Data Protection Act 1998
Capita Healthcare SAR Request
Subject Access Request (SAR) Process for cases involving requests for access to health records that are held in a sealed medical envelope
If an employee wishes to see the data in their sealed medical in confidence envelope Capita has to be involved. This is because the records are medical records and access to the information comes within the Access to Medical Records Act, so a Capita clinician will need to access the data on the departments behalf. Sealed medical in confidence data must never be opened by anyone other than Capita personnel.
The process for dealing with these SARs falls into three stages:
Stage 1 It is the Departments responsibility to get the SAR to Capita within 5 working days
Stage 2 It is Capita’s responsibility to complete this stage within 20 working days
Stage 3 It is the Data Protection Unit’s responsibility to complete this stage by the 40 day legislative deadline
Stage 1 - It is the Departments responsibility to get the SAR to Capita within 5 working days
These tasks are carried out by the Subject Access Request Manager (SARM) and the person responsible for the data subject’s personnel file:
When a correctly completed SAR is received which contains a request for access to the Capita or other health records or reports, the SARM must contact the officer responsible for the personnel file or delegated deputy (by email, fax or telephone when appropriate) to advise them of the request.
The person responsible for the personnel file must establish its whereabouts and whether it contains a sealed medical envelope. If it does they should pass the envelope to the SARM.
The SARM completes the form SAR-med. The sealed 'medical in confidence' envelope and the form should be sent to Capita (DPA Request Department) by 'timed delivery' post.
If the 'medical in confidence' envelope is already with Capita the form SAR-med should simply be emailed to Capita with a copy to DPU.
Stage 2 - It is Capita's responsibility to complete this stage within 20 working days
These tasks are carried out by Capita and the Data Protection Unit at Longbenton.
If the medical envelope has been posted, or the form faxed, the Data Protection Unit will email Capita so that they know it is on its way and can react quickly if it does not arrive. Capita will let the Data Protection Unit know when the SAR med form is received.
Capita will monitor the SAR progress. If it seems likely that the 40 day legislative deadline will not be met, they will immediately consult with the Data Protection Unit. If the processing of the SAR has not been completed by day 20 Capita will telephone the Data Protection Unit to give a progress report and discuss handling.
Capita issues a copy of the appropriate contents of the sealed envelope by 'timed delivery' for onward transmission to the employee via the Data Protection Unit and the original sealed envelope for return to the SARM. (These will be in sealed envelopes and will not be opened by the Data Protection Unit)
Capita emails the DPU to inform them that the envelope is on its way to them.
Stage 3 - It is the Data Protection Unit's responsibility to complete this stage by the 40 day legislative deadline
On receipt of the copy contents of the sealed envelope from Capita, the Data Protection Unit will post it on to the employee who has made the SAR. The Data Protection Unit will return the original sealed medical envelope to the SARM.