(Please note that this form should not be used by a patient wishing to access health records about them held by a local healthcare organisation (e.g. hospital, GP surgery, dental practice, pharmacy). The relevant local healthcare organisation will have its own procedure for dealing with requests for access to health records and should be contacted direct for further information.) NCAS SUBJECT ACCESS REQUEST FORM (DATA PROTECTION ACT 1998) INTRODUCTION The Data Protection Act 1998 (DPA) gives individuals (data subjects) certain rights regarding information held about them (personal data). The DPA also places obligations on those who process personal data (data controllers). The definition of personal data includes any expression of opinion about an individual and any indication of the intentions of the data controller or any other person in respect of the individual. Anyone processing personal data must notify the Information Commissioner s Office (ICO) that they are doing so, unless their processing is exempt. Anyone processing personal data must also comply with the eight data protection principles. The data must be: 1. processed fairly and lawfully 2. obtained for specific and lawful purposes 3. adequate, relevant and not excessive for those purposes 4. accurate and, where necessary, kept up to date 5. not kept for longer than is necessary 6. processed in accordance with the rights of a data subject 7. kept secure 8. not transferred abroad unless to a country with adequate data protection laws. The rights of a data subject include a right of access to personal data held about them. However, this right of access is subject to a number of exemptions. The ICO s website contains further information on the DPA and the right of access. ABOUT THIS FORM This form may be used if you wish to make a subject access request under the DPA to the National Clinical Assessment Service (NCAS) for personal information that you believe we may hold about you. NCAS is an operating division of the NHS Litigation Authority (NHS LA). The NHS LA is the data controller for the purposes of the DPA; however, subject access requests can be made directly to NCAS. Under section 7(3) of the DPA, a data controller is not obliged to comply with a request unless it is supplied with such information as it may reasonably require in order to satisfy itself as to the identity of the person making the request and to locate the information which that person seeks. Accordingly, while you may have already made a request to us by other means, we may still require you to supply us with additional information (as set out in this form). If you are requesting information on behalf of the data subject, you will need the data subject to sign the authority for you to act on their behalf in Section B and the declaration in Section E.
FEE Normally, NCAS charges a fee of 10 to process subject access requests. This fee may be waived at the discretion of the NCAS. Unless NCAS has indicated to you that the fee will be waived, you should enclose a cheque for 10 with this form made payable to NHS Litigation Authority. IDENTIFICATION Unless NCAS has indicated otherwise, you should also provide the following identity documentation: - a copy of either your passport or driving licence (photo ID); - a copy of one utility bill showing your current residential address. SUBMITTING THE REQUEST Please send the completed form, cheque and copy identity documentation to: The Information Access Manager, National Clinical Assessment Service, Area 1C, Skipton House, 80 London Road, London SE1 6LH HOW WILL WE PROCESS YOUR REQUEST? We will verify and shred your proof of identity documentation. We will aim to acknowledge receipt of your request within two working days. We may ask you to clarify the request where its terms are not clear to us or where we need additional information in order to search for the requested information. Upon our receipt of a valid request, we will arrange for searches to be carried out for the requested personal information. We may subsequently ask you whether you require copies of particular communications which we suppose may already be in your possession (e.g. correspondence previously sent to you by us or by other parties). Where the personal information requested by you is contained in records of communications with third parties (e.g. an employer or contracting body, a regulator, or a public authority), we will normally seek the views of each such third party on the issue of disclosure. We do this to inform our decision-making as to whether the disclosure of certain information (e.g. the personal information of staff members of the third party) would be lawful. We will send the response either to your residential address or to the business address of your representative by recorded delivery. TIMEFRAME There is a 40 calendar days timeframe for responding to subject access requests. We will endeavour to respond to your request within 40 days of receipt of a valid request and the fee.
SECTION A: Details of the data subject (person to whom the information relates) Title Forenames Surname Address (for correspondence) Telephone number E-mail address SECTION B: Identification Identity documentation may be required in order to for us to process your request. Please provide us with a copy of either your passport or driving licence, and a copy of one utility bill showing your current residential address. Please complete the checklist below to indicate what you have enclosed with this form. Please note: 1. The copy identity documentation will be shredded once we have verified your identity. 2. It is an offence under section 55 of the Data Protection Act 1998 to impersonate a data subject. ID supplied TICK Copy of passport / driving licence Copy of utility bill NCAS ADMINSTRATION DATE FORM RECEIVED
SECTION C: Details of person acting on behalf of the data subject Title Forename Surname Address (for correspondence) Telephone number E-mail address Relationship to data subject To authorise another person to make this subject access request on your behalf, please sign the statement below. I hereby give my authority for (full name of the person) to make a subject access request on my behalf under the Data Protection Act 1998 to the National Clinical Assessment Service, an operating division of the NHS Litigation Authority. Signed: Date: Print name: NOTE: The data subject must also sign the declaration in Section E.
SECTION D: Description of information requested Please describe the information that you believe we hold and to which you are seeking access. If you can be specific about the information that you would like, it will assist us to locate it (if we hold it). If we require further details about the information that you are requesting, we will contact you.
SECTION E: Data subject declaration I certify that the information given on this form is true. I understand that the National Clinical Assessment Service may need to obtain further information in order to comply with this request. Signed: Date: Print name: Please return this form and the enclosures to: The Information Access Manager National Clinical Assessment Service Area 1C Skipton House 80 London Road London SE1 6LH