Consent For Release Of Protected Health Information Template for England and Wales

A Consent For Release Of Protected Health Information is a legal authorization document that allows healthcare providers in England and Wales to share your medical records with specified third parties. This document is required under UK GDPR and the Data Protection Act 2018 to ensure your health information is only disclosed with your explicit consent and for legitimate purposes. Without proper consent, healthcare providers face significant legal restrictions on sharing your medical information, making this document essential for various healthcare and legal scenarios.

When do you need this document?

You need this consent form when your medical records must be shared outside the immediate healthcare team treating you. Common situations include transferring care to a new healthcare provider, supporting insurance claims, providing medical evidence for legal proceedings, or enabling family members to access your health information during incapacity. Employers may also require medical information for occupational health assessments or disability accommodations. The document is particularly important when seeking second opinions from specialists who are not directly involved in your NHS care, or when private healthcare providers need access to your NHS records.

Key legal considerations

The consent must be specific, informed, and freely given under UK GDPR requirements. You have the right to limit exactly what information is disclosed, specify the purpose for disclosure, and set time limits on the authorization. The document should clearly identify the recipient and include safeguards for how your information will be protected after disclosure. You maintain the right to withdraw consent at any time, and healthcare providers must ensure the recipient has legitimate grounds for processing your health data. Special category data protections apply to health information, requiring higher standards of consent and security. The document must also comply with professional confidentiality obligations and NHS information governance requirements.

Legal requirements in England and Wales

Under the Data Protection Act 2018 and UK GDPR, healthcare providers must have a lawful basis for processing health data, with explicit consent being the most common basis for disclosure to third parties. The Access to Health Records Act 1990 governs how medical records can be accessed and shared, particularly regarding deceased patients. NHS providers must follow additional information governance standards under the National Health Service Act 2006. The common law duty of confidentiality requires healthcare professionals to maintain patient privacy unless disclosure is authorized or legally required. Consent forms must include specific information about data protection rights, including the right to access, rectify, or erase personal data, and the right to lodge complaints with the Information Commissioner's Office.