Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) people have the right to see any health and other personal information an organisation holds about them. To use this right, you can make what is known as a ‘Subject Access Request’.
How to Apply
NHS Orkney has developed a Subject Access Request Form which should be completed and returned to the contact details below (please see the forms at the bottom of this page.) A Guidance document is also available to assist with completing the application form.
Requests for a copy of personal information should be sent to ork.dp@nhs.scot or posted to:
FOI Officer
NHS Orkney
The Balfour
Foreland Road
Kirkwall
KW15 1NZ
To help us respond effectively, we encourage you to:
- be as clear as possible about what information you are seeking;
- include relevant date ranges, services, or departments if known;
- explain the context (for example, a particular episode of care or employment matter).
This helps us focus our searches and provide you with the most relevant information more quickly. If a request is very broad (for example, asking for “everything you hold about me”), we may contact you to ask for clarification or to help narrow the scope. This is allowed under the law and helps ensure searches remain reasonable and proportionate.
Who can make a Subject Access Request?
You can make your own application to see your records or you can authorise someone else to make the request on your behalf.
How long should it take?
The maximum period is one calendar month after the request is received. If you are asked to provide clarification or further details the deadline is taken from receipt of the further information. However, if your request is complex this can be extended for a further two months. If this is the case we will tell you and explain the reason for the delay.
How much does it cost?
There is no charge to receive a copy of your patient notes. If additional copies are requested a fee will apply.
What records can you see?
You can apply for access to records that have been made about you, including your medical notes. These are valid reasons why you may be refused access to parts of your own health records, you would not be able to see information that could:
- cause serious harm to your physical or mental health, or anyone else’s; or
- identify another person (except members of NHS clinical staff who have treated the patient), unless that person gives their permission.
NHS Orkney cannot provide a copy of audit trails as this information is not relating to an identifiable individual. If you have concerns regarding your personal records being accessed inappropriately please get in touch with NHS Orkney’s Data Protection Officer (ork.dp@nhs.scot).
How we search for your information
Under the Data (Use and Access) Act 2025, NHS Orkney is required to carry out reasonable and proportionate searches when responding to Subject Access Requests.
This means:
- we will make sensible efforts to locate your personal information;
- we will search systems and records where your information is reasonably likely to be held;
- we are not required to search every system, archive or backup if doing so would involve disproportionate effort.
The law confirms that individuals are entitled to personal data that can be provided following a reasonable and proportionate search, rather than an exhaustive search of all records ever held.
Accessing records of deceased patients
The access to records of deceased patients is not included in the legislation above. The Access to Health Records Act, 1990 lays down strict guidance on what personal information can be provided to a third party regarding a deceased patient.
The Act gives certain people a right to see the health records of somebody who has died. These people are defined under section 3(1)(f) of that Act as:
- The patient’s personal representative. This will be the executor or administrator of the deceased person’s estate.
- Any person who may have a claim arising out of the patient’s death.