GDPR: How to respond to clinicians who ask for subject access requests for results to be made in writing
<p>During a hospital stay, when requesting a copy of blood test results from doctors or nurses, unfortunately patients are often met with the response "Your request must be made in writing and must be made to the hospital admin department".</p>

<p>This is in contrast to the guidance from the information comissioner's office on GDPR which states that subject access requests can be made verbally [1] and can be made to any employee of the organisation [2].</p>

<p>How should a patient respond in this scenario?</p>

<p><strong>Guidance from the information commissioners office on GDPR:</strong>
<a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/711097/guide-to-the-general-data-protection-regulation-gdpr-1-0.pdf" rel="nofollow noreferrer">https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/711097/guide-to-the-general-data-protection-regulation-gdpr-1-0.pdf</a> </p>

<p>1:
Page 61: "Individuals can make a subject access request verbally or in writing".</p>

<p>Page 62: "The GDPR does not specify how to make a valid request. Therefore, an individual can make a subject
access request to you verbally or in writing."</p>

<p>Page 63: "... even if you have a form, you should note that a subject access request is valid if it is
submitted by any means, so you will still need to comply with any requests you receive in a letter, a
standard email or verbally."</p>

<p>2: 
Page 62: "... It [The request] can also be made to any part of your organisation
(including by social media) and does not have to be to a specific person or contact point."</p>

<blockquote>
  <p>This is in contrast to the GDPR which states that subject access requests can be made verbally and can be made to any employee of the organisation.</p>
</blockquote>

<p>No, it doesn't. Article 12(1) says:</p>

<blockquote>
  <p>The controller shall take <strong>appropriate</strong> measures to provide any information ...</p>
</blockquote>

<p>Limiting requests to specific forms or particular departments is quite appropriate.</p>

gdpr