I have been asked to supply copies of a patient’s dental notes and records, what do I do now?
This question highlights the confusion surrounding the area of patient’s rights and access to their own medical records.
In this article, I have tried to summarise and clarify the law surrounding access to medical records and, in particular, dental records. I expand upon a subject touched upon in my first article on how to avoid a dental negligence claim. The area surrounding the supply of dental records is complex and one which I find is often misunderstood by many dentists. I hope to clarify some of the basic statutory regulations to help you deal with any requests for records that you may receive from either patients directly, or more often, from their solicitors. A request from a solicitor acting on behalf of a patient should be dealt with in exactly the same way as a request from a patient.
Relevant legislation
The legislation which governs patient access to records is a mixture of the following:
- The Data Protection Act 1998 (in force from March 1, 2000)
- The Data Protection Act 1998(Subject Access) Fees and Miscellaneous Provisions Regulations 2000
- The Access to Health Records Act 1990
Under section 7 of the Data Protection Act 1998, provision is given to any patient to have access to or copies of their dental treatment notes, records or radiographs. This is a basic right, as everybody is entitled to know what is written or held about them. The Data Protection Act 1998 states that subject to certain provisions, an individual is entitled to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller.
It is fairly unusual, in my experience, for a patient to request copies of their own notes, as most records are requested through a patient’s solicitor. To release the records, the patient usually signs a form of authority which gives written consent to their solicitor to obtain the notes upon that patient’s behalf. The form of authority usually gives the patient’s name, address, date of birth, a statement that all records should be forwarded (the formal consent) and is signed and dated by the patient themselves.
Health record
A health record is defined in the Data Protection Act 1998 as a record consisting of information about the physical or mental health or condition of an identifiable individual made by or on behalf of a health professional in connection with the care of that individual. A dental record falls clearly into this category. A health record can be recorded in a computerised or manual form or a mixture of both. Most dental records supplied to me include both computerised records and handwritten notes. Health records may include such things as:
- Hand-written clinical notes
- Computerised clinical notes
- Letters to and from other health professionals, for example, referral letters
- Laboratory reports
- Radiographs and other imaging records
- Printouts from monitoring equipment
- Photographs
- Videos
- Tape-recordings of telephone conversation
Application for records
The Data Protection Act 1998 does not give any specific form that has to be complied with for you to release your records, but an application does have to be made in writing. The Court rules suggest that a distinction is made between a request for records where litigation is contemplated against a particular dentist, and one where it is not.
In my own practice, this distinction is adopted when a request for records is made as follows. When litigation is contemplated against a particular dentist, a letter is sent out to that dentist, informing them of this fact, along with a pro-forma application as suggested by the Court rules, and a form of authority. The dentist who may be the subject of the litigation is also carefully advised to contact their defence organisation for further advice who can assist them in providing copies of their records and radiographs to me, as the copying of radiographs is a specialised business.
A patient is likely to have seen more than just the offending dentist, and all other dental records must be gathered to build up a proper picture of all treatment. In my own practice, a letter is sent out with a form of authority, requesting disclosure of records, and making it clear that no litigation is contemplated against that particular dentist. Most dentists usually oblige within a relatively short period of time.
Time limits
Once a proper request is made in writing for disclosure of records, you only have a limited time in which to supply them. The Data Protection Act 1998 gives you just 40 days to supply the requested records. It is therefore vital that you do not delay disclosure. There is no obligation to comply with an access request unless the data controller has such information as he or she needs to identify the applicant and locate the information and unless the required fee has been paid. Once the data controller has all the relevant information and fee where relevant, they should comply with the request promptly.
What if you do not hold the records requested?
This is a fairly uncommon occurrence, but if you do not hold the records that have been requested, then common sense dictates that you must inform the requesting party as soon as possible. It is good practice to provide a short and clear explanation as to why the notes cannot be disclosed, this may be your ‘saving grace’ if an application to the Court is made at a later date by the patient’s solicitors for non-compliance with an application for disclosure. It is in your own interests to be as helpful as possible. Even if a request is made for records due to an allegation of negligence, the patient’s solicitors will only require your records at this early stage to help build up a proper picture of events. It may well be that once the records have been disclosed, a decision may be taken not to proceed especially if your records are accurate and up-to-date, and contradict the patient’s version of events.
Can fees be charged for access to copies of patient’s records?
Section 7 (2) Data Protection Act 1998 states: “A data controller is not obliged to supply any information under subsection (1) unless he has received a request in writing and, except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.”
By section 7 (2) b Data Protection Act 1998, you are allowed to charge a prescribed fee for production of the patient’s notes. There is an exception where the request is restricted solely to data which form part of a health record, and that record has been at least partially created within the 40 days preceding the request, and no permanent copy of the information is to be provided, no fee may be charged.
What is the prescribed fee?
Under section 7 (2) b Data Protection Act 1998, the prescribed fee is set (rather technically) by the Secretary of State by way of regulation. The actual sum mentioned is contained not in the Data Protection Act itself, but is in the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000.
