capacity and position of any affected third party, and the extent of the duty of confidentiality owed to that person.

A person can exercise these access rights through a relative, advocate or solicitor, so long as they have mental capacity. Requests from people without mental capacity will not have legal force, whether made by themselves or their agents.

It is likely that information may be requested about a data subject by a third party. Although it seems that the right to receive information is restricted to the data subject, it has been suggested that it should be read so as to be compatible with Convention rights and that this will extend to a third party making the request. We do not think that it is possible to stretch the subject access parts of the legislation so far, as a matter of legal reasoning. But we are confident that a court would be likely to find some way or another of authorising disclosure to a third party where it was essential for the best interests of the person concerned. It is possible that in so far as the DPA builds on the law of confidentiality, it is that body of law that would be regarded as the bottom line for the lawfulness of the processing which would have been constituted by the disclosure. The Mid Glamorgan Family Health Service Authority ex p Martin case suggests exceptional disclosure to third parties will be acceptable.

The Government seems to think that disclosure will be made to third parties because the Regulations under the Act provide for additional grounds of refusal specifically applicable to third party requests. For instance, the grounds for refusal for Court of Protection Patients are that the subject expected it would not be disclosed; that consent to examination was given on that basis, or the person had expressly indicated it should not be disclosed.


Access to earlier data

The Access to Health Records Act 1990 meant people could see their records from then onwards, but those wanting to see earlier detail had to use the common law, persuasion and reference to government guidance to medics.

The DPA 1998 is retrospective. Subject to transitional provisions, it allows access to records created before it was passed. The second transitional period under the DPA commences on 24 October 2001 and this brought in a general right of access to manual information whenever created, about individuals, provided it is held in a relevant filing system.

After 24 October, rights in relation to automated and other health information in a relevant filing system, whenever recorded or processed, were brought into line with the rules for s68 accessible health and social services records.

This entitles people making a proper request to information in an intelligible form by way of a copy unless the effort is disproportionate, along with info about sources processing purposes and possible recipients.

Under the First Transitional Period, there were no rights of access to information held or processed before 24 October 1998, if the information was neither automated information, nor covered by s68 of the Act (ie a health record). If a relevant filing system was in existence on that date, and new information has been added to it, there might have been rights in regard to that new information). Before October 24th, access to internal memos about a complaint prior to October 1998 would only be available if the records were made in connection with the person~s care – because the data would then have counted as an accessible health record. But after the second transitional period starts on October 24, they would be available, no matter what their purpose, so long as part of a relevant filing system.


B Access to general information about the health service


BMA guidance from 1997 also suggests that doctors should give as much information as possible as to why treatment is not always available on the NHS or through private insurance, and it called for better dissemination of evidence about efficacy of procedures. This is the aim of NICE (a special health authority).

The common law duty to provide information

It is a general principle that where a benefit or advantage may be refused by a public body, (eg a service) the arguments and evidence on which the decision is to be based should be put to the person affected so that they have an opportunity to comment.

But the NHS legal framework does not provide for representations to be made before a service is refused. In one case where this was asserted as implicit, Ethical Committee of St Mary’s Hospital ex p H, regarding removal from an in vitro fertilisation list, the argument was rejected. It may be that this was more on the facts than anything else, because the body about which the argument was raised was an ethical committee which had merely decided to let a consultant make up her own mind as to whether the patient should remain on the list. Also it did not help the argument that the patient was held to have had every opportunity to make representations direct to the consultant herself. Similarly, in the North West Regional HA ex p Daniels case, a bone marrow unit was closed without consultation of the parents, but the court held that there was no legal obligation to inform the parents of children awaiting a bone marrow transplant; only the Community Health Council (now abolished).


Once treatment has started, one might think that one had a better chance of a court holding that there should be fair procedure guaranteed, before withdrawal. This has not been so however; in the only challenge thus far, against a HA, but on the particular facts of the case, it turned out that the NHS Trust had provided the drug for haemophiliac children, on its own initiative out of other monies, and when that ran out, the expectation that it be continued could not be enforced against the health authority – see East Lancashire HA, ex p B and others.


Secondly, consultation, whether voluntary or required by regulations or guidance, must be adequate before it can count, and must proceed upon sufficient information to enable a meaningful response at a time when it could make a difference – see North & East Devon HA ex p PowThe Perry and Coughlan cases too, illustrate the different emphasis on consultation in the health service, when compared to that in the social care field. See the related question Does each resident have to be individually re-assessed before a decision to close a local authority’s residential home can be made?


Thirdly, the common law obligation to give reasons is another non-statutory route to a right to information. There are such obligations in the NHS Complaints procedure, and with regard to the Health Service Ombudsman, which have been expressly imposed in statutes or in guidance; but the court can also imply an obligation, such as was the case in the Fisher case, where there was departure from national guidance from central government.


When a decision is made not to follow recommendations made when a complaint is upheld, the common law may require the reasons to be intelligible and adequate.


Fourthly, when a health body intends to take a decision which could impact on family life or integrity, article 8 of the European Convention may require more in the way of openness, than is required by the common law or statute law. Now the Human Rights Act requires respect for physical and psychological integrity of the person, there might be a breach found if public bodies refuse to disclose health related information just on the basis that the item requested is something beyond that which is covered by the statutory rules regarding access to personal health information. This is because there can be a free-standing interest under article 8 in obtaining access to particular records which even though not about the individual, bear upon the personal situation of the persons seeking the details.


