SAR - Medical records

[Simcfc73]

Apologies for asking this but I am a bit stuck.

 

Our school nurse has a request form a parent requesting medical information about her 13 year old son.

 

They are sleep and behaviour records which the nurse says she wouldnt feel comfortable giving out (I havent seen them but I can't believe they would be unprofessional)

 

We are a private school by the way

 

From the ICO

 

There is no equivalent legal right to access your child’s educational record. It will be up to the school to decide whether to grant such access, and it is likely to depend on the contractual relationship between the parent and the school.

 

As a parent, when can I request other information about my child?

You will be able to access all the information about your child if your child is unable to act on their own behalf or gives their permission. As a general guide, a child of 12 or older is expected to be mature enough to make this kind of request.

 

This document goes further but I won't paste that stuff.

 

https://ico.org.uk/media/for-organisations/documents/2259722/subject-access-code-of-practice.pdf

 

So as the parent has requested the information we cannot give it as the student is over 12 and mature enough that he need to consent himself? As we a private school and fee paying wouldnt the parent be allowed to request the information as they paid for it?

[GREED]

Apologies for asking this but I am a bit stuck.

 

Our school nurse has a request form a parent requesting medical information about her 13 year old son.

 

They are sleep and behaviour records which the nurse says she wouldnt feel comfortable giving out (I havent seen them but I can't believe they would be unprofessional)

 

We are a private school by the way

 

From the ICO

 

There is no equivalent legal right to access your child’s educational record. It will be up to the school to decide whether to grant such access, and it is likely to depend on the contractual relationship between the parent and the school.

 

As a parent, when can I request other information about my child?

You will be able to access all the information about your child if your child is unable to act on their own behalf or gives their permission. As a general guide, a child of 12 or older is expected to be mature enough to make this kind of request.

 

This document goes further but I won't paste that stuff.

 

https://ico.org.uk/media/for-organisations/documents/2259722/subject-access-code-of-practice.pdf

 

So as the parent has requested the information we cannot give it as the student is over 12 and mature enough that he need to consent himself? As we a private school and fee paying wouldnt the parent be allowed to request the information as they paid for it?

I don't know if the medical records have different stature or not so won't comment on that.

 

However, GDPR is law and is unrelated to you being a private or state school, and unrelated to whether they pay you or not, data law overrides all of this. That bit I do know!

[enjay]

To clarify, who holds the information (school or NHS) and who obtained the information (school or NHS)?

[Simcfc73]

Its a school report which we created.

[GREED]

Its a school report which we created.

 

I think the question is how did you obtain the data - was it given to you by the parent/student, or even created by yourselves (school nurses etc) - or is it NHS data that you simply access?

[enjay]

I think the question is how did you obtain the data - was it given to you by the parent/student, or even created by yourselves (school nurses etc) - or is it NHS data that you simply access?

 

That's correct. I'm trying to get to who the data controller is - school or NHS? If this is school-collected data, you should apply the same policy as for any other SAR, which given the age of the child in question, is probably to get consent from the child. If the information was given to an NHS nurse, the SAR should probably be sent to the NHS who will then apply whatever policy they have about access to medical records, exactly as if a parent asked the family GP for their child's records.

[Simcfc73]

We would be the data controller then as we created the reports. The data in question has reference to other pupils which we've flagged up as being sensitive so we'll have to look into this further.

[Ditto]

These live situations are great case studies for DPA/GDPR topics and how they should be handled. Do you have a Data Protection Officer, even if outsourced, as they should be able to assist you.

[GrumbleDook]

The information has probably not been gathered by consent so the age of digital consent is not relevant here ... as a private school I would judge that it is contractual obligation (under article 6) and purposes of preventive or occupational medicine (under article 9 - special category data) ... but get your DPO to look at the DPIA on this.

 

As such, the parent is the legal carer of the child, and the contract is with them (including as the legal carer of the child) and has rights to medical information ... unless an exemption is applied ... and they have to be justifiable. "Not being comfortable" ... that is going to be a hard case to argue. I would suggest that the nurse consults with her professional body on this as they will have plenty of experts looking at the exemptions.

[Simcfc73]

The information has probably not been gathered by consent so the age of digital consent is not relevant here ... as a private school I would judge that it is contractual obligation (under article 6) and purposes of preventive or occupational medicine (under article 9 - special category data) ... but get your DPO to look at the DPIA on this.

 

As such, the parent is the legal carer of the child, and the contract is with them (including as the legal carer of the child) and has rights to medical information ... unless an exemption is applied ... and they have to be justifiable. "Not being comfortable" ... that is going to be a hard case to argue. I would suggest that the nurse consults with her professional body on this as they will have plenty of experts looking at the exemptions.

 

Thanks, I'm swimming under the GPDR tide at the moment.