Disclosure Requests in Health and Social Care: Understanding Your Legal Obligations
Health and social care providers receive a wide range of requests for confidential information, from patients requesting their own records to solicitors, police officers, coroners and safeguarding professionals.
Understanding the differences is essential to ensuring information is disclosed lawfully, securely and within the correct timeframe.
Subject Access Requests (SARs)
Legislation: UK GDPR Article 15, Data Protection Act 2018 and Data (Use and Access) Act 2025.
Timeframe: One calendar month, extendable by a further two months where the request is complex or numerous requests have been received. The clock may also be paused where clarification is reasonably required.
Exemptions: Information may be withheld where disclosure would be likely to cause serious harm to someone's physical or mental health, compromise another person's confidentiality, or reveal legally privileged information. Other statutory exemptions may also apply.
SARs can be made by patients, service users, employees or authorised representatives, including solicitors.
Access to Deceased Patients' Records
Legislation: Access to Health Records Act 1990 (AHRA).
Timeframe: 21 calendar days where the health record has been created or updated within the preceding 40 days; otherwise, 40 calendar days.
Exemptions: Only releasing data from 1991 onwards.
Access may be restricted where information identifies third parties, disclosure would cause serious harm, or the deceased expressed relevant confidentiality wishes.
Access is generally available to the deceased's personal representative or someone with a claim arising from their death. The latter is entitled only to information relevant to the claim.
Medical Reports for Employment or Insurance
Legislation: Access to Medical Reports Act 1988.
Timeframe: The legislation provides a 21-day period associated with the individual's opportunity to see the report before disclosure. This is not a general 21-day deadline for completing the report.
Exemptions: Access to parts of the report may be restricted where disclosure would be likely to cause serious harm or reveal certain intentions of the medical practitioner.
The individual must be informed of their rights, including the opportunity to request access and seek corrections.
Police Requests
Legislation: UK GDPR, Data Protection Act 2018
Timeframe: No universal statutory deadline for voluntary disclosures. Urgent requests should be prioritised.
Exemptions and restrictions: Information must not be disclosed automatically simply because the police have requested it. Providers must establish a lawful basis and consider necessity, proportionality and confidentiality.
A valid court order or specific statutory power may create a separate obligation to disclose.
Court Orders and Coroners' Requests
Legislation: Relevant court rules and orders, and the Coroners and Justice Act 2009.
Timeframe: As specified by the court or coroner's formal notice.
Exemptions and restrictions: The scope of disclosure should be checked carefully. Legal privilege, relevance and any applicable restrictions must be considered, with concerns raised through the appropriate legal process.
A request from a solicitor is not the same as a court order, and the two should not be treated interchangeably.
Safeguarding Disclosures
Legislation: UK GDPR, Data Protection Act 2018, Children Act 1989, Children Act 2004, Care Act 2014 and Children's Wellbeing and Schools Act 2026.
Timeframe: No single statutory timeframe applies to every safeguarding request.
Information should be shared without unnecessary delay, particularly where someone is at immediate risk.
Exemptions and restrictions: Disclosure must be relevant, necessary and proportionate. Consent is not always required, and withholding information solely because consent has not been obtained may be inappropriate.
The Children Act 2004 also contains a specific information-sharing duty for certain organisations involved in safeguarding children, subject to statutory conditions and exceptions.
Freedom of Information (FOI) Requests
Legislation: Freedom of Information Act 2000.
Timeframe: Normally 20 working days.
Exemptions: Personal information, confidential information and certain commercially sensitive information may be exempt (there are a variety of other exemptions).
FOI applies to public authorities and certain NHS contractors, including GP practices in respect of their relevant NHS functions. It does not automatically apply to every private health or social care provider.
FOI requests generally concern organisational information.
Getting Disclosure Decisions Right
Regardless of the type of request, we should establish who is requesting the information, what legal authority supports disclosure, which records are relevant and whether any information must be withheld or redacted.
The key is to disclose what the law requires or permits, without disclosing more than is necessary.
Mistakes can result in confidentiality breaches, complaints, missed statutory deadlines and unnecessary administrative work.
Support for Existing Kafico Customers
If you are an existing Kafico customer, further support is available through myKafico.
Visit the Resources page for guidance, templates and practical information to support your disclosure processes. You can also ask us questions any time via the Raise a Query page.
If you are uncertain about a particular request, you can also use the Queries page to obtain advice from the Kafico team before making a disclosure.
Prefer Us to Manage Your Disclosures?
Kafico also offers a fully managed disclosure service, Kafico Managed Disclosure Service (KMDS), for organisations that would rather leave the administrative and information governance work to us.
With KMDS, all you need to do is forward the request to Kafico. We take care of the rest.
Our experienced team securely accesses your clinical system on your behalf, identifies and reviews the relevant records, considers applicable exemptions, undertakes necessary redactions and manages the disclosure process through to completion.
This means fewer administrative demands on your staff, consistent handling of requests and reassurance that disclosures are being managed by information governance specialists.
We Have Just Two Places Available
We currently have capacity to onboard two additional customers to our KMDS service.
If your organisation is spending valuable time processing disclosure requests, or would benefit from dedicated specialist support, contact the Kafico team to discuss joining the service.
This lets Kafico manage your disclosures so your team can focus on delivering care.
Comments