Add us as a preferred source
Ellie O’Brien, paralegal at Maulin Law, offers up some practical guidance for private providers, whether corporate entities or individual practitioners, on the steps required upon receipt of a Subject Access Request from a patient or their solicitor.
Subject Access Requests (SARs) submitted by patients, or by solicitors acting on their behalf, are frequently one of the earliest formal steps in a potential clinical negligence claim. How a request of this kind is handled, from the moment it is received through to disclosure, can materially affect your position if a claim is subsequently pursued. You do not need detailed data protection expertise to manage this correctly, but you do need to understand what is expected of you and where the boundaries of your responsibilities lie.
Recognising the signs before a SAR is received
A SAR is not always an isolated event. In practice, it is most commonly preceded by one of two things: a formal complaint about the care provided, or a direct request for compensation, whether made informally or through a solicitor. Where either of these has occurred, it is reasonable to anticipate that a SAR may follow, and to treat the eventual request accordingly. This does not mean every complaint results in a claim; most do not. It does mean that complaints and compensation requests should be reported promptly and consistently to your private practice’s complaints lead or to your indemnity provider if you hold a claims made policy, so that if a SAR is subsequently received, it is not dealt with in isolation from the wider context.
The request should be actioned, not assessed
Where a SAR is known or suspected to relate to a potential claim, it should still be processed through the practice’s standard SAR procedure without delay or additional scrutiny. The law does not permit a SAR to be refused, restricted, or delayed on the basis that it may be intended to support a claim; the requester’s underlying motive is legally irrelevant to the obligation to respond. You should refer the request to whoever is responsible for SAR compliance at your private practice and should not attempt to manage or filter it personally.
The statutory time limit is unaffected
A SAR must be responded to within one calendar month of receipt, extendable by up to two further months only where the request is genuinely complex or the volume of records is substantial, and only where the requester is informed of the extension, and the reason for it, within the first month.
The consequences of non-compliance
Failing to comply with a SAR, particularly once the deadline has passed and reminders have been given, carries real consequences. The Information Commissioner’s Office (ICO) can take regulatory action for the underlying failure, ranging from a reprimand to an enforcement notice requiring compliance within a set period, continued non-compliance can lead to a monetary penalty. Separately, a patient can apply directly to the court for a compliance order, with costs awarded against a provider found to have failed in its obligations without good reason, and can claim compensation for any damage the delay or refusal has caused. Beyond the direct regulatory and legal exposure, a delayed or incomplete response is likely to be noted by any solicitor already acting for the patient and can become a further point of complaint in its own right, regardless of the underlying clinical position.
Records must be preserved, not amended
Once a SAR is received, the clinical record must be preserved exactly as it stands. No entry should be added to, edited, or clarified retrospectively, regardless of the intention behind the change. Where a genuine correction is required, this should take the form of a new, separately dated entry explaining the correction, rather than an amendment to the original text. Retrospective changes to a record are generally identifiable on examination and, where identified, are liable to undermine the credibility of the record as a whole, irrespective of the clinical merits of the underlying care.
What must be disclosed, and what may not need to be
The clinical record itself, including consultation notes, results, imaging, and related clinical correspondence, must be disclosed in response to a SAR and cannot be withheld on the basis that a claim is anticipated. A narrower category of material may fall outside this obligation: communications with lawyers, or documents prepared specifically because litigation was already in contemplation, may be protected by legal professional privilege. Incident reports and complaint investigations prepared as part of routine clinical governance will not usually attract this protection, even where they discuss the same events. Decisions of this kind should not be made by clinical or administrative staff in isolation; they should be referred to the practice’s indemnity provider or legal advisers.
Where clinical judgement is required
Clinical input is genuinely required in two circumstances. The first is where disclosure of specific information is likely to cause serious harm to the physical or mental health of the patient or another individual; this is a high threshold and is not met simply because the information is distressing or would ordinarily be communicated in person. The second is where the record contains identifiable information about a third party, such as a family member, another patient, or a colleague, which may need to be redacted. In both cases, your assessment and the reasoning behind it should be documented at the time.
Notify the indemnity provider promptly
In many cases, an adverse incident, a complaint, or a request for compensation will already trigger a notification obligation under the terms and conditions of your indemnity or insurance policy, and should have been reported to your indemnity provider or insurer at that earlier stage. In any event, receipt of a SAR connected to such circumstances should be notified to your indemnity provider or insurer immediately, regardless of whether they have already been made aware of the underlying incident or complaint. Early notification allows the indemnity provider to advise on any privilege or disclosure questions before they become time critical and is consistent with the reporting obligations most clinicians hold under their indemnity arrangements in any event.
A SAR is a data protection right, not a step in litigation
It is worth noting that a SAR is a right of access under data protection law and exists independently of any litigation process. Formal pre-action disclosure in a clinical negligence claim follows a separate protocol; a SAR is often used first because it is faster and involves no cost to the requester. Responding properly and within time to a SAR is not an admission regarding the standard of care provided, and should not be treated as such.
Handled correctly, a SAR request, requires nothing more than the practice’s standard process, applied without alteration to the underlying records. Your role is limited but important: report the relevant background promptly, leave the record untouched, provide clinical input only where it is genuinely required, and ensure the appropriate people are informed early.
