This is quite complicated and I will leave it to somone with a written policy to give you the full details
I suggest you also get a copy of Diana Kloss's Occupational Health Law where this is explained in Chapter 3
You can release the notes to anyone the person wishes them to be released to.
If s/he has given consent to release to their solicitor that is what you do. Do not release to employer's solicitor unless you have specific permission to do so.
You need to photocopy all the notes and go through them to cross out any references to "third parties".. I am a bit vague on this myself, but certainly the name of any other employees which may have made their way into the record (for example lists of those who need health surveillance) Perhaps another JISC member would expand on this?
You do not need to get consent from GP and other external medical professionals to release their reports which are contained in notes.
The only thing that does not get passed on information covered by legal privilege see p78 section 3.11 of Kloss.. this is things to do with litigation, so communications from the employers solicitor for example.
You can charge and most see it as an access request under the data protection act, this also allows certain amount of time so don't rush it! (40-day time limit for responding)
How much does it cost?
Organisations may charge a fee of up to £10 (£2 if it is a request to a credit reference agency for information about your financial standing only).
There are special rules that apply to fees for paper based health records (the maximum fee is currently £50) and education records (a sliding scale from £1 to £50 depending on the number of pages provided).
You will have to pay a fee (if charged) for every request, so you need to specify all the information you need in your first letter, otherwise you may have to pay another fee to get information you have asked for on a different occasion.
http://www.ico.gov.uk/for_organisations/data_protection/the_guide/principle_6/access_to_personal_data.aspx
What is a valid subject access request?
For a subject access request to be valid, it should be made in writing. You should also note the following points when considering validity:
- A request sent by email or fax is as valid as one sent in hard copy.
- You do not need to respond to a request made verbally but, depending on the circumstances, it might be reasonable to do so (as long as you are satisfied about the person’s identity), and it is good practice to at least explain to the individual how to make a valid request, rather than ignoring them.
- If a disabled person finds it impossible or unreasonably difficult to make a subject access request in writing, you may have to make a reasonable adjustment for them under the Disability Discrimination Act 1995. This could include treating a verbal request for information as though it were a valid subject access request. You might also have to respond in a particular format which is accessible to the disabled person, such as Braille, large print, email or audio formats. If an individual thinks you have failed to make a reasonable adjustment, they may make a claim under the Disability Discrimination Act. Information about making a claim is available from the Equality and Human Rights Commission.
- If a request does not mention the Act specifically or even say that it is a subject access request, it is nevertheless valid and should be treated as such if it is clear that the individual is asking for their own personal data.
- A request is valid even if the individual has not sent it directly to the person who normally deals with such requests – so it is important to ensure that you and your colleagues can recognise a subject access request and treat it appropriately.
Cheers
Diane
