GDPR

Who can view your medical records?

Who can view your medical records?

Sometimes a complicated question has a simple answer

— Dr Suess

Question: “Who can view your medical records”

Simple answer: “A doctor, a doctor, or a doctor”.

Do we really need to reiterate that again? There is no requirement or legal authority for anyone to view your personal, private and sensitive medical records other than a doctor.

 

General Data Protection Regulations

Let’s start by looking at what protections there are for you and your medical records. The main one is the General Data Protection Regulations 2016/679 (‘GDPR’), tailored by the Data Protection Act 2018.

Article 4.1 GDPR defines ‘Personal data’ as follows,

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

 

Medical records are one step further from ‘Personal data’ and is classed as a ‘special category’ of personal data, also known as ‘sensitive personal data’,

Article 9.1 GDPR defines the processing of special categories of personal data,

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

 

The GDPR recognises the importance of this special category of data citing that they are subject to a higher level of protection. There are two ways in which someone may lawfully process (view) or obtain your medical records, the first is consent and the second is a statutory authority. Regardless of the authority relied upon, it doesn’t allow the uncontrolled dissemination or arbitrary viewing of your medical records.

In the world of ill-health retirement and injury awards, here are four of the most common scenarios when access may be required to your medical records,

  1. Ill-health retirement
  2. ‘Assessment for an injury award’
  3. ‘Reassessment of an injury pension’
  4. ‘Appeal to board of medical referees’, usually in response to one of the above events

For practical purposes, scenarios one and two are often considered concurrently by the Police Pension Authority (‘PPA’) as an application for an injury award will often run in parallel with ill-health retirement. Even though this frequently occurs, the necessity for access to your medical records is different in each case.

 

1. Ill-Health Retirement

When an officer applies for ill-health retirement, the PPA are ordinarily obliged to refer a number of medical questions to a Selected Medical Practitioner (‘SMP’) under one of the police pension schemes.

It is suggested that the Force Medical Examiner (‘FMA’), who would usually have had some involvement in your case up until this point are required to provide an opinion to the SMP, as defined in Home Office (‘HO’) guidance and confirmed by Police Negotiating Board (‘PNB’) Circular 03/19,

18. In normal cases the police authority should ask the FMA most familiar with the case to provide advice on the case to the SMP…. The purpose of the FMA’s advice is to inform the assessment by the SMP…


19. To assist the SMP, the FMA’s advice will consist of two sections: a medical background and opinion:


· The medical background will include all relevant medical details and history of the case. This section should take account of the assessments of the officer’s GP and hospital specialist as appropriate and wherever possible should be supplemented with relevant records, reports, X-rays or scans. (The FMA should seek the written consent of the officer for this section to be referred to the SMP.)


· The opinion will be the FMA’s advice to the SMP on the issue of permanent disablement in answer to the questions under regulation H1(2)(a) and (b).The authority should ensure that the FMA is aware of the officer’s compulsory retirement age. Where the FMA is of the view that the officer is permanently disabled he or she should also give his or her opinion on the officer’s capability. (This section will not include any confidential medical information and therefore no consent of the officer is required.)

 

It is perfectly acceptable for the FMA and SMP to be able to view your medical records as ill-health retirement is a medical decision and they are both qualified doctors.

What is not acceptable, or necessary is for any other non medical person or third party to have access to, or be able to view your medical records. This includes, but is not limited to other staff in –

  • Occupational Health Units
  • Human Resources
  • Force Solicitors
  • Senior Management
  • PPA (Chief Constable)
  • Any other person

None of these people are responsible for making a medical determination, and therefore there is no legal requirement or need for them to be able to access your medical records.

In our opinion, all requests for consent to obtain, or process your medical records should come directly from the FMA, or the SMP. Records should only be released directly to the person requesting it. More of this later.

 

2. Assessment for an injury award  – reg 30

An application for an injury award (injury gratuity and injury pension) is no longer managed under any of the police pension schemes, but under The Police (Injury Benefit) Regulations 2006. As there is no reference to the FMA in the regulations, it is questionable whether they have any need or legal authority to view your medical records.

Regulation 30 of the PIBR 2006 confirms that it is the SMP, who is required to answer a number of medical questions,

30 (2) Subject to paragraph (3), where the police authority are considering whether a person is permanently disabled, they shall refer for decision to a duly qualified medical practitioner selected by them the following questions—

(a) whether the person concerned is disabled;

(b) whether the disablement is likely to be permanent…

(c) whether the disablement is the result of an injury received in the execution of duty, and

(d) the degree of the person’s disablement;

What is not acceptable, or necessary is for any non medical person or third party to have access to, or be able to read your medical records. This includes, but is not limited to other staff in –

  • Occupational Health Units
  • Human Resources
  • Force Solicitors
  • Senior Management
  • PPA (Chief Constable)
  • Any other person

In our opinion, all requests for consent to obtain, or process your medical records should come directly from the SMP. Records should only be released directly to the person requesting it. More of this later.

 

3. Reassessment of an injury pension – reg 37(1)*

Before an injury pension can be revised under regulation 37(1) of the PIBR 2006, the PPA has to find that the ‘degree of the pensioner’s disablement has substantially altered‘. This is a medical question and Regulation 32(2)(d) dictates that the PPA shall refer the question to an SMP,

30(2) Subject to paragraph (3), where the police authority are considering whether a person is permanently disabled, they shall refer for decision to a duly qualified medical practitioner selected by them the following questions—

(d) the degree of the person’s disablement; and, if they are considering whether to revise an injury pension, shall so refer question (d) above.

 

As stated before, the regulations do not mention the FMA at all. Therefore there is no necessity or lawful authority for them to request or view your medical records.

We believe that any request for consent to view existing medical records or obtain medical records should come directly from the SMP, with a justification as to what medical information they seek and why. Only the SMP can decide what medical information they may require in any particular case, and each case would have to be considered individually.

We can now add the FMA to our previous list of people who should not access your medical records under an injury review –

  • FMA
  • Occupational Health Units
  • Human Resources
  • Force Solicitors
  • Senior Management
  • PPA (Chief Constable)
  • Any other person

It is not acceptable for any other third party to make this request for or on behalf of the SMP, which includes HR managers, even if they have had powers delegated to them by the PPA under the PIBR 2006. The PPA does not have the authority to view your medical records and therefore neither can their delegate.

In our opinion, all requests for consent to obtain, or process your medical records should come directly from the SMP. Records should only be released directly to the person requesting it. More of this later.

 

4. Appeal to board of medical referees – reg 31

An appeal to a Police Medical Appeal Board (‘PMAB’) may require you to provide consent to release your medical records. The PMAB is an independent body and all requests should come directly from the board as defined in HO guidance and confirmed by PNB Circular 03/19,

59. It will be for the board chair appointed by Aon to arrange as necessary for the appellant’s consent to release other medical records, as applicable, from:
· the appellant’s General Practitioner
· any hospital or specialist which has treated the appellant, together with details of any tests and final reports. Aon will send the appellant the necessary consent form. Any reasonable costs necessarily incurred by the board in obtaining these records will be added to the board’s expenses at the end of the case

What is not acceptable, or necessary is for any non medical person or third party to have access to, or be able to read your medical records. This includes, but is not limited to other staff in –

  • FMA
  • Occupational Health Units
  • Human Resources
  • Force Solicitors
  • Senior Management
  • PPA (Chief Constable)
  • Any other person

It is not acceptable for any other third party to make this request for or on behalf of the PMAB, which includes force solicitors, even if they have had powers delegated to them by the PPA under the PIBR 2006. The PPA does not have the authority to view your medical records and therefore neither can their delegate.

All requests for consent to obtain, or process your medical records should come directly from the PMAB. Records should only be released directly to the PMAB. More of this later.

