How we process requests

Responsibilities and processes

Any requests we receive will be sent to our Information Governance team as soon as possible.

The Information Governance team will consider the request for release and any views from the individual’s care team and the Caldicott Guardian if relevant. A record will be kept of disclosure decisions and the reasons they were made.

Considerations of requests

Requests will be considered on a case-by-case basis and any information released will be dependent on:

  • approved receipt of identity and evidence of right to act as a Personal Representative to the deceased; you can find out more on how to make a request

  • availability of personal data requested; if it's already in the public domain, for example, in news articles or a coroner's report

  • inclusion of any special category data, as defined by the General Data Protection Regulation (GDPR)

  • whether the data contains personal details of any third parties, such as family members, carers, social care or healthcare staff; whether any of these third parties previously refused consent to disclosure of their personal data; you can find out more on third party information

  • whether there's sufficient evidence to support the assumption that the deceased individual would have consented to the release of their personal information if they were still alive; you can find out more on wishes of the deceased individual

  • whether the personal data requested was provided in confidence; you can find out more on duty of confidentiality

  • whether release of the data could cause harm or distress to an individual

  • whether disclosing the personal data would be likely to prejudice our ability to provide a service

Third party information

The Data Protection Act 2018 (DPA) and UK General Data Protection Regulations (GDPR), which allow an individual to access their records, does not apply to these requests, as the legislation only relates to living individuals.

The legislation does still apply to the personal data of any third parties contained in the records, such as information about other family members, and will be withheld unless there's a legal reason to disclose it.

Public interest disclosures

Occasionally there may be a public interest justification for the disclosure of information in a record. To make a disclosure, we'll need to be satisfied that the public interest served by disclosure outweighs the public interest served by protecting the confidentiality of the individual. Scenarios may include:

  • protecting a person from serious harm, for example, disclosing information about a communicable disease so other individuals can see seek appropriate care and support

  • addressing concerns about clinical practice provided that may have contributed to the death of the individual

Any disclosures in the public interest will be made on a case-by-case basis in consultation with the Information Governance Team and, if relevant, the Caldicott Guardian.

Wishes of the deceased individual

If the service user expressed any wishes around who can access their information whilst alive, we'll normally be respectful of this, unless grounds are established to release it in the public interest. We may seek the views of the staff who cared for the individual, as well the Caldicott Guardian, where no documented wishes exist.

Duty of confidentiality (social care records)

A duty of confidentiality arises when information is obtained in circumstances where it's reasonable for a person confiding personal information to expect that it will be held in confidence by the recipient of the information.

Any personal information shared in confidence must not be disclosed without some form of legal authority or justification.

In practice, this often means that the information cannot be disclosed without that person’s explicit consent unless there is another valid legal basis.

Due to the personal and sensitive nature of social care records, it's likely that they'll continue to be subject to a duty of confidence after an individual’s death. It's generally assumed that this type of personal data would have been provided in confidence.

If we believe that disclosure of the deceased's personal information would be likely to give rise to an actionable breach of confidence, then the data will not be released.

Time limit for responding to requests

There is no set timeframe for response to any requests for social care records. However, we aim to respond to all queries with 40 calendar days, as prescribed by the Access to Health Records Act 1990 as good practice.