In Specific, Please Confirm What Authorisation the Solicitor'soffice Within the HMRC Would

Dear Mr Maxwell
Freedom of Information Act 2000
Thank you for your request for information submitted on 23rd January 2009. This was worded as follows:
Please provide a copy of HMRC internal policy documents governing how HMRC staff medical data is handled, with specific attention tomatters of disclosure, access control and security. If this requestexceeds the standard FOI limits of cost or time, please supply alist of the relevant policy documents.

In specific, please confirm what authorisation the solicitor'soffice within the HMRC would require to access medical datapertaining to a HMRC staff member or previous staff member.
If a member of HMRC staff or their appointed representative is seeking disclosure of their own medical records, they can submit a Subject Access Request (SAR) to the department’s Data Protection Unit (DPU) in Newcastle. Requests of this type are processed under the terms of the Data Protection Act and are subject to the same 40 calendar day deadline as all other requests HMRC receives. This also applies to requests for information submitted by former staff members.
Once a SAR for medical information is received it is recorded on the central database used for all DPA requests. The application is then forwarded to the appropriate Human Resource (HR) team for the trace and retrieval of the information and a copy of the requested data is then returned to the DPU for issue to the member of staff. This is always sent to the home address unless otherwise specified.

When processing a SAR or handling employee medical records in general, only those staff with a legitimate business requirement to view these records will do so. Usually this will be those within the line management chain,anyone needing access to the information to enable reasonable adjustments to be made or staff employed within the departments Human Resource teams.
However there will be occasions when employees have sensitive medical information on their file whichis contained in a sealed envelope which can only be viewed by qualified medical practioners. CAPITA is the department’s occupational health adviser and whenever they are involved in the disclosure of information there is particular process that must be followed. I have attached a copy of this.
The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988. You are free to use it for your own purposes, including any non-commercial research you are doing and for the purposes of news reporting. Any other re-use, for example commercial publication, would require the permission of the copyright holder. Most documents supplied by HMRC will have been produced by government officials and will be Crown Copyright. You can find details on the arrangements for re-using Crown Copyright on HMSOnline (internet access required) at:

Information you receive which is not subject to Crown Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated. You must ensure that you gain their permission before reproducing any third party (non Crown Copyright) information.
If you are not happy with this reply you may request a review by writing to HMRC FOI Team, Room 4/52, 100 Parliament Street London SWIA 2BQ. You must request a review within 2 months of the date of this letter. It would assist our review if you set out which aspects of the reply concern you and why you are dissatisfied.
If you are not content with the outcome of your complaint, you may apply directly to the Information Commissioner for a decision. Generally, the Information Commissioner cannot make a decision unless you have exhausted the complaints procedure provided by HMRC. He can be contacted at: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Yours sincerely

Michael Armstrong

Freedom of Information Unit