 

In summary

At present there appears to be a wholesale abuse of medical records. We believe that the following good practice should be adopted,

  1. Requests should only come directly from the FMA, SMP or PMAB where appropriate.
  2. The request should be on headed paper and signed by the individual concerned.
  3. There should be written justification of what medical records are required and why.
  4. Medical records should only be provided directly to the appropriate doctor requesting them.
  5. All records will be held securely and confidentially.
  6. There should be a record of access for each set of records with a log of who accessed the records, when, where and why.
  7. No records will be divulged to any third party without additional and express permission.
  8. At the conclusion of the process, all records, other than those which may be lawfully retained should be returned, or confidentially destroyed.
  9. A declaration should be signed by the person requesting the records that the above conditions will be complied with at the point of request.

This article has been written taking into account the views of the Information Commissioners Office (‘ICO’) who enforce the lawful application of the GDPR. A separate document containing their opinions on these issues can be found here – https://iodpa.org/the-general-data-protection-regulations-gdpr-and-you/

*Whilst this article does refer to providing consent to access or provide medical records under certain conditions, the current legal advice is that there is NO requirement to provide any consent with regards to a reg 37(1) review.

Catch Up

Catch Up

For a wrongdoer to be undetected is difficult; and for him to have confidence that his concealment will continue is impossible

Epicurus

 

There has been so much going on. It’s hard to know where to start. IODPA has grown in a very short space of time from its beginnings of a handful of IOD pensioners to its proud status as a registered national charity.

Membership of IODPA is growing apace. Every force in England and Wales is now represented, and we also are honoured to have members from Northern Ireland and Scotland. Our members bring with them a wealth of knowledge, experience and skills which all add to the collective strength and capabilities of IODPA.

We thought it was timely to mention, and to celebrate, some of our successes over recent months. Uniquely, IODPA gets it strength from the efforts of determined individuals who stand up to maladministration of injury pensions in whatever forms it takes. We are not a top-down organisation. The strength and success of IODPA comes from its members, and from its supporters.

So let’s see what’s been happening.

Let’s start with our members. Every time a new member joins we get to hear their account of wrongdoing by injury pension scheme managers. It
saddens us to hear so many pitiful stories of the harm done to disabled former officers by uncaring HR managers, by SMPs, by police pension
authorities who view the police injury pension Regulations as a tool to save money and by some police and crime commissioners who do not want to
know the bad news about wrong doing by senior officers and others.

Happily, IODPA is shining a light of ever increasing brilliance into the murky corners of those HR departments who deliberately abuse the
Regulations. We are watching, we are listening and we will ensure compliance with the Regulations and current caselaw. IODPA spreads
knowledge, and knowledge is power. We empower our members to stand up for their rights. By exposing wrongdoing we empower right minded HR
managers to conduct themselves within the law.

Our members are living proof of the old adage that in unity there is strength.

What then of our supporters? We have recently announced we have our first Patron. None other than Pete Conway has kindly agreed to be a
Patron of IODPA. Pete Conway is the stage name of Peter Williams, who describes himself as, ‘Veteran Entertainer, Sports nut and father of a
famous son.’ and is none other than the father of the World-famous singer Robbie Williams.

As one of the roles of a Patron is to raise public awareness of the charity they support, we are confident that Pete will bring IODPA to the
attention of a wider audience beyond former and serving police officers and their families.

Elsewhere, we know that NARPO has consistently done what it could to support disabled former officers, so we are delighted to reveal that Brian Burdus, President of NARPO, together with Vice President Richard Critchley, CEO Steve Edwards and Deputy CEO Alan Lees met with trustees of IODPA in Wakefield recently. Brian has written in the NARPO magazine that there was, “…agreement that the work they [IODPA] did was a useful source for members to use.” Branch secretaries have been advised of the NARPO recognition of the valuable work we do for former officers who were injured and disabled in the line of duty.

It was a pleasure for our trustees to meet with the Brian, Richard, Steve and Alan, and we thank them for their generous welcome. IODPA will continue to work together with NARPO at local and national level, which can only be good news for all IOD pensioners.

