1. FUNCTION
1.1 In accordance with the Data Protection Act 1998, NHS Fife employees have the right to request a copy of information that is held on them as an employee of NHS Fife, subject to certain exemptions. This information includes both electronic and manual held records.
1.2 Such a request is defined under the Data Protection Action 1998 as a Subject Access Request.
1.3 This Procedure sets out the process to be followed to respond to a Staff Subject Access Request and ensure that the 40 day time limit is met.
1.4 This Procedure does not cover medical information held which is dealt with under a separate procedure.
2. LOCATION
2.1 This Procedure applies to all NHS Fife employees and across all areas of NHS Fife.
3. RESPONSIBILITY
3.1 The Human Resources Director is responsible for compliance with this procedure.
4. OPERATIONAL SYSTEM
4.1 A Flowchart is attached at Appendix 1 which outlines the procedure to be followed on receipt of a Staff Subject Access Request.
4.2 The member of staff should be as clear as possible about what information is being requested. To ensure all relevant data is supplied it can be helpful to provide any information that helps to locate what is being sought and the name(s) of those within NHS Fife who may hold this information.
4.3 Information requested usually involves that held on a member of staff’s personal file but may include other sources eg
- Information held by line management
- Information held by Payroll
- Emails on the system
4.4 In accordance with the Data Protection Act a fee of £10 is made for the copy of the information requested.
4.5 The 40 day time limit for response commences at the time that the request is received subject to it being clear in terms of what information is requested and the fee having been received.
4.6 If the member of staff simply wishes to view their Personal File they do not need to make a Subject Access Request or pay the fee and can arrange this by contacting the HR Directorate. Arrangements will be made for a mutually convenient time to view the file and the member of staff will be accompanied by a member of the HR team during the viewing. This is often sufficient to meet the needs of the member of staff who can still request copies of any paperwork held on file thereafter.
4.7 The HR member of staff must be satisfied as to the identity of the member of staff before providing them with the copy of information requested and if to be sent by mail will ensure the address matches that on NHS Fife’s records.
5. RISK MANAGEMENT
5.1 HR staff must comply with this procedure to ensure that the Subject Access Request is dealt with in accordance with the Data Protection Act 1998 and that the laid down timescale for response is met.
6. RELATED DOCUMENTS
6.1 NHS Fife Data Protection Policy (GP/D3)
6.2 NHS Fife Subject Access Request for Health Records Procedure (GP/D3-12)
7. REFERENCES
7.1 Data Protection Act 1998