Historically an individual did not have a right to see his or her medical records. The position has gradually altered due to a number of pieces of legislation, the most important of which is now the Data Protection Act 1998. This covers both computerised and (some) manual records, and as such is a significant advance on its predecessor (the Data Protection Act 1984), which only regulated records held on computer.

There is specific legislation on access to manually held health records in the form of the Access to Health Records Act 1990. However, “since the passing of the Data Protection Act 1998, the terms of this Act are now redundant except in so far as they relate to a deceased person” (Mason, McCall Smith and Laurie, Law and Medical Ethics (6^th edn 2002), para 8.57), and so this legislation is not discussed further here.

Data Protection Act 1998

The Data Protection Act 1998 enables an individual (the data subject) who believes that personal information relating to him/her is being electronically stored, to apply to discover if the information is being stored and if so, to have access to it (the “right of access to personal data”). It also confers a right to have inaccurate personal data rectified, blocked, erased or destroyed, and a right to prevent data processing which is likely to cause unwarranted damage or distress.

There are a number of exceptions to the right of access. Most importantly, medical information may be exempt if applying the right “would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person” (Data Protection (Subject Access Modification) Health Order 2000, reg 5(1).

Further information about data protection is available from the website of the Information Commissioner’s Office (http://www.informationcommisioner.gov.uk/).

Access to Medical Reports Act 1988

Under this Act, a person has the right to see a medical report prepared by a doctor, 'who is or has been responsible for the clinical care of the individual' (i.e. their own doctor), for employment or insurance purposes. Any employer. potential employer or insurance company who wants a medical report from a person's doctor, must first obtain the individual's consent and inform them of their right of access under the Act. The person concerned has a right to see the report before it is sent to the employer or insurance company if they have asked to do so, in writing, when giving their consent to the report. Once the report has been sent, the individual may still seek a copy of it for up to six months. There is no right to amend or correct the report unless the doctor agrees to do this, but there is a right to prevent the report being sent at all.

The Act allows circumstances where non–disclosure by the doctor is possible. If a person feels that they have been wrongly refused access to a medical report, they may apply to the county court, which can order disclosure (section 8).

Although an employer or insurance company can circumvent the Act by appointing their own doctor to prepare reports, such a report might still be accessible under the provisions of the Data Protection Act 1998.