Handling requests for children’s medical records

Dr Rachel Birch, Medico-legal Consultant at Medical Protection Society (MPS), advises on handling requests for children’s medical records and the disclosure of such records

A father of two young patients aged 10 and 15 has asked for copies of his daughters’ medical records, stating that their mother won’t give him any information about their health and he is particularly concerned due to Covid-19. He also wants to be contacted whenever either child attends the practice. You do not know the father and he is not a patient at the practice, but the mother is registered at the practice.

The first thing to establish in a situation like this is whether this man is who he says he is and whether he has legal guardianship of the children. You should ask him to provide ID to confirm his name and documentation to prove that he has legal guardianship, such as a letter from his solicitor, court documentation, or a marriage certificate.

Legal guardianship

The rights of guardianship are only automatically conferred upon a patient’s mother. The father would only receive similar rights if he were married to the patient’s mother or if both parents sign a statutory declaration entitling joint guardianship. Failing this, the court may appoint a joint guardianship based upon what is in the best interests of the child.

Disclosure of records

Both the Freedom of Information Acts 1997 and 2003 and the GDPR and the Data Protection Act 2018 provide a patient (and for minors their guardians) with the legal right to be given a copy of their medical records. The Freedom of Information legislation only applies to the records held by a doctor in their capacity as an agent of the HSE (that is, for GMS patients holding a medical card). GDPR and the Data Protection Act apply to records held by the doctor in both a public and private capacity.

If the children are public (GMS) patients, requests for access to their records would usually be dealt with under Freedom of Information, unless stated otherwise. As such, the father should be advised to direct his request to the HSE’s Freedom of Information Office. Although the medical records are under the physical control of the GP, the HSE is actually the “public body” for deciding whether access to the records should be granted.

On receipt of the request, the HSE will ask the GP for the records and these must be provided to the HSE. The HSE will invite comments and this is an opportunity to set out any concerns about releasing the information. However, the decision to provide or refuse access to the children’s records lies with the HSE and not the GP.

If the children are private patients, it is essential that you consider the Medical Council’s ethical guidance,1 which clearly states that the welfare of the child is of paramount importance. The guidance outlines that the doctor’s primary duty is to act in the best interests of children. Children should be involved as much as possible in discussions about their healthcare, they should be given information suitable for their age and their views considered.

The Medical Council states that children and young people have a right to confidential medical treatment. However, this right is not absolute, since parents and guardians would retain a legal right to access their children’s medical records up until the age of 18.

The Irish College of General Practitioners has helpful practical advice2 and states: “An individual can only make an access request for their own personal data. Legal guardians can also make an access request on behalf of a child. However, once a child is capable of understanding their rights to privacy and data protection, the child should normally decide for themselves whether to request access to data and make the request in their own name.

This is not age dependent. It would also be important in such a case that the GP be satisfied that the person was genuinely acting on behalf of, and in the best interests of, the child whose data was being requested.

Revealing of medical information of a child who is capable of making decisions themselves will in most situations constitute a breach of the Data Protection Acts if undertaken without the consent of the child capable of making their own decisions.”

The Medical Council states that children and young people have a right to confidential medical treatment. However, this right is not absolute, since parents and guardians would retain a legal right to access their children’s medical records up until the age of 18

In the scenario above, it is highly likely that the 15-year-old patient will have capacity to decide whether her medical records should be disclosed to her father. You should contact her to discuss the request and seek consent.
If you think that the 10-year-old patient might have capacity, you should consider contacting her mother, in the first instance, to arrange a formal assessment. During the current Covid-19 pandemic, any assessment will be most safely undertaken over the telephone or by video consultation, in accordance with all applicable laws and regulations.

The child’s best interests

In establishing whether disclosure of records does not go against the child’s best interests, it would be helpful to review the records of the two children, in particular to ensure there are no previously documented concerns about their father. It would be useful also to talk to the doctor that knows the family best and seek their views. In this particular case, it is likely you will need to talk to the patients’ mother, to ensure there are no reasons why disclosing the records could be harmful to the children.

You may wish to explain to the father the processes you are obliged to follow regarding his request for access to his daughters’ records, as he may otherwise question why you have involved the mother in this request.
Before disclosing any records, third party information relating to individuals other than the patient, should be removed. In addition, any information that could cause serious harm to the mental or physical health of the patient or others should be removed.

It is impractical and unrealistic for the practice to contact the father every time his daughters attend the practice. You should explain this to the father and suggest that, as an alternative, he comes to an agreement with the mother and his daughters on how he is informed about their health.
If you need support with consent dilemmas such as this, contact Medical Protection, or your medical defence organisation.

References

https://www.medicalcouncil.ie/news-and-publications/reports/guide-to-professional-conduct-ethics-8th-edition.html

https://www.icgp.ie/go/in_the_practice/data_protection