Access to patient records

A member of the research team requires access to medical records in order to identify a potential cohort of patients, who they would then approach and ask to participate in a research study. The researcher is not part of the healthcare team. What consent provisions should be in place?

In order for an individual to have legitimate access to a patient's record, consent should be in place, with certain exceptions (see below). Consent is implicit if access is by a member of the healthcare team.


The healthcare team and implied consent

A member of the healthcare team delivers healthcare directly to the patient (or supports others to do so) and can access the patient records for that purpose. This legitimate healthcare relationship between individual clinician and patient relies on past and current delivery of healthcare to the patient. Healthcare means all types of patient care services, including diagnostic, preventive, continuing-care and rehabilitative-care services; and the audit/assurance of quality of the healthcare provided. This includes some administration staff, e.g. medical secretaries - who, whilst not directly caring for patients, do support the work of clinicians; and medical students delivering routine care to a patient, but medical students purely on a research placement would not be considered part of the healthcare team.

If there is any doubt about the individual's role in the healthcare team, one of the clinicians who is delivering healthcare to the patient should obtain explicit patient consent for the individual to access the patient's records. The individual may then have access to their records.

The basis on which the NHS operates is that this access has implied consent. Consent cannot simply be assumed, there must be a basis for implying consent. Most patients are aware that their GPs /consultants do not type up their own referral / discharge letters. There is therefore a basis for implying consent for activities that directly support the care of the patient (i.e. in this case for the administration staff to type these letters). The administration staff are also under a contractual obligation of confidentiality.

Access to a patient's records on the basis of a possible future healthcare relationship requires explicit consent from the patient. These healthcare relationships would include the patient as a research participant.


Exceptions to when consent is required

Confidential identifiable patient information can be disclosed in certain circumstances without consent, for example if required by law. Examples of two situations which are relevant for research are outlined below.

  • Disclosure with Section 251 Approval

    In England and Wales, the Confidentiality Advisory Group (CAG) of the Health Research Authority (HRA) can give individual projects approval to access confidential patient information without consent under Section 251 of the NHS Act 2006. Please see Section 251 approval for further information. There is no statutory equivalent in Scotland or Northern Ireland, please see Privacy Advisory Committees for further guidance on requirements in these nations.

  • British Medical Association Confidentiality and health records tool kit

    The British Medical Association Confidentiality and health records tool kit (Card 13 or PDF page 53) outlines circumstances where disclosures without consent can be made if in the public interest, where the benefits to an individual or to society of disclosure outweigh the public and patient's interest in keeping the information confidential. 

    It should be noted that the decision to disclose information in the public interest lies with the NHS organisation responsible for the data. The duty of confidence should not be set aside lightly with any decision to disclose information without consent being made on a case-by-case basis, and the extent of the infringement of the patient's privacy and confidentiality (and the harm to the overall trust between doctors and patients) weighed against the benefits which are likely to arise from release of the information.

There are many other guidance documents that have been produced to help the research community understand these circumstances. Some are summarised in the MRC publication 'Consent for Consent' which also includes some key recommendations. All relevant guidance is listed in Should consent be sought?