Access to Information

Freedom of Information (FOI) and Right of Access (Subject Access Request)
Freedom of Information Act 2000

Our Duty to you
Before you request information from GP Healthcare Alliance.

Check whether the information you seek is already available. GP Healthcare Alliance publishes information on this website and you may well find the answer to your question is already here.

If you request information from GP Healthcare Alliance that is already published, we will simply refer you to the published source.

Who can request information?
Anyone, anywhere in the world, can make a FOI request to GP Healthcare Alliance.

What can I request?
You can seek any recorded information that you think GP Healthcare Alliance may hold.

If the information is environmental, we will respond according to the Environmental Information Regulations (EIR) 2004. You do not have to know whether the information you want is covered by the EIR or the FOI Act. When you make a request, we will decide which law applies.

If the information is your own personal data, then you should make a subject access request under the Data Protection Act (DPA) 1998, and not under the FOI Act. See below for how to make DPA requests.

How do I request information?
Your request must be in writing and can be either posted or emailed to GP Healthcare Alliance.

For postal requests, please send to the following address:

Senior Information Risk Owner
GP Healthcare Alliance Limited
Orbital House
20 Eastern Road
Romford, Essex
RM1 3PJ

Email requests should be sent to lucy@gphealthcarealliance.co.uk

What information must I include in my request?
The FOI Act requires certain information to be supplied before GP Healthcare Alliance can respond to your request:

• your real name – we do not have to respond to requests submitted under a pseudonym;
• your address (email addresses are acceptable);
• a description of the information you wish to obtain; and
• any preferences for the format in which you wish to receive the information e.g. electronic or hard copy. We will endeavour to meet your preferences but cannot guarantee that we will be able to.

What you do not need to do:

• explicitly mention the FOI Act, although it may help to do so;
• know whether the information is covered by the FOI Act or the EIR as we will decide this;
• say why you want the information; or
• Specify particular documents. You have a right to information, however it is recorded.

How should I word my request?
Comprehensive guidance on submitting effective requests for information is available from the Information Commissioner’s Office. However, to frame an effective request for the information you need:

Do:

• Do clearly identify the information you want. Be clear about date ranges or timescales. If it is not clear what you are requesting, we may need to seek further clarification;
• Do be as specific as possible. If your request is too general, it may be refused on the grounds that replying would exceed the cost limit laid down in the Fees Regulations, which is equivalent to one person working for three and a half days. If this happens, we will ask you to re-submit a narrower, more specific request which could be met within the cost limits and give you advice and assistance to do so;
• do ask questions such as “what” or “how much” as this is much more likely to result in a useful response;
• Do use straightforward, polite language.

Don’t:

• Don’t use open-ended questions such as “why”. We do not have to answer your question if this would mean creating new information or giving an opinion or judgment that is not already recorded;
• don’t base your request on assumptions or opinions;
• Don’t mix your request with complaints or comments.

What happens when my request is received?
GP Healthcare Alliance has a legal obligation to reply to your FOI request and must do so within 20 working days of receipt. We will do one of the following:

• supply you with the information you requested;
• inform you that we don’t hold the information and, if we are able, advise you who does;
• inform you that your request will exceed the cost limit specified in the Fees Regulations and invite you to submit a narrower request;
• inform you that we hold the information requested but refuse to provide all or part of it and explain why, citing one or more of the exemptions from the FOI Act;
• inform you that we are refusing your request on the basis it is repeated or vexatious; or
• Inform you that we need more time to consider the public interest test in relation to your request and let you know when to expect a further response. This should not be later than 40 working days after receipt of your request.

What can I do if I am unhappy with the reply I receive or the way my request was handled?
You can ask GP Healthcare Alliance for an internal review of your FOI request. When you write to us requesting an internal review, we will acknowledge your letter and tell you how long we think the review will take. We aim to complete internal reviews within 20 working days, although more cases that are complex may take longer. Where internal reviews go over 20 working days, we will keep you informed of progress.

If, after an internal review, you are still not satisfied you can then complain to the Information Commissioner (ICO). Details of how to do this are available at the ICO website.

Full details of how to ask GP Healthcare Alliance for an internal review will be included in our initial reply to your FOI request. Details of how to complain further to the Information Commissioner will be included in our response to your internal review request.

How do I request information held about me?
Please see below ‘Right of Access (Subject Access Request)’ where your rights under Data Protection Act 2018 are explained.

Right of Access (Subject Access Request)
The Data Protection Act 2018 provides individuals with a number of rights with regards to information held about them by organisations.

A full list of the rights available to a data subject is available here:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

One of the rights available to data subjects is the Right of Access. This allows you to view or obtain a copy of the personal information held about you. Specific information with regards to the right of access is available here:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

How to Gain Access
In order to gain access to records held regarding an individual, a request needs to be made to the relevant organisation. Request can be made either in writing, or verbally (where the receiver has the ability to write this down), however, in order to be deal with more efficiently and safely, we would prefer to receive a request in writing.

There is no requirement to fill in a particular form, but GP Healthcare Alliance will need certain information from a data subject (or their authorised representative) in order to deal with a request.

We will need the name of the individual whose records are required – we will also need copies of identification (a copy of photographic ID, i.e. driving license or passport, in addition to proof of address, such as a utility bill), so that we can assure ourselves that the person requesting records is the data subject.

If a request is being made on behalf of the data subject, we will still need copies of identification of the data subject (as per description above), but will also need signed consent from the data subject for the requester to act on their behalf, and copies of identification of the requester (as per description above).

Should the data subject lack capacity to provide consent then we will need to see a copy of Power of Attorney for Health and Wellbeing, which will allow those listed within the document to act on behalf of the data subject without their consent being provided at that time, in addition to copied of identification of both the data subject and the requester.

Please send your request to the following address: lucy@gphealthcarealliance.co.uk

Please detail as specifically as possible the information you require, whether this be all the information held, or only that covering a certain time period or within a certain department.

Time Period
Once we have received your request, and subsequently satisfied ourselves as to identification and consent (where necessary), we will respond within 30 days to provide the information you have requested.

Very occasionally it may not be possible to comply within this time frame; we will keep data subject, or their representatives, informed if this is the case.

Sending the Information
You can choose to have the information requested sent to you by recorded delivery, you can collect the records personally or you can choose to come in to view the records with an appropriate health professional.

We can also provide information electronically, usually via email; however there are security considerations when using this option and these will be discussed at the time should that option. Please choose which method you would like on the application form.

Requests made on behalf of Children and Young People
Those with parental responsibility have a statutory right to apply for access to their children’s health records although if the child is of an age capable of giving consent, he or she must consent to the access. We may require sight of a child’s birth certificate, or a certified copy, in order to establish parental responsibility.

Limited Access
Current legislation allows for access to be limited in certain cases. For example:

• If it is believed that the requester would be harmed by the access, the request may be refused in part or whole.
• Third person involvement – where a third party has divulged information in confidence and the information was given on the basis that it would not be shared, these parts of the record may not be released.
• The subject has requested that information is not disclosed to any third party.

Charges
Under the Data Protection Act 2018, there are no longer charges associated with the right of access to information held about data subjects.

Complaints
If you are dissatisfied with the way we have dealt with your subject access request, please contact us via the following julia.wallis@nhs.net