Medical Records Release Policy Template for England and Wales

A Medical Records Release Policy is a comprehensive document that establishes the legal framework and operational procedures for healthcare organizations to manage requests for patient medical records. Under England and Wales law, this policy ensures compliance with multiple regulatory requirements while protecting patient confidentiality and enabling lawful disclosure of sensitive health information.

When do you need this document?

You need a Medical Records Release Policy if you operate any healthcare facility, medical practice, or organization that maintains patient records in England and Wales. This includes NHS trusts, private hospitals, GP practices, dental surgeries, mental health services, and specialist clinics. The policy becomes essential when handling subject access requests under UK GDPR, responding to court orders, processing insurance claims requiring medical evidence, or managing requests from other healthcare providers for continuity of care. You also need this policy to address complex situations involving deceased patients, where the Access to Health Records Act 1990 applies, or patients lacking mental capacity under the Mental Capacity Act 2005.

Key legal considerations

Your policy must balance competing legal obligations: the duty to protect patient confidentiality against requirements for lawful disclosure. Under UK GDPR, patients have broad rights to access their personal data, including medical records, with limited exceptions for protecting others or preventing serious harm. You must establish clear procedures for verifying identity, determining lawful basis for processing, and applying appropriate exemptions. The policy should address third-party requests, requiring explicit consent or legal authority such as court orders or statutory powers. Special consideration is needed for sensitive categories of personal data, including mental health records, which require heightened protection. You must also establish retention periods, secure processing methods, and procedures for refusing inappropriate requests while providing clear reasons for refusal.

Legal requirements in England and Wales

Your Medical Records Release Policy must comply with UK GDPR and the Data Protection Act 2018, which govern all personal data processing including medical records. The Access to Health Records Act 1990 specifically regulates access to deceased patients' records, requiring different procedures and timeframes. Under the Mental Capacity Act 2005, you must establish protocols for handling requests involving patients who lack capacity, potentially requiring input from appointed representatives or the Court of Protection. The Health and Social Care Act 2012 mandates information governance standards for NHS organizations, while the NHS Confidentiality Code of Practice provides detailed guidance on handling patient information. Your policy must incorporate one-month response timeframes for subject access requests, proper fee structures where applicable, and mandatory reporting procedures for data breaches to the Information Commissioner's Office within 72 hours.