How to respond to a request to amend medical records

Dr James Thorpe and Dr Jayne Molodynski, medico-legal consultants at Medical Protection, provide advice and guidance on whether a patient can request amendments to their medical records

Clinicians and practice staff regularly contact Medical Protection for advice on handling approaches from patients about information contained in their medical records. Issues range from disputes about the accuracy of a clinical diagnosis, to entries made in the wrong patient’s notes. The evolution of data protection legislation in Ireland has resulted in patients having high expectations of the degree of control they can exert over data held about them. This can lead to a conflict if a practice cannot agree to a patient’s request to have information removed from their records. In this article we will look at the relevant guidance and a common scenario faced
by practices.

What does the Medical Council say?

The Medical Council has published useful guidance on medical records in its Guide to Professional Conduct and Ethics for Registered Medical Practitioners (Amended), 8th Edition 2019.

In paragraph 33.2 they highlight that records must be accurate, stating:
“You must keep accurate and up-to-date patient records either on paper or in electronic form. Records must be legible and clear and include the author, date and, where appropriate, the time of the entry, using the 24-hour clock.”

They also highlight that you must comply with data protection and other legislation relating to storage, disposal and access to records at paragraph 33.4.

Understanding GDPR – what are the key principles?

The key principles are set out in Article 5 of the GDPR (pages 35-36) and can be summarised as follows:

1. Data should be processed lawfully,
   fairly and in a transparent manner.
2. Data should be collected for specified, explicit and legitimate purposes and be processed in a manner compatible with those purposes.
3. Data should be accurate, relevant and limited to what is necessary for purpose.
4. Data should be kept up-to-date and inaccurate data should be rectified without delay.
5. Data should be stored (in a form that identifies the data subject) for no longer than is necessary for the purpose for which it is required (exemptions in relation to the public interest and research may apply).
6. Data should be securely stored and protected against unlawful processing and accidental loss/destruction or damage.

Under the GDPR legislation, patients have a right to ask for factual inaccuracies in records to be rectified or erased. This, however, does not give them the right to ask for an opinion a GP has made as a professional to be changed. The Irish Data Protection Commission highlighted in a 2019 article that for the right to rectification to apply, the personal data must actually be ‘incomplete’ or ‘inaccurate’. This would not usually be the case with respect to a doctor’s genuinely held opinion.

How do we deal with requests to have personal data rectified?

Individuals are entitled to have personal data rectified if it is inaccurate or incomplete. If the data controller has disclosed the personal data in question to third parties, you must inform them of the rectification where possible. You must also inform the individuals about the third parties to whom the data has been disclosed, where appropriate. However, this doesn’t extend to where the data recorded accurately represents a medical opinion. It is often impossible to conclude with certainty, perhaps until time has passed or tests have been done, whether a patient is suffering from a particular condition. An initial diagnosis (or informed opinion) may prove to be incorrect after more extensive examination or further tests.

Individuals may want the initial diagnosis to be deleted on the grounds that it was, or has proved to be, inaccurate. However, if a patient’s records accurately reflect the doctor’s diagnosis at the time, the records are not inaccurate, because they accurately reflect a particular doctor’s opinion at a particular time. Moreover, the record of a doctor’s initial diagnosis may help those treating the patient later.

The ICGP has published a useful guidance document, Processing of Patient Personal Data: Guidelines for General Practitioners. They recommend that if a patient disagrees with their doctor’s reasonably held opinion, they have the right for a note to be inserted in the record that they disagree with the diagnosis made at that time, but that the contemporaneous records and clinical diagnosis does not have to be deleted or erased.

Further information on the right to rectification and erasure of personal data can be found on the website of the Data Protection Commission.

How long do I have to comply with a request for rectification?

You must respond without undue delay and within one month. This can be extended by two months where the request for rectification is complex.
Where you are not taking action in response to a request for rectification, you must explain why to the individual, informing them of their right to complain to the supervisory authority and to a judicial remedy.

References available on request