Your health information, data and privacy

Confidentiality

Your medical and healthcare information is confidential by default.

Anything you tell a doctor, nurse, or other health professional must be treated as confidential and cannot be shared outside your care team without a lawful reason or your consent.

UK GDPR

The UK GDPR, together with the Data Protection Act 2018, sets out the rules for how the NHS and private healthcare providers should handle your personal health data.

Key points:

• Lawful basis: Organisations must have a legal basis to process your personal data (including your health data) (e.g. consent, vital interests, public task, or legitimate interests).
• Special category data: Health data is considered special category personal data, requiring extra protection and usually necessitating an additional condition (e.g., provision of healthcare, public health, or research with safeguards).

If you are concerned that your personal data may have been processed unlawfully, you should request further information from the data controller.

You must be clearly informed (through privacy notices or conversations) about how your data is used and who may access it. If you are unsure, you have a right to ask your GP/healthcare provider what information has been processed about you and to whom it has been provided.

The Information Commissioner’s Office (ICO) also has some helpful guidance, and you can even make a formal complaint via its website: Make a complaint (ICO)

Accessing your own records

You can request a copy of your medical records (known as a Subject Access Request) from your GP or hospital.

The NHS must respond within one month.

Updating your name and gender marker

If you’ve changed your name and/or gender, and you want them updated on the NHS system:

• You do not need a Gender Recognition Certificate to request this change.
• For a change in gender marker on the system, a GP will want to discuss this with you and discuss the possible implications.
• The process typically involves notifying NHS Primary Care Support England (PCSE) to issue you a new NHS number and transferring records while redacