Sometimes a complicated question has a simple answer
— Dr Suess
Question: “Who can view your medical records”
Simple answer: “A doctor, a doctor, or a doctor”.
Do we really need to reiterate that again? There is no requirement or legal authority for anyone to view your personal, private and sensitive medical records other than a doctor.
General Data Protection Regulations
Let’s start by looking at what protections there are for you and your medical records. The main one is the General Data Protection Regulations 2016/679 (‘GDPR’), tailored by the Data Protection Act 2018.
Article 4.1 GDPR defines ‘Personal data’ as follows,
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
Medical records are one step further from ‘Personal data’ and is classed as a ‘special category’ of personal data, also known as ‘sensitive personal data’,
Article 9.1 GDPR defines the processing of special categories of personal data,
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
The GDPR recognises the importance of this special category of data citing that they are subject to a higher level of protection. There are two ways in which someone may lawfully process (view) or obtain your medical records, the first is consent and the second is a statutory authority. Regardless of the authority relied upon, it doesn’t allow the uncontrolled dissemination or arbitrary viewing of your medical records.
In the world of ill-health retirement and injury awards, here are four of the most common scenarios when access may be required to your medical records,
- Ill-health retirement
- ‘Assessment for an injury award’
- ‘Reassessment of an injury pension’
- ‘Appeal to board of medical referees’, usually in response to one of the above events
For practical purposes, scenarios one and two are often considered concurrently by the Police Pension Authority (‘PPA’) as an application for an injury award will often run in parallel with ill-health retirement. Even though this frequently occurs, the necessity for access to your medical records is different in each case.
1. Ill-Health Retirement
When an officer applies for ill-health retirement, the PPA are ordinarily obliged to refer a number of medical questions to a Selected Medical Practitioner (‘SMP’) under one of the police pension schemes.
It is suggested that the Force Medical Examiner (‘FMA’), who would usually have had some involvement in your case up until this point are required to provide an opinion to the SMP, as defined in Home Office (‘HO’) guidance and confirmed by Police Negotiating Board (‘PNB’) Circular 03/19,
18. In normal cases the police authority should ask the FMA most familiar with the case to provide advice on the case to the SMP…. The purpose of the FMA’s advice is to inform the assessment by the SMP…
19. To assist the SMP, the FMA’s advice will consist of two sections: a medical background and opinion:
· The medical background will include all relevant medical details and history of the case. This section should take account of the assessments of the officer’s GP and hospital specialist as appropriate and wherever possible should be supplemented with relevant records, reports, X-rays or scans. (The FMA should seek the written consent of the officer for this section to be referred to the SMP.)
· The opinion will be the FMA’s advice to the SMP on the issue of permanent disablement in answer to the questions under regulation H1(2)(a) and (b).The authority should ensure that the FMA is aware of the officer’s compulsory retirement age. Where the FMA is of the view that the officer is permanently disabled he or she should also give his or her opinion on the officer’s capability. (This section will not include any confidential medical information and therefore no consent of the officer is required.)
It is perfectly acceptable for the FMA and SMP to be able to view your medical records as ill-health retirement is a medical decision and they are both qualified doctors.
What is not acceptable, or necessary is for any other non medical person or third party to have access to, or be able to view your medical records. This includes, but is not limited to other staff in –
- Occupational Health Units
- Human Resources
- Force Solicitors
- Senior Management
- PPA (Chief Constable)
- Any other person
None of these people are responsible for making a medical determination, and therefore there is no legal requirement or need for them to be able to access your medical records.
In our opinion, all requests for consent to obtain, or process your medical records should come directly from the FMA, or the SMP. Records should only be released directly to the person requesting it. More of this later.
2. Assessment for an injury award – reg 30
An application for an injury award (injury gratuity and injury pension) is no longer managed under any of the police pension schemes, but under The Police (Injury Benefit) Regulations 2006. As there is no reference to the FMA in the regulations, it is questionable whether they have any need or legal authority to view your medical records.
Regulation 30 of the PIBR 2006 confirms that it is the SMP, who is required to answer a number of medical questions,
30 (2) Subject to paragraph (3), where the police authority are considering whether a person is permanently disabled, they shall refer for decision to a duly qualified medical practitioner selected by them the following questions—
(a) whether the person concerned is disabled;
(b) whether the disablement is likely to be permanent…
(c) whether the disablement is the result of an injury received in the execution of duty, and
(d) the degree of the person’s disablement;
What is not acceptable, or necessary is for any non medical person or third party to have access to, or be able to read your medical records. This includes, but is not limited to other staff in –
- Occupational Health Units
- Human Resources
- Force Solicitors
- Senior Management
- PPA (Chief Constable)
- Any other person
In our opinion, all requests for consent to obtain, or process your medical records should come directly from the SMP. Records should only be released directly to the person requesting it. More of this later.
3. Reassessment of an injury pension – reg 37(1)*
Before an injury pension can be revised under regulation 37(1) of the PIBR 2006, the PPA has to find that the ‘degree of the pensioner’s disablement has substantially altered‘. This is a medical question and Regulation 32(2)(d) dictates that the PPA shall refer the question to an SMP,
30(2) Subject to paragraph (3), where the police authority are considering whether a person is permanently disabled, they shall refer for decision to a duly qualified medical practitioner selected by them the following questions—
…
(d) the degree of the person’s disablement; and, if they are considering whether to revise an injury pension, shall so refer question (d) above.
As stated before, the regulations do not mention the FMA at all. Therefore there is no necessity or lawful authority for them to request or view your medical records.
We believe that any request for consent to view existing medical records or obtain medical records should come directly from the SMP, with a justification as to what medical information they seek and why. Only the SMP can decide what medical information they may require in any particular case, and each case would have to be considered individually.
We can now add the FMA to our previous list of people who should not access your medical records under an injury review –
- FMA
- Occupational Health Units
- Human Resources
- Force Solicitors
- Senior Management
- PPA (Chief Constable)
- Any other person
It is not acceptable for any other third party to make this request for or on behalf of the SMP, which includes HR managers, even if they have had powers delegated to them by the PPA under the PIBR 2006. The PPA does not have the authority to view your medical records and therefore neither can their delegate.
In our opinion, all requests for consent to obtain, or process your medical records should come directly from the SMP. Records should only be released directly to the person requesting it. More of this later.
4. Appeal to board of medical referees – reg 31
An appeal to a Police Medical Appeal Board (‘PMAB’) may require you to provide consent to release your medical records. The PMAB is an independent body and all requests should come directly from the board as defined in HO guidance and confirmed by PNB Circular 03/19,
59. It will be for the board chair appointed by Aon to arrange as necessary for the appellant’s consent to release other medical records, as applicable, from:
· the appellant’s General Practitioner
· any hospital or specialist which has treated the appellant, together with details of any tests and final reports. Aon will send the appellant the necessary consent form. Any reasonable costs necessarily incurred by the board in obtaining these records will be added to the board’s expenses at the end of the case
What is not acceptable, or necessary is for any non medical person or third party to have access to, or be able to read your medical records. This includes, but is not limited to other staff in –
- FMA
- Occupational Health Units
- Human Resources
- Force Solicitors
- Senior Management
- PPA (Chief Constable)
- Any other person
It is not acceptable for any other third party to make this request for or on behalf of the PMAB, which includes force solicitors, even if they have had powers delegated to them by the PPA under the PIBR 2006. The PPA does not have the authority to view your medical records and therefore neither can their delegate.
All requests for consent to obtain, or process your medical records should come directly from the PMAB. Records should only be released directly to the PMAB. More of this later.
In summary
At present there appears to be a wholesale abuse of medical records. We believe that the following good practice should be adopted,
- Requests should only come directly from the FMA, SMP or PMAB where appropriate.
- The request should be on headed paper and signed by the individual concerned.
- There should be written justification of what medical records are required and why.
- Medical records should only be provided directly to the appropriate doctor requesting them.
- All records will be held securely and confidentially.
- There should be a record of access for each set of records with a log of who accessed the records, when, where and why.
- No records will be divulged to any third party without additional and express permission.
- At the conclusion of the process, all records, other than those which may be lawfully retained should be returned, or confidentially destroyed.
- A declaration should be signed by the person requesting the records that the above conditions will be complied with at the point of request.
This article has been written taking into account the views of the Information Commissioners Office (‘ICO’) who enforce the lawful application of the GDPR. A separate document containing their opinions on these issues can be found here – https://iodpa.org/the-general-data-protection-regulations-gdpr-and-you/
*Whilst this article does refer to providing consent to access or provide medical records under certain conditions, the current legal advice is that there is NO requirement to provide any consent with regards to a reg 37(1) review.
The top and bottom of this is don’t trust any police service with anything regarding personal information on yourself whatsoever, if requests are made, challenging them as to why they need it should be made, as a former Staffordshire officer I can only comment on the disgusting behaviour of my former employer, I have absolutely no trust at all in this organisation and how it has cruelly treated its iod recipient’s, in future if I am ever asked for anything from them I will seek professional legal advice first, do not trust them at all with Anything, even a seemingly innocent request, the sneaky b**tards will want info for a specific reason, I have a friend who is interested in joining the police service, all I said was “I wouldn’t join staffs mate”.. That says it all really
Thank you IODPA for this article and raising awareness that the only person who should ever see your medical records with your consent is a medical doctor.
The contemptuous manner in which we are treated by our former employers gets worse not better as time goes on. Nothing exemplifies this better than the wholesale disregard for the privacy of highly sensitive medical records.
Despite continuous numerous breaches of the Data Protection Acts by several Police Forces and their employees and agents the ICO continues to only issue guidance.
Hardly a toothless tiger more a paper tiger, the ICO show themselves to be completely unwilling and unable to enforce the law in a manner that ensures compliance.
Due to their failure to act effectively these breaches of the GPD will continue, the offenders safe in the knowledge that the law will not be enforced in any meaningful way by the ICO.
Stand up to these bullies folks and spread the word. Police Forces have no right at all to see your medical records so don’t let them.
I am so glad I put subject access requests in not just to staffs police but to other organisations such as medical companies who have provided smp’s. If it is as it appears to be the case that only a doctor can request and view information, a certain little person in hr at Staffordshire police can gladly explain why he has gone through all of my medical notes, emailed and advised and asked for certain actions to be undertaken in a court, I cannot wait for this as tut tut andrew you left a trail of your efforts.
What type of Doctors are they employing as SMP,s. I refused access to my medical records as I wouldn’t trust anyone within Staffs with them.
To cut a long story short when I went for my “review” with the SMP because he hadn’t got hold of my medical records, although I produced a comprehensive report outlining my medical condition from my GP, he refused to make a decision. No questions asked of me regarding my injury on duty. No request by him to medically examine me. Surely a Doctor should be able to assess you by questions and a medical examination. If not is he/she up to the job of being an SMP.
What is wrong with a comprehensive report from the person who knows you best…your own Doctor. Or dont they trust your Doctor. Or are they looking for anything else in your medical records to latch on…….
Well done IODPA for posting this clarification. It really does help.
I am aware a little Solicitor in Northumbria has been unlawfully getting the HR bod to intercept the consent forms for PMAB’s and likely 37(1) reviews, to “Paginate” them for the PMAB Board. He then releases your Special Category data to the board as part of his report. Let me make that clear – The force solicitor is getting HR to get hold of your consent form, HR then send off for your FULL medical records from birth sometimes, hand the records to the solicitor to paginate and then he submits your Special Category data to the PMAB as part of his report. Now who believes HR don’t have a little look through those records? Who believes the solicitor just paginates them without pulling out the juicy bits that fit his argument?
Neither do I. This practise is wrong, unlawful, morally reprehensible and the persons involved in this little ruse need to be disciplined and kicked out of their position. I wonder if we turned round and said “You show me yours and I will show you mine” if they would? No, neither do I.
Perhaps we could all have a laugh at who has had testicular cancer, or who lost a child, or why some people are born with dwarfism?
All of these conditions are nothing to do with your index injury, but somebody, somewhere in a dark little corner is beavering away trying to find something they can use to reduce your banding – Isn’t that right Nicholas, Jon, and your HR helpers. Watch this space – prosecutions are coming!!!
Are you kidding me? When I signed my forms to release my records for my appeal board, I thought those running the board would actually get my records therefore bypassing my force. I had refused my records to be released to the force as I didn’t trust them with my data. So they (my force) actually applied for the records on behalf of the company who runs the appeal boards and having a good gawp through them all, hands them across eventually to the board? How the f### is this being allowed to happen? Corrupt, and wrong is what this is. And what’s even worse, I had no idea they had done this. I am livid beyond words. I signed that form in good faith and trusted those who were running my appeal. That’s why this website and organisation is crucial to us all, they allow us to share vital information with each other.
A question back at you IODPA. Why is it that HR are demanding us to send us our doctors records to them then? And threatening to remove our pensions if we don’t comply with their intimidating threats. We should be only supplying the SMP with them at a review, if I read your post correct. Whole scale abuse has been happening and by the looks of it, is still happening.
Alex, you are correct and this is our understanding of The Police (Injury Benefit) Regulations 2006 and the GDPR.
If we are correct, no one has the authority to request or view your medical records other than a doctor.
We believe that this unlawful activity and wholesale abuse has been going on for years!
Very informative article IODPA. Thankfully I haven’t been subjected to anything like this yet but when they do come knocking, there is no chance they are getting my medical information.
What you do for us injured police officers is incredible and I will always be thankful and grateful you are there to look after our interests. There is genuinely nobody else out there who is doing what you good people do for us. Because of you, I am able to sleep better at night.
Harry
So how does it work when the HR Support Advisor in my infamous force, has read all my Medical notes that I foolishly sent in, before I discovered IODPA, and actually sent a memo to the SMP what he thinks is wrong with me. I kid you not. An HR Admin chap, with no medical qualifications going through my extremely private GP notes, and is highlighting medical issues. THIS SHOULD NEVER BE ALLOWED TO HAPPEN. It is wrong morally, ethically and lawfully.
The more I think about it, the angrier I become. I was fooled, hoodwinked, bamboozled into handing my notes over. And what is worse, is that this force won’t send my notes back to me. So I have had this massive worry over me for months that any Tom, Dick, Harry and Andrew have been able to read them.
