Medical Records Consent Form Template UK

MEDICAL RECORDS CONSENT AND DISCLOSURE AUTHORIZATION

Pursuant to the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (UK GDPR)

DOCUMENT CONTROL

• Effective Date: [Effective Date]
• Document Version: 2.1 (UK Jurisdiction)
• Scope & Governing Law: England, Wales, Scotland, and Northern Ireland (United Kingdom)

---

1. OFFICIAL NOTICE & LEGAL DISCLAIMER

This document is an elite legal and operational template designed to secure explicit, informed consent for the processing, retrieval, and disclosure of special category medical data under UK GDPR and the Data Protection Act 2018. Use of this template requires proper contextual customization. This document does not constitute formal legal counsel; parties should verify compliance with their specific regulatory oversight bodies (e.g., General Medical Council, Information Commissioner's Office).

---

2. PARTIES & DEFINITIONS

• Data Subject (Patient): [Patient Full Legal Name], residing at [Patient Residential Address], with Date of Birth [DD/MM/YYYY] and NHS Number (if known) [NHS Number].
• Data Controller / Recipient: [Name of Organization / Healthcare Provider / Employer], having its registered office at [Registered Corporate Address], Company Registration Number [Registration Number], hereinafter referred to as the "Recipient".
• Medical Practitioner / Custodian: [Name of GP Practice, Hospital Trust, or Medical Facility holding records], located at [Facility Address].
• Processing Purpose: The lawful retrieval, review, and retention of medical records strictly for the purpose of [State precise purpose, e.g., occupational health assessment, personal injury litigation, insurance underwriting, or clinical continuity of care].

---

3. OPERATIVE CLAUSES & TERMS

1. Grant of Consent and Statutory Authority

1.1. The Data Subject hereby grants explicit, affirmative, and unambiguous consent pursuant to Article 6(1)(a) and Article 9(2)(a) of the UK GDPR, and Section 8 of the Data Protection Act 2018, empowering the Medical Practitioner / Custodian to disclose the Medical Records detailed herein to the Recipient.

1.2. This authorization extends to all past, current, and future medical records, clinical notes, specialist reports, laboratory results, imaging data, and psychiatric evaluations held by the Custodian, subject to any explicit limitations noted in Clause 2.

2. Scope of Disclosure and Data Minimization

2.1. The scope of records authorized for release under this instrument includes:

• Full Medical History: All general practitioner records, hospital admissions, and outpatient notes.
• Specific Medical History: Records restricted exclusively to the period between [Start Date] and [End Date] relating specifically to [Medical Condition/Injury].
• Occupational Health Records: Fit notes, health surveillance records, and ergonomic assessments.

2.2. Pursuant to the Access to Medical Reports Act 1988 (AMRA) (where applicable for employment or insurance purposes), the Data Subject confirms whether they wish to view the medical report prior to its disclosure to the Recipient:

• I wish to see the report before it is supplied to the Recipient.
• I do not wish to see the report before it is supplied to the Recipient.

3. Data Protection, Security, and Confidentiality

3.1. The Recipient covenants that all medical data obtained pursuant to this consent form shall be:

• Processed lawfully, fairly, and in a transparent manner in relation to the Data Subject.
• Collected only for the specified, explicit, and legitimate Processing Purpose stated herein and not further processed in a manner incompatible with that purpose.
• Adequate, relevant, and limited to what is necessary regarding the Processing Purpose (Data Minimization).
• Kept in a form which permits identification of the Data Subject for no longer than is necessary for the Processing Purpose, after which secure destruction protocols shall be executed.
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures (Encryption at rest and in transit).

4. Revocation of Consent

4.1. The Data Subject maintains the statutory right to withdraw consent at any time, pursuant to Article 7(3) of the UK GDPR.

4.2. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. To revoke this authorization, the Data Subject must serve written notice to the Recipient’s Data Protection Officer (DPO) at [DPO Email Address]. Upon receipt of revocation, the Recipient shall immediately cease processing the subject medical data and execute secure deletion, save where retention is mandated by statutory or regulatory obligations.

5. Expiration and Validity

5.1. Unless prematurely revoked in writing pursuant to Clause 4, this consent and disclosure authorization shall automatically expire exactly six (6) months from the date of execution set forth below.

---

4. SIGNATURES & ACKNOWLEDGMENT BLOCK

By executing this document below, the Data Subject certifies that they have read and understood the scope of this consent, have been informed of their rights under the UK GDPR and DPA 2018, and voluntarily authorize the disclosure of their special category medical data.

DATA SUBJECT (PATIENT)

• Signature: __________________________________________________
• Print Name: [Patient Full Legal Name]
• Date: [DD/MM/YYYY]

WITNESS (Required if executing under physical disability or special circumstances)

• Signature: __________________________________________________
• Print Name: [Witness Full Name]
• Address: [Witness Address]
• Date: [DD/MM/YYYY]

---

5. STEP-BY-STEP EXECUTION GUIDE

1. Customization & Verification: Ensure all bracketed fields ([...]) are accurately populated to reflect the precise legal entities, specific medical scope, and lawful processing purpose. Do not leave blank fields.
2. Subject Notification: Present this document to the Data Subject (Patient). Ensure they understand their rights under the UK GDPR, including the right to view reports under the Access to Medical Reports Act 1988 if applicable.
3. Execution: Have the Data Subject sign and date the Acknowledgment Block in the presence of an independent witness (recommended for evidentiary durability).
4. Transmission & Auditing: Transmit a certified copy of the executed form to the Medical Custodian alongside the records request. Store the master executed copy within the Recipient's secure compliance vault alongside an immutable audit trail logging the date of data retrieval and processing lifecycle.