What is The NHS Care Records Guarantee for England?

The NHS Care Records Guarantee for England is a public document. It explains how your medical records are handled within the NHS in England. It sets rules for protecting your privacy and keeping your information safe. It also sets out your rights as a patient in relation to your care records.

What is the Purpose of the Guarantee?

The NHS Care Records Guarantee serves two main purposes:

1. To explain how your care records are used and kept safe.
2. To reassure patients that their privacy is respected at all times.

Having clear rules builds trust. Patients can feel confident that their personal information is treated responsibly.

Protecting Your Privacy

Your care records are private. They hold sensitive information about your health. This includes details of illnesses, treatments, and any prescriptions you are taking. The NHS understands the importance of keeping this information safe.

Only certain people will access your care records. These are usually doctors, nurses, and other professionals directly involved in your care. Even then, they will only see the parts of your record that they need.

There are procedures in place to keep your privacy protected. These include:

• Making sure staff are trained in data protection.
• Using secure computer systems for storing records.
• Limiting access with passwords and access controls.

Your privacy is also protected by law, including the Data Protection Act 2018. If your information is shared inappropriately, it can lead to penalties.

Why Care Records Are Important

Care records help healthcare professionals look after you. They allow staff to see your medical history, ensuring no critical information is missed. For example, knowing your allergies or past treatments can help avoid problems with new medicines or procedures.

They also help improve the safety and efficiency of your care. Care records can save time by reducing the need for repeat tests. They make sure you get the right treatment faster.

Your right to see and correct your care records

You have the right to see the information held in your NHS care records. If you ask, the NHS will provide you with copies of your records.

If you find something wrong, you can ask for it to be corrected. For example, if there is a mistake in your medical history, you can point it out to your doctor.

Sharing Information

Sometimes your care records need to be shared to ensure you receive safe and effective care, or for other legally permitted reasons.

• Sharing for Direct Care: Information is often shared between healthcare professionals involved in your direct care. This happens, for example, when your GP refers you to a specialist, or when you need treatment in an emergency. This sharing is typically done under the UK GDPR legal bases of ‘Public Task’ and ‘Provision of Health or Social Care’, alongside the common law duty of confidentiality. Secure systems like the Summary Care Record (SCR) may be used to share key information (like allergies and medications) for urgent care, and you have choices about the level of detail included in your SCR.
• Sharing for Research and Planning (Secondary Uses): Information from patient records can be crucial for improving NHS services, planning healthcare, and conducting medical research. Usually, information used for these purposes is anonymised or pseudonymised so individuals cannot be identified.
• Your Choices:
  • National Data Opt-Out: You have the right to stop your confidential patient information being used for most research and planning purposes. This is known as the National Data Opt-Out. It does not stop your information being shared for your own individual care. You can set your choice via the NHS website or helpline.
  • Summary Care Record (SCR) Choices: You can ask your GP practice about the options for your SCR, including having one with core information or adding more details. You can also choose not to have an SCR at all, but this might limit the information available to clinicians in an emergency.
  • Right to Object (UK GDPR): Under data protection law, you have a right to object to the processing (including sharing) of your personal data in certain circumstances (e.g., where the legal basis is ‘public task’). This is not an absolute right for health data used for direct care, as organisations can continue processing if they demonstrate compelling legitimate grounds.

NHS staff follow strict confidentiality rules and use secure methods whenever information is shared.

How Records Are Kept Safe

The NHS uses technology to store and manage care records. These systems are protected with measures like encryption and cybersecurity monitoring. Staff are also trained to understand their responsibilities around data safety.

Physical records, like paper files, are kept in secure places. They are locked away and only accessible to authorised staff members.

All NHS organisations are checked regularly to make sure they are following data protection rules.

What Happens if Data is Leaked

If personal information is shared without permission, it is considered a breach of privacy. The NHS must report these breaches. Patients affected by the breach are informed. Steps are also taken to fix the problem and prevent it from happening again.

The Information Commissioner’s Office (ICO) oversees data protection in the UK. They can take action against organisations or individuals who break the rules, such as issuing fines.

Consent and Your Choices

The NHS processes (uses and shares) your health information under strict legal frameworks, primarily the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, alongside the common law duty of confidentiality.

• For Your Direct Care: When information is used or shared for your individual healthcare (e.g., between your GP and a hospital specialist, or during an emergency admission), the NHS typically relies on the following UK GDPR legal bases:
  • Article 6(1)(e): Processing is necessary for the performance of a task carried out in the public interest (providing healthcare).
  • Article 9(2)(h): Processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems.
    This is often alongside the common law duty of confidentiality, where your consent might be implied by seeking treatment, or expressly sought for specific procedures.
• For Research and Planning (Secondary Uses): Explicit consent (UK GDPR Article 6(1)(a) and 9(2)(a)) is often sought if identifiable information is needed for research. However, information may also be used under other legal gateways (like Section 251 of the NHS Act 2006, approved by the Confidentiality Advisory Group) or when anonymised. Remember, the National Data Opt-Out applies here (see ‘Sharing Information and Your Choices’).
• Other Legal Reasons: Information may sometimes be shared without your consent if required by law (e.g., court order, reporting certain infectious diseases – UK GDPR Art 6(1)(c) Legal Obligation) or to protect someone’s life (UK GDPR Art 6(1)(d) / 9(2)(c) Vital Interests).
• Your Choices: As outlined previously, you have choices regarding the National Data Opt-Out (for research/planning) and your Summary Care Record. You also have the right to object to processing under UK GDPR in certain situations, although this is not absolute for direct care. Speak to your GP surgery or healthcare provider to understand your choices.

Research and Planning

Your records can be used for research and healthcare planning. This helps the NHS make improvements to services. It can also help find new treatments and cures for illnesses.

In most cases, any shared information is made anonymous. This means your name and personal identifiers are removed. If researchers need identifiable data, you will usually be asked for permission first.

Monitoring and Accountability

The NHS is responsible for making sure your care records are handled correctly. There are organisations in place to monitor this, like the Care Quality Commission (CQC).

If you have concerns about how your records are used, you can file a complaint. Every NHS organisation has a complaints procedure. You can also take your concerns to the ICO if needed.

Your Rights Under the Guarantee

The NHS Care Records Guarantee aimed to explain your rights regarding your health information, which are primarily set out in data protection law (UK GDPR/Data Protection Act 2018). Key rights include:

• The Right to be Informed: To understand how your data is being used.
• The Right of Access: To request copies of your records (Subject Access Request).
• The Right to Rectification: To ask for factual mistakes in your records to be corrected.
• The Right to Erasure (Right to be Forgotten): This is limited for health records needed for care or public health.
• The Right to Restrict Processing: To ask for processing to be limited in certain circumstances.
• The Right to Object: To object to processing based on certain legal grounds (like public task), though this is not absolute for direct care.
• Rights related to automated decision-making and profiling.
• National Data Opt-Out: Your right to stop your confidential patient information being used for most research and planning.

NHS staff must follow legal and ethical guidelines. If you believe your rights have not been respected, you can raise a concern or make a complaint to the relevant NHS organisation or the Information Commissioner’s Office (ICO).

Contacting the NHS

If you have questions about your care records, you can contact your GP surgery or local NHS organisation. They should provide clear information and address any concerns you have.

You can also contact NHS England for more general advice. Their website contains useful resources about your rights and how records are managed.

Final Thoughts

The NHS Care Records Guarantee for England exists to protect the rights and privacy of patients. It explains how records are managed, who can access them, and what steps are taken to keep them secure.

If you want to know more about the guarantee or your rights, talk to your healthcare provider.