Doesn’t surprise anyone.
What I am surprised about is that continue to try and defend their inappropriate seizures of our sensitive data.
The ICO has not fined the Forces despite finding in the IOD’s favour following numerous complaints. The ICO just keeps giving the Forces guidance despite them not complying to any DPA legislation on processing or controlling sensitive data.
The Forces continue not to comply with the Regulations under which the Officers/IOD’s were contracted/employed by.
Shame on those handful of Forces who continue reviewing, their garden stinks to high heaven of maladministration and corruption.
It makes me really really angry to think of who may have looked at my medical records…and I know for a fact that it isn’t just the SMP….as at one review the SMP actually said ‘ HR have sent me your medical notes’…no who had been rifling through those to pick out totally irrelevant information??
When you sign a consent form, giving them authority for a ‘report’from your GP, and then they ask your GP for full records from birth!
The whole system is a shambles, and I really really hope that certain individuals, I.e Coley & Morgan from Staffordshire Police, are bought to task over it…
It’s seriously worryingly and frustrating to think that police authorities HR etc are fully aware of What is right and wrong in their interpretations of the “ medical notes” demands but still persist in the manipulation of the facts and disruption of injured officers lives.
A court has to nail this down!!
Prior to my ET, my solicitor informed me that the ET judge had requested that I provide my medical records from a specific period. Had I known at that time, that all and sundry from the opposing side would then have access to those records, then I would have refused. The opposing barrister, (obviously without medical expertise), even attempted to offer a weak opinion on one of my medical conditions, without a whimper of protest from my barrister or the presiding judge. The whole subject makes me sick to the stomach.
Well where do I begin, maybe at the start?!
My SAR (Subject Access Request) shows that my Force HR (on 4 occasions) recommended to the SMP I should be reviewed. It’s meant to be be the other way around clowns!).
My HR considered that I should be reviewed, So informed the SMP that they would request and access my medical notes first, After reviewing MY medical notes (none medical personnel, admin, Hr assistants, HR advisors) sent it to legal dept, all having a good read into my Confidential medical notes. HR then sent a report to the SMP with recommendations to lower my IOD banding, but added in lots of false and unrelated data relating to another officer together with my medical notes for them to to review! Seriously you couldn’t make it up..
The Force is Northumbria, bring it on……… it’s all in the paperwork, Northumbria have conducted UNLAWFUL reviews for at least 15 years. Northumbria PPA…….your legal advisor needs to be sacked!
Great article, very concise and informative. Thanks IODPA for your continued support keeping vulnerable injured on duty officers up to date and able to make the correct decisions
Thanks again
Unfortunately, yet again we learn from experience that loyalty means nothing to this modern era’s Chief Officers or their voracious (in terms of saving cash), employed lackeys in HR & OH Dept’s.
I have personally experienced these ‘honest’ employees and SMP’s breach confidentiality and share such ‘higher level personal data’, or tell any number of ‘half truths, seemingly without a care.
Why? Because “they are the police, so they can’t do any wrong”, is their attitude.
Quite often some seemingly innocuous requests, politely written, need careful checking, as the ‘Consent form(s)’, often ask for much more info than the letter implies, but worse, once obtained, they either refuse to release or destroy the data, or often having sworn that they have done so, in reality they haven’t, (and if truth be told, will never do so!)
The answer is clear, as intimated in the blog. Don’t give it at all, unless it is absolutely essential.
Don’t give full access even then, as you can exclude 3rd party, or other non-injury related conditions, if it is a review of an Injury On Duty Pension.
You should tie down very specifically, who; for what purpose; where kept; who has access; and the return/destruction (without copy) of the data, you will allow.
That way, hopefully, the ICO would act on any complaint, but more importantly, the door then opens for action against the data abusers via the Courts, with some Solicitors well experienced in such actions.
Always, always, seek guidance from IODPA, before you consent to any information release. Remember, once it’s in their sticky paws, you’ll struggle to get it back.
Having been requested by H/R in Summer last year to provide access to my medical records for the second time for my IOD application, the first time being for IHR in autumn 2018 can/should I therefore now be requesting that the Force A) Confirm who has accessed them and for what purpose and B) That the Force return ALL copies to me via recorded delivery – I would not trust them to destroy them confidentially?
Also, I wait until the IOD situation is resolved and request the same of the SMP? Many thanks
Some Forces are saying that they will retain ALL medical records until your death.
I made a caveat on release of my records for a review which stated ‘only records that relate directly to my injury on duty’ I was then bombarded with requests for consent to ‘FULL’ disclosure (from birth!)
In the same situation again (as they have all my medical notes and are refusing to destroy them so no idea where they are are or who has access to them) I would seek expert legal advice and let them act on my behalf,