Patient personal data belongs to the individual/ the patient, and individuals/patients have a number of rights to their personal data.
This practice has voluntarily adopted the ICGP recommendations on the requirements of “processing of Patient Personal Data: A Guideline for General Practitioners”
We have put the following procedures in place to protect and support the individual/patient’s rights as detailed below
Under Article 15 of GDPR, the patient, whether GMS or private, has a right to access a copy of their medical record. This practice will always provide a copy of a patient’s medical record on receipt of a signed request or authorisation form. The access request will be carried out as soon as possible, and no later than 30 days after the access request. No fee will be charged for providing a copy of this medical record.
If a GMS patient submits a FOI request for their medical record the request should be submitted to the HSE and the HSE should then authorize the practice to release these records.
As per GDPR legislation, an individual can only make an Access Request for their own personal data. Legal Guardians can also make a request on behalf of a child, however, once a child is capable of understanding their rights to privacy and data protection, the child should make this request in their own name. THIS IS NOT AGE DEPENDENT therefore we reserve the right to process these requests on an individual basis as revealing medical information of a child who is capable of making decisions themselves will in most cases constitute a breach of Data Protection Acts.
The right to access may be restricted, as per Section 54 of the Data Protection Bill 2018, if the disclosure of the record to the patient ‘would be likely to cause serious harm to the physical or mental health of the data subject’. In a situation where access is denied, the practice will advise the patient of the reason for the restriction either at the time access is denied or as soon as is advisable thereafter.
In addition, only the part of the medical record likely to cause harm will be withheld, the rest of the medical record will be released in the usual way.
The patient has a right to appeal the restriction to the Data Protection Commissioner.
Under Article 16 of GDPR, the patient has the right to obtain rectification of inaccurate patient data which is factually inaccurate. However, this is not an unqualified right and depends on the circumstances of each case (reference Irish Data Protection Commissioner case study 1 of 2007). A relevant dispute resolution may be addressed by the addition of a 17 supplementary statement in the patient record.
For example, a patient may believe that a diagnosis of ‘Depression’ in their clinical record is inaccurate. This was the opinion of the GP at a point in time. The patient has the right for a note to be inserted in their clinical record that they disagree with the GP’s diagnosis made at that time, but the contemporaneous record and clinical diagnosis by the GP does not have to be deleted or erased.
All GP Practices have a requirement under Medical Council rules to keep medical records and also have a right to defend medico-legal claims, under Article 23.1(g) the right to erasure of medical records is not an absolute right and restrictions may apply. This type of request will be examined on a case-by-case basis in this practice.
If you decide at any time and for whatever reason to transfer to another practice we will facilitate that decision by making available to your new doctor a copy of your records on receipt of your signed consent from your new doctor.
We will need written consent from every individual in your family. As per GDPR legislation, an individual can only make an Access Request for their own personal data. Legal Guardians can also make a request on behalf of a child, however, once a child is capable of understanding their rights to privacy and data protection, the child should make this request in their own name.
These records will be sent electronically through Healthmail to your new GP or directly to you, the Patient. If it is not possible for you to pick these up we will then register post them to your new GP. We have a no post policy unless as stated above. We will not email them or save them to a usb stick/cd or similiar device.
For medico-legal reasons we will also retain a copy of your records in this practice for an appropriate period of time which may exceed eight years.
All patients have a right to object at any time to processing of personal data for direct marketing purposes, however this practice does not carry out any direct marketing campaigns.
Automated Individual Decision-making, Including Profiling
GPs do not base decisions solely on automated processing, and the point of view of the patient is central to any decision making in the provision of medical care.