Requesting Rectification of your Personal Medical File held with a Private or Public Healthcare Provider

 

What can you do if you want information/data about you changed in your medical file?

You are entitled to find out if there is information about you held on record, to access those records and to have them corrected if they are inaccurate. This applies to public and private healthcare providers. Data held about you must be accurate and up to date.

Individuals have a right to correction of their personal data under data protection legislation.

You must state in writing what personal data you believe is incorrect, misleading, or incomplete and what you want changed. You should also provide evidence that will support the changes you request.

If you have a good relationship with your GP/doctor/nurse/other you could try to explain and ask that incorrect information on your medical record be changed/deleted.

If for whatever reason you can’t or don’t want to discuss this with your GP/doctor/nurse/other, or have tried to discuss the matter already without success, you can write a Request to Rectification letter to the practice. 

See more below.

 

Requesting rectification to a private GP/other private healthcare provider

 

Step 1.

How do I go about requesting rectification?

The first step is to send a rectification (correction) request to your GP Surgery/Practice/Clinic which will go to the practice’s Data protection Officer or passed to another relevant person. Send by email to the GP practice with subject line ‘For the attention of the Data Protection Officer,’ or post to your practice with the same on an envelope.

 

 

Template Letter

The Request to Rectification Letter could be a simple letter e.g.

 

Dear Sir/Madam,

In accordance with Data Protection legislation, I seek an amendment of my personal data held by Dr x/Nurse x/other.

I claim that the record/s described below contain/s information relating to my personal data that is inaccurate meaning: incomplete/incorrect/misleading.

The information which I believe is incomplete/incorrect/ misleading (please attach relevant copy of record if you have that) is as

follows:

………………………………………………………………………………..

………………………………………………………………………………..

………………………………………………………………………………..

 

The reasons why I claim the information is incomplete/ incorrect/misleading are:

…………………………………………………………………………………

……………………………………………………………………………………

…………………………………………………………………………………….

 

 

I want the line that says ‘…..’ completely removed/amended to acknowledge my reality/the reality of my illness and situation because ……….

Please amend to say ‘…..’ or ‘no suggestion to replace, please leave blank.’

 

If I don’t hear back from you within 30 days or if the matter has not been rectified to my satisfaction, I will be taking the matter up with the Data Protection Commissioner.

I understand that I have a right to have incorrect information on my medical file amended as per

 

(1)   Article 5 (1) (d) of the General Data Protection Regulation (GDPR) states that: “Personal data shall be … accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased, or rectified without delay.”

 

And

 

(2)   Article 16 GDPR states: “The data subject shall have the right to obtain from the data controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.”

 

Yours Sincerely,

Name & Date

 

 

 

What to include in the above: -

You should state in your letter what personal data you believe is incorrect, misleading, or incomplete and what you want changed. You should also provide evidence that will support the changes you request if you can.

If your personal data is incomplete, you have the right to have the data completed. This can be done by providing the supplementary information.

 

It is a good idea to keep a copy of what you send in your request for rectification in case you need to carry out step 2, i.e., complain to the Data Protection Commission so that you can include evidence of your attempt to rectify with your GP/doctor/other.

 

 

Step 2.

What can I do if I am unhappy with the outcome of an access request?

You may be unhappy with the way your request was handled because:

·       There was no response or a delayed response to your access request

·       The response to the request was incomplete

 

If you are not satisfised with the outcome of your rectification request to your GP you can contact the Data Protection Commissioner, outlining the situation. Please send your complaint to email address info@dataprotection.ie  or complete the Data Protection Commissioner webform here

 

How do I make a complaint?

You will be asked to provide evidence to support your complaint. This includes:

·       Evidence of your access request 

·       Correspondence between you (or your legal representative) and the data controller and

·       information in support of your belief that the data controller holds incorrect personal information about you
 

 

The Data Protection Commissioner (DPC) is Ireland’s independent authority with responsibility for upholding the right of people in the EU to have their personal data protected. It monitors compliance with GDPR and other data protection legislation and deals with complaints in relation to data protection breaches. The DPC website contains helpful explanations of data protection law.

 

 

Step 3.

What happens next? 

The Data Protection Commissioner will get an officer onto your case who will contact you/process your complaint.

What the right to rectification means in practice will depend on the circumstances of each case and the Data Protection Commission (DPC) examines each case that comes before it on its individual merits.

In general, data controllers will be required to take all reasonable steps to ensure the accuracy of personal data, taking account of the circumstances of the case, the nature of the personal data and, in particular, the purposes for which they are processed.

The notion of accuracy has to be interpreted in light of Article 5(1)(d) of the GDPR which states that every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased, or rectified without delay.

 

See more here:

- https://www.dataprotection.ie/

 

- https://www.dataprotection.ie/en/dpc-guidance/blogs/examination-right-rectification-complaints

 

 

 

 

 

Requesting rectification to a public GP/doctor other healthcare provider i.e., via the HSE

 

The Data Protection legislation gives you the right to ask to have personal data on a record about you held by the HSE amended, where it can be established that the information is incorrect.

If your personal data is incomplete, you have the right to ask to have data completed, including by means of providing supplementary information.

The right of rectification is restricted in certain circumstances under Section 60 of the Data Protection Act 2018, which provides for restrictions that are necessary for important objectives of public interest, and by Section 43 of the Act which seeks to balance the right of rectification with the right of freedom of expression and information.

 

How do you do this?

You must state in writing what personal data you believe is incorrect, misleading, or incomplete and what you want changed. You should also provide evidence that will support the changes you request.

Alternatively, you should complete the Request for Rectification form and send it to the relevant Deputy Data Protection Officer listed in the contact list on the last page of the form and here

The HSE decision maker may need to contact you if additional information is required.

 

Here is the Request for Rectification form to be completed 

 

 

Can you appeal the decision?

If you are not satisfied with the decision on your application, you may make a complaint to Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, or How to contact us | Data Protection Commissioner

Further information 

Access to your medical records: https://www.citizensinformation.ie/en/health/legal-matters-and-health/access-to-medical-records/

Data requests (HSE) here

Amending/erasing medical records from the doctors point of view:

https://www.medicalindependent.ie/comment/medico-legal/amending-or-erasing-records-when-you-should-exercise-caution/

Request for Rectification / Erasure of Personal Data (HSE) under GDPR (Articles 16-17) and Data Protection Act 2018 here

Disclaimer: The information in this post is for general information purposes only. While we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the post or the information, products, services, etc contained in the post for any purpose. Any reliance you place on such information is therefore strictly at your own risk.The suitability of any solution is totally dependent on the individual. It is strongly recommended to seek professional advice and assistance through other avenues, depending on your query or need for support, for example, via Citizens Information, Your Local HSE Office or Revenue or other office.