The current fee is set at a maximum of £50, which represents an access fee of £10, the remainder of the balance being allowable for copying charges. No further guidance is given making the area of reasonable copying charges a legal ‘grey area’ open to interpretation.
In my own practice, in relation to copying charges, I rely upon guidance under the regulation relating to the maximum subject access fees where a copy of the information contained in an educational record is supplied in permanent form.
A request for records is not an opportunity to charge large amounts to either the patient or their solicitors. Large fees will be rejected as being unreasonable unless there is a large amount of photocopying involved in supplying the notes and records. In my experience, there seems to be a charging culture among some dentists that once a request for records is made, an automatic invoice is sent out for £50 being the maximum allowable charge. This is not good practice and should be avoided, as unless the charge is justified, then it will be challenged, forcing you to correspond further with a patient’s solicitors to justify the charges.
Can I charge additional costs for copying radiographs?
Radiographs are to be included in the £50 maximum fee, and this point was tested in the case of Hubble v Peterborough Hospital NHS Trust (2001) unreported, before Recorder Christopher Butler. In this case, the defendant trust demanded a ‘fixed fee’ of £50 along with an additional charge for copying X-rays and CTG traces. The question was mooted as to whether an X-ray was included as part of a ‘health record’ or not. It was found by the Judge that even though it may cause financial hardship, X-rays were clearly part of the claimant’s ‘health record’ and the defendant trust was obliged to provide copies of Miss Hubble’s health records including X-rays upon payment only of a maximum fee of £50.
Am I obliged to give out the information that I hold?
Under the Data Protection Act 1998, there are certain circumstances in which the record holder may withhold information. Access may be denied or limited where the data controller judges that information in the records would cause serious harm to the physical or mental health or condition of the patient, or any other person, or where giving access would disclose information relating to or provided by a third person who had not consented to the disclosure.
What if I ignore a request for records?
Ignore requests for records at your peril! If you choose to ignore a proper request, then you are likely to be accused of holding up the claimant’s claim which has adverse consequences, running the risk of being accused of covering up certain actions, and also running the risk of being reported to the General Dental Council for misconduct. If you do unreasonably refuse to supply records properly requested, then it is likely that the patient’s solicitors will have no other option than to make an application to the Court to order disclosure. They may also have the option to complain to the Information Commissioner, (formerly the Data Protection Commissioner).
The Court procedure is straightforward and is often used by solicitors, quite simply an application is made to the local District Judge sitting at the County Court to force you to disclose your records, or otherwise provide an explanation to the Judge as to why the records are being withheld or cannot be disclosed. This means that the principal of the practice will have to attend the Court (even though it was probably your practice manager dealing with the request) which means taking time out of your practice. Any application for disclosure will be accompanied by the usual legal costs argument, in that you must pay the costs of the hearing due to your non-disclosure. This is an important point to bear in mind if you later decide to disclose the patient’s notes after an application to the Court has been made, as it is likely that even though the notes have been provided, you will still have to attend the court to answer any costs arguments, unless costs can be agreed between you beforehand.
Responsibility for dealing with a subject access request lies with the ‘data controller’. A data controller is defined in the Data Protection Act 1998 as a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data about an individual are, or are to be, processed. Your practice manager is likely to have control of all records, and for most purposes is likely to be the data controller jointly with the principal of your practice.
You may be asked by the patient’s solicitors or the Judge to provide an explanation as to why the records have not been disclosed, therefore, it is important to tell the patient’s solicitors any reasons for non-disclosure as early as possible to avoid this from happening. If you are ordered by the Judge to release the records and this is subsequently not done, then this non-action is a contempt of Court, and is punishable ultimately by imprisonment.
Who can help if I get a request for records?
The best way to deal with a request for records is to supply them to the requesting party as soon as possible along with an invoice in relation to the £10 access fee chargeable, plus a reasonable fee for copying charges. It is not unusual for many dentists to waive the access and copying fees altogether especially if only a few pages of notes are all that you hold. It is crucial that you simply do not ignore any requests for records. If you do not have the relevant records then you must say so at the earliest opportunity in order to avoid a Court application being made. If you do not wish to enter into any correspondence with any solicitors (and this is understandable) then instruct your defence organisation to become involved, and tell the requesting party that this is what you have done.
If your receive a request for records:
- Don’t panic! Deal with the request promptly; you have just 40 days (maximum) under the DataProtection Act 1998 to deal with any requests.
- Do not see the request as an opportunity of a money-making scheme, and be reasonable in your charges.
- Remember that you cannot charge more than £50 in total, even if the notes are more than 500 pages long, this sum would include the cost of copying radiographs and any access fee.
- If you do not have the requested notes or records, then inform the requesting party immediately and explain giving reasons why the notes are no longer in your possession; giving a good reason now to the patient or their solicitors, may save you having to attend Court if an application is made for disclosure.