_edited.png){kind=logo}
Health or Care Subject Access Requests from Solicitors: How do we treat them?
- Jun 19
- 5 min read
It is common for GP practices or care homes to receive Subject Access Requests (SARs) from solicitors acting on behalf of patients / residents. These requests are often linked to personal injury claims, clinical negligence cases, employment disputes, insurance claims or family court proceedings.
A common question we hear is:
"Do we provide the same information to the solicitor that we would provide to the patient?"
The short answer is usually yes – but there are some important considerations.
Is It Really a Subject Access Request?
A solicitor may write requesting a patient / resident records without specifically mentioning data protection legislation or a Subject Access Request.
However, if the solicitor is seeking access to the living patient / service users personal data and is acting on the patient / resident's behalf, the request should generally be treated as a SAR.
The fact that the request comes from a solicitor does not change the patient's rights under UK GDPR.
Has the Solicitor Been Properly Authorised?
Before disclosing any information, practices/ care homes should be satisfied that the solicitor has authority to act on behalf of the patient / resident.
This will usually involve obtaining:
A signed consent form
A letter of authority
Evidence that the patient has instructed the solicitor
If there is any doubt about the authority provided, the patient / resident can request further evidence before processing the request.
Remember that the statutory time limit does not begin until you have received sufficient information to identify the individual and verify authority where required.
Is the Patient's Consent Clear Enough?
Not all solicitor consent forms are equally clear.
Some forms are very specific and make it obvious that the patient understands what is being requested. For example, the BMA and Law Society approved form is much more explicit about the nature and extent of the information being sought. Where a patient has signed a clear and detailed form like this, practices / care homes scan usually be more confident that the patient has given informed authority for the solicitor to act on their behalf.
Other forms are much weaker. Some simply say that the patient consents to the release of "necessary information" or "relevant records", without explaining what that might include. This can create uncertainty, particularly where the solicitor then asks for a full copy of the patient / resident medical records.
Patient / resident's may not always realise the solicitor is requesting their entire record. They may assume the solicitor will only ask for information directly relevant to the claim or issue. In reality, some requests are drafted very broadly.
Where the consent form is vague, unclear or does not appear to match the scope of the request, the practices / care home should consider taking extra steps before disclosure. This may include contacting the patient / resident directly to confirm that they understand what has been requested and are happy for the information to be sent to the solicitor.
This is not about creating unnecessary barriers. It is about making sure the practice / care home is satisfied that the patient / resident has given clear, informed authority before their confidential medical information is disclosed.
There are many times where we have called the patient and they have said no and were surprised their solicitor was asking for so much.
Do We Provide the Same Information as We Would to the Patient?
In most cases, yes.
A solicitor acting on behalf of a patient / residen tis exercising the their right of access. The solicitor effectively stands in the patient / resident's shoes.
This means the practice / care home should generally provide the same information that would have been disclosed directly to the patient / resident, including:
Medical / care records
Consultation notes
Correspondence
Test results
Referral information
Administrative records containing the patient / resident's personal data
Third party data where patient / resident is aware or provided it (i.e. not confidential)
The request should be assessed in the same way as any other SAR.
Can Solicitors Ask for "Everything"?
Solicitors often request:
"A complete copy of all records held."
Patient / residents are entitled to obtain copies of their personal data, and organisations should not routinely refuse broad requests.
However, organisations are entitled to seek clarification where:
The request is genuinely unclear
Large volumes of information are held
The patient only requires specific records
For example, if a solicitor requests thirty years of records relating to a minor road traffic accident that occurred six months ago, it may be reasonable to ask whether the request can be narrowed.
That said, organisations should be cautious about pushing back unnecessarily. The ICO expects organisations to make reasonable efforts to locate and provide personal data.
Can a Solicitor Sometimes Receive Information That Would Not Be Sent Directly to the patient / resident?
Potentially, yes.
There may occasionally be circumstances where disclosing information directly to a patient / resident would be likely to cause serious harm to their physical or mental health. For example, a record may contain extensive details relating to suicide attempts, severe self-harm, psychotic episodes or other highly sensitive information that a clinician believes could trigger significant deterioration if provided without support.
Where the serious harm exemption applies, the practice / care home may decide not to disclose some or all of that information directly to the patient / resident .
However, that does not necessarily mean the information cannot be disclosed to the patient / resident authorised representative.
In some cases, practices / care homes may consider providing the information to the patient / resident's solicitor while making it clear that the records contain sensitive material and should be reviewed carefully before being shared with the client. The solicitor is often in a better position to discuss the contents with the patient / service user, seek appropriate support where necessary, and consider how best to use the information within the context of the legal matter.
The key point is that these situations should be considered on a case-by-case basis, with appropriate clinical input. The decision is not whether the information is "embarrassing" or "upsetting", but whether disclosure would be likely to cause serious harm. Any decision to withhold information from a patient / resident, or to provide it through an authorised
representative instead, should be carefully documented along with the reasoning behind it.
As with all serious harm decisions, practices should ensure they can demonstrate why the approach taken was necessary and proportionate in the circumstances.
What About Requests Under the Access to Health Records Act?
Practices sometimes receive requests from solicitors acting on behalf of deceased patient / resident.
These are not SARs because data protection legislation only applies to living individuals.
Instead, requests may need to be considered under the Access to Health Records Act 1990.
Different rules apply regarding who can access records and what information can be disclosed. See our blog around deceased records here.
Practical Tips for processing SARs can be found in the Resource section of myKafico (for our DPO+ customers)
Template letters for responding to solicitors with weak consent forms or requesting excessive data can be found in the Resource section of myKafico (for our DPO+ customers)
Key Takeaway
A solicitor does not gain greater rights of access simply because they are a legal professional. When acting on behalf of a patient / resident, they are exercising the patient's right of access and should generally receive the same information that would have been disclosed directly to the patient / resident.
The focus should be on verifying authority, reviewing the records appropriately and applying any relevant exemptions in the same way you would for any other Subject Access Request.
💡 Have a Data Protection Question?
Ask the experts through our low cost advice hub
🖱️ Interested in myKafico
One month free trial of our DPO Compliance platform
Comments