Your medical records and data across borders

Why moving medical records needs care

Health records are among the most sensitive information held about you, and the law treats them that way. The Information Commissioner’s Office, the UK regulator for data protection, explains that information about health is special category data, which may be used only when extra conditions are met [1].

When personal information leaves the UK, people can lose the protection of UK data protection law, which is why the UK GDPR has its own rules for sending it to organisations abroad [2].

How UK law governs a transfer abroad

A UK clinic that sends your records to a separate organisation outside the UK, or makes them accessible to one, is making what the ICO calls a restricted transfer [2]. Every restricted transfer must be covered by UK adequacy regulations for the destination, an appropriate safeguard, or an exception [2].

Adequacy regulations let information flow without an extra safeguard. Without them, the sender can use a safeguard such as the International Data Transfer Agreement, and must then assess the risk to make sure the protection of your information is not materially lower after the transfer [2]. When no adequacy regulations or safeguards cover a transfer and no exception fits, the clinic must not make it [2].

The rules apply to every restricted transfer, even small and infrequent ones [2]. A careful clinic therefore asks where a letter is going, and to whom, before it sends anything.

Your rights over your own records

You can ask any UK organisation for copies of the information it holds about you, and organisations usually have one month to respond [3]. Where an organisation relies on your consent or a contract to use your data, you can also ask for it in a commonly used, machine-readable format [4].

Holding your own copies gives you control. You can carry them to a doctor abroad yourself and choose who sees them, and nothing then depends on two organisations finding each other.

Sharing records with a doctor abroad

Share records through a secure route, with a named person at the other end. NICE asks that when care passes from one provider to another, information moves in the most effective and secure way, such as secure electronic communication [5]. After care abroad, the CDC advises asking for records in English and giving them to every doctor who sees you afterwards [6].

• Agree who will receive each letter, by name, before anything is sent
• Use a secure link or an encrypted portal in place of ordinary email
• Send scan images in their original format along with the written report
• Ask for copies in English, or a translation, where the receiving doctor reads another language
• Keep your own copy of everything you send
• Tell each clinic in writing if you would like sharing with someone to stop

Consent and who sees your record

Doctors share information with others involved in your care so that care continues safely, and you can say who should and should not receive it. Principles agreed by UK healthcare regulators ask professionals to share relevant information with colleagues and other providers involved in your care unless you object [7].

Someone else, such as a family member or an assistant, can ask for copies of your records for you if they can prove they have your permission, for example with your written authority or a power of attorney [3]. An organisation does not have to release anything if it is not satisfied that permission is real [3].

When this matters most

These rules matter most when you live in one country and are treated in another, when you seek a second opinion from abroad, when a family has members in several countries, or when an employer or family office arranges care across borders.

Paperwork should never hold up urgent care. In an emergency abroad, call the local emergency number, or 999 in the UK, and show the treating team whatever records you carry [8].

How The Wellness can help

Every result and letter goes into one record you open from any country, and a doctor anywhere can read it [8]. A member’s records stay theirs, and they can read and download them after membership ends [9]. A GP appointment is the time to tell the doctor which colleagues abroad should receive your letters.

Our clinics are on Baker Street in Marylebone and Eccleston Street in Belgravia. Every doctor is GMC registered, regulated services are delivered through registered partner clinics and accredited laboratories, and appointments can be arranged with partners in 12 more cities.