Information about organ retention from deceased children, for instance, could have come in this category. Information about CJD, the MMR vaccine research, and health risks and telephone masts and hotspots for childhood leukaemia etc might be examples of this principle in action. The more hazardous the activity on the part of government the more likely it is that the courts would require an effective and accessible procedure to enable persons to seek appropriate information.


Fifthly there is something called the Code of Practice on Openness in the NHS. first published in the form of a circular in June 1995 – see EL 95(42). The letter says that NHS organisations must implement the Code of Practice from June 1 1995, meaning the Code is very strong guidance indeed.

This Code of Practice sets out the basic principles underlying public access to information about the NHS. It reflects the Government’s intention to ensure greater access by the public to information about public services and complements the Code of Access to Information which applies to the Department of Health, including the NHS Executive. It also builds on the progress already made by the Patient’s Charter which sets out the rights of people to a range of information about the NHS.

It covers Regional Health Authorities, Family Health Services Authorities, District Health Authorities, Special Health Authorities, NHS Trusts, and the Mental Health Act Commission. It also covers family doctors, dentists, optometrists (opticians) and community pharmacists.

The aims of the Code are to ensure that people:

  • have access to available information about the services provided by the NHS, the cost of those services, quality standards and performance against targets;
  • are provided with explanations about proposed service changes and have an opportunity to influence decisions on such changes;
  • are aware of the reasons for decisions and actions affecting their own treatment;
  • know what information is available and where they can get it.


In implementing the Code, the NHS must:

  • respond positively to requests for information (except in the circumstances identified in paragraph 9);
  • answer requests for information quickly and helpfully, and give reasons for not providing information where this is not possible;
  • help the public to know what information is available, so that they can decide what they wish to see, and whom they should ask;
  • ensure that there are clear and effective arrangements to deal with complaints and concerns about local services and access to information, and that these arrangements are widely publicised and effectively monitored.


Apart from the exempted categories of information, NHS trusts and authorities must publish or otherwise make available the following information:

  • information about what services are provided, the targets and standards set and results achieved, and the costs and effectiveness of the service;
  • details about important proposals on health policies or proposed changes in the way services are delivered, including the reasons for those proposals. This information will normally be made available when proposals are announced and before decisions are made;
  • details about important decisions on health policies and decisions on changes to the delivery of services. This information, and the reasons for the decisions, will normally be made when the decisions are announced;
  • information about the way in which health services are managed and provided and who is responsible;
  • information about how the NHS communicates with the public, such as details of public meetings, consultation procedures, suggestion and complaints systems;
  • information about how to contact the Health Service Commissioner (Ombudsman);
  • information about how people can have access to their own personal health records.


The Code contains complaints guidance, for people to use when they are dissatisfied with levels of openness. The person responsible for the Code’s application should be a senior officer directly accountable to the chief executive of the health body; and thereafter the person should be able to go to the chief executive directly if still wanting to pursue their complaint. This ~internal~ route is required before the health service ombudsman considers the complaint. Note that the Ombudsman does not consider complaints about the withholding of information by family doctors, dentists, pharmacists, or optometrists (opticians).

The actual substance of the Code demands that information should be made available unless it is exempt information under the Code. But exempt information can still be disclosed, at the discretion of the health body. The exceptions relate to

  • personal information relating to third parties,
  • manifestly unreasonable, far too general or expensive requests,
  • internal discussion and advice, where disclosure would harm frank internal debate, except where the disclosure would be outweighed by the public interest
  • management information which would harm the effective operation of the NHS
  • legal matters which would prejudice the administration of justice
  • details prejudicial to personnel management or commercial contracts, but not internal NHS contracts
  • Information given in confidence, unless outweighed by the public interest
  • information about to be published where disclosure would be premature in relation to a planned announcement or publication
  • information relating to incomplete analysis or research or statistics, where disclosure would be misleading or prevent the holder from publishing it first.

By way of example, one could expect to be able to get the inspection reports on a particular private nursing home under this Code.

It is recommended that people should write with a request for information, should be given an acknowledgement within four working days and that the information should follow within 20 days. If the information is not to be provided under the terms of the Code, an explanation must be provided within 20 working days of receipt of the request.

The charges which may be made are restricted, according to the identity and to some extent the purpose of the request for the information, and as to the hourly charge for the work involved in responding to the request. There is no reference to the statutory power to charge for this sort of information, and we doubt whether it would be lawful without one underpinning it, but in any event the Code suggests that there should be:

  1. i) no charge for individuals enquiring about services or treatment available to them; press and other media; Community Health Councils; MPs; Local Authorities; Citizen~s Advice Bureaux; and that
  2. ii) for requests from people not listed above, there should be no charge for the first hour and a charge not exceeding £20 per hour for each hour thereafter.


Related Links

NHS Code of Practice on Openness

Data Protection Act 1998 Protection and Use of Patient Information

NHS Information Authority’s Action Plan

The Information Commissioner’s legal guidance to the Data Protection Act 1998.


Leave a Reply

Your email address will not be published.