We ought to elaborate here on the valuable work IODPA does. We provide general and personalised advice and support for all our members.
We help former and serving officers to understand the Regulations which govern injury awards, and thus help them protect their rights against
the widespread and persistent maladministration which has poisoned what is intended to be a benevolent provision of lifelong compensation for
disabled former officers.

Beyond advice, we are empowered by having a very close working relationship with two excellent firms of solicitors. We know that all
too often forces can be remarkably stubborn. They often have a pathological antipathy to admitting mistakes, and sometimes the only way
to ensure they apply the Regulations lawfully is to challenge them in court. Haven Solicitors and Cartwright King together have the most
expert and profound understanding of the Regulations, and all associated law, and know exactly how to deal with SMP’s and police pension
authorities’ misdeeds.

We also are happy to have a more recent but equally successful association with Equal Justice, which specialises in Employment Tribunal cases.

Our solicitors instruct David Lock, QC of Landmark Chambers. David has developed a special interest and expertise in all aspects of police
injury pensions and is responsible for bringing about successful resolutions in a string of cases, all of which have greatly enhanced
understanding of how the Regulations should be applied. His successes have exposed the chronic failures of some police pension authorities and
we thank him for that and for the most helpful informative opinion pieces he has published on line. We only hope that good-hearted and
well-intentioned HR people take note and join with us in condemning those of their colleagues who would seek to abuse the Regulations.

Indeed, raising awareness is a constant theme of IODPA’s work. We have a ready audience of IOD pensioners who are growing daily more alert
to the sad fact that many HR departments have poorly trained staff, who are under pressure to produce results, often by methods which are at
best dubious and at worst downright unlawful. We aim to be a counter voice to those who whisper in the ears of HR employees and others. We
speak the truth. We expose those whose motivation is contrary to the intentions of the Regulations. We explain the rules. In so doing we aim
to encourage decent folk to resist all pressure to act in ways which demean their integrity.

That leads us seamlessly on to mention the new General Data Protection Regulation (GDPR). It is readily apparent that some forces have played fast and loose with the personal information they hold which refers to former officers. We have heard of multiple instances where information has been accessed, ‘processed’ in the language of the data protection legislation, without the consent or knowledge of the data subject. We have also been most concerned to see repeated instances of forces using very dubious practices, including threats, in attempts to compel disabled former officers into giving access to sensitive personal information, such as details of income, employment, and health.

We are pleased to see the GDPR, which came into effect on the 25th May, very much tightens up the way organisations safeguard and process personal information. We anticipate IOD pensioners will use the GDPR to check how their personal data is held, to prevent any unlawful use of it, and to put a firm stop to all unlawful attempts to obtain information which forces or police pension authorities have no entitlement to seek.

IODPA has arranged a special two day seminar during which we will learn from experts how the GDPR can be used to help further the
effectiveness of our charitable work.

As part of IODPA’s ongoing work to inform, educate and share we have held several well attended conferences and workshops in various
locations across the country. We recently held our first meeting in Northumbria and are planning another one shortly, where IODPA will be
assisting all injury on duty pensioners who want to learn how to protect their rights.

In conjunction with NARPO, we achieved a major about-turn from one police pension authority which had sent out notices to pensioners that
their degree of disablement was to be reviewed. The author of the letter had tried to claim that failure to complete an enclosed questionnaire
was covered by the Regulations, and that any such failure would allow the police pension authority to reduce the pension down to band one.

When confronted over this flagrant abuse of the Regulations, the Chief Constable had no option other than to offer an apology and arrange
withdrawal of the review notices and questionnaires.

We are awaiting the next move from this particular force.

And on that note, we end this brief catch up with a word of thanks and praise to those who are perhaps the silent invisible
supporters of all that IODPA stands for – the decent right minded HR managers and others who are prepared to work to ensure the police
pension regulations are applied honestly and fairly.