Access to medical records
- Introduction
- Routine and administrative access to HSE records
- Data protection
- Freedom of Information
- Court cases
- Further Information
Introduction
Individual patients may be entitled to get access to their medical records in a number of different ways:
- By routine and administrative access to Health Service Executive (HSE) records
- Under data protection laws
- Under the Freedom of Information Act
- On the basis of a contract between the patient and the medical practitioner or hospital
- By discovery, in the course of court proceedings
The five ways listed above apply to patients of the public system: patients in public or publicly-funded hospitals, as well as people who use a medical card or GP visit card for GP services. The HSE provides a list of public hospitals.
If you visit your GP as a private patient, attend a private hospital, or are cared for in a private nursing home, you can get access to your medical records:
- Under data protection laws
- On the basis of your contract with the medical service, or
- By court order
Confidentiality and disclosure
Doctors and other medical personnel and health institutions have a duty to maintain patients' records in confidence, but there are some circumstances in which they may be obliged to give this information to third parties.
Their ethical duty with regard to confidentiality is set out in the Medical Council guidelines Guide to Professional Conduct and Ethics for Registered Medical Practitioners.
The confidentiality of personal information such as medical records is protected by data protection laws and the Freedom of Information Act. Under these laws, third parties may not get access to personal information except under exceptional circumstances.
Routine and administrative access to HSE records
You can request access to your HSE health records by writing to the relevant service. The HSE provides information on getting your health records using routine and administrative access.
Data protection
The rules on data protection are set by the General Data Protection Regulation (GDPR). Data held must be accurate and up to date. You are entitled to find out if there is information about you held on record, to access those records and to have them corrected if they are inaccurate. The laws apply to public and private healthcare providers.
There may be a limited exception to this duty to disclose your records to you where doing so is likely to cause serious harm to your physical or mental health.
The GDPR does not apply to the personal data of deceased persons.
The Data Protection Commission provides information about accessing your personal information. The Commission deals with complaints in relation to data protection.
To access your information, write to the relevant health service to make a data access request. You may be asked to provide evidence of your identity.
If you are making an access request to a HSE service (pdf), you can write to the health service or send it a HSE Subject Access Request Form (pdf). You can find more information about GDPR on the HSE website.
Freedom of Information
The Freedom of Information Act 2014 (FOI Act) provides for, among other things, individual right of access to personal records held by public bodies covered by FOI unless they are specifically exempt. Medical records are personal records. The FOI Act applies to the HSE and to voluntary hospitals as well as to a number of health agencies. It does not apply to private hospitals. It applies to records held by GPs in relation to patients who are medical card holders. It does not apply to the records of private patients of GPs.
If you want to access records under the FOI Act, you should apply to the public body that holds them (the HSE is considered to hold the records of medical card holders).
There is a particular procedure that must be followed for medical information if the head of the public body believes that giving you the information may be harmful to your health or emotional wellbeing. In these circumstances, if you ask them to do so, the public body must instead release the record to an appropriate health professional nominated by you.
FOI requests should be addressed to the FOI Unit of the public body or office holding the records.
Disputes about access to records under the FOI Act should be addressed to the Office of the Information Commissioner.
Access to the records of a child or incapable person
In general, for personal information the FOI Act gives you the right to access information about you.
There is a procedure whereby parents or guardians can access personal information about a minor. The Act also allows parents/guardians to access personal information about an adult who is incapable of exercising their rights under the Act because of mental incapacity or severe physical disability.
The access in both cases will only be granted if the head of the public body concerned considers it would be in the best interests of the person concerned.
Access to a deceased person's records
Under FOI, access to the personal information of a deceased person may be granted:
- To the personal representative who is administering the estate of the deceased
- To a person who is performing some legal function in relation to the individual or the estate of the individual
- To the spouse (including a divorced spouse or cohabitee) or next of kin or such other person as the head of the public body considers appropriate
Court cases
Discovery
Patients and others may access medical records for the purpose of court cases if they get a court order of discovery. The court may order a hospital or doctor to disclose or discover documents or medical records to a plaintiff's advisers where those documents are considered relevant to the issues involved in the court proceedings.
Further Information