Medical Information Request Form Template for England and Wales

When you need to request medical information in England and Wales, you must follow strict data protection laws that govern how sensitive health data is accessed and shared. A Medical Information Request Form provides the legal framework to properly request patient records while ensuring compliance with UK GDPR and the Data Protection Act 2018. This standardized document protects both patients' privacy rights and requestors' legitimate needs for medical information.

When do you need this document?

You'll need this form whenever medical records or health information must be formally requested from healthcare providers. Common situations include transferring care between medical professionals, obtaining records for legal proceedings, supporting insurance claims, or accessing deceased patients' medical information. The form is essential when you're not the patient but have legitimate grounds to access their medical data, such as being an authorized representative, legal guardian, or executor of an estate. Healthcare providers also use this form when requesting medical history from other institutions to ensure continuity of care.

Key legal considerations

The form must clearly establish the legal basis for processing sensitive health data under UK GDPR, whether through explicit patient consent, legitimate interests, or legal obligations. You must specify exactly what information you're requesting and for what purpose, as healthcare providers can only disclose the minimum necessary data. Patient consent mechanisms are crucial—the form must include clear explanations of how the data will be used and patients' rights to withdraw consent. For deceased patients, different rules apply under the Access to Health Records Act 1990, requiring proof of entitlement from executors or those with legitimate interests. Mental capacity considerations under the Mental Capacity Act 2005 may also apply when patients cannot provide informed consent.

Legal requirements in England and Wales

Under England and Wales law, all medical information requests must comply with the Data Protection Act 2018 and UK GDPR, which require explicit consent for processing health data except in specific circumstances. Healthcare providers must verify the identity of requestors and their authorization to access the information. The Access to Medical Reports Act 1988 gives patients additional rights when reports are prepared for employment or insurance purposes, including the right to see and amend reports before they're disclosed. Requests must specify the lawful basis for processing, retention periods, and patients' rights including access, rectification, and erasure. Healthcare providers typically have one month to respond to valid requests, though this can be extended for complex cases. The form must include data protection notices explaining how personal information will be processed and patients' rights under current legislation.