Glossary, records and interoperability
What is a subject access request?
A subject access request is a person asking an organisation for a copy of the personal information it holds about them, a right under UK GDPR. For a clinic, it usually means producing the patient's record, letters and messages within one month.
Updated . Defined by the wai team for clinics, groups and health systems.
Also called SAR, DSAR or right of access.
Why Subject access request matters to a clinic
The ICO says a request can be made verbally or in writing, and the clinic must respond without undue delay and within one month, extendable by up to two further months for complex requests.1 In most cases no fee can be charged.1
US practices have a parallel duty under HIPAA, which gives patients a right of access to their protected health information.2 Either way, a clinic that can produce the whole record quickly answers in days, and one that has to assemble it from several systems risks missing the deadline.
Questions
Can a clinic refuse a subject access request?
Only in narrow cases, for example where the request is manifestly unfounded or excessive, or where releasing information would harm the patient or reveal someone else. The ICO guidance sets out when.1
Does the clock start when the request arrives?
Usually yes. It starts later if the clinic needs to confirm the person's identity, and it pauses while the clinic asks them to clarify the request.1
Sources
See wai on your own clinic.
A 15 minute video call on your own diary, notes and inbox. Prices for clinics, groups and hospitals are on the pricing page.