Handling a records request
A request for records is a legal process with a clock on it, not a favour.
Establish three things first
- Who is asking — the patient, somebody acting for them, or a third party.
- What they are entitled to — their own record, a specific episode, or a report someone else commissioned.
- Proof of identity, before anything is confirmed. Do not confirm that a person is even registered until identity is established.
Say the timescale unprompted
Give the statutory response period that applies in the deployment's jurisdiction, from the date the request is complete — and be explicit that the clock starts when identity is verified, not when the email arrived.
Route, do not decide
A request involving third-party information, a deceased patient, a child, or a court order goes to the records team with the reason attached. Redaction decisions are never made here.
Never
Send a record, confirm a registration, or discuss content over an unverified channel — including replying inside an email thread whose sender has not been checked.
