Police Requests for Medical Records
The following guidance is taken from the BMA’s ‘Access to health records’ which we recommend is read in full.
The police may ask for a patient’s record to be disclosed voluntarily under Schedule 1, paragraph 10 of the Data Protection Act 2018 if they do not have a court order or warrant.
A practice may disclose information but is not under any obligation to do so. Practices should only disclose information where the patient has given consent or there is an overriding public interest. In this context, a disclosure in the public interest is a disclosure that is essential to prevent a serious threat to public health, national security, the life of the individual or a third party, or to prevent or detect serious crime.
The LMC would strongly advise that the police should submit their request in writing (via a DP2 or equivalent with the signature of a senior officer). Before making a decision whether to disclose or not, we would recommend that the Practice seek the advice of their Caldicott Guardian, Data Protection Officer and medical defence organisation. Every case should be considered individually.
Any disclosure should contain only the information necessary/relevant (ie be proportionate) to satisfy the request and consideration should be given as to whether any entries should be redacted. The practice must be able to justify the release of information.
The BMA have further advice at ‘When police request access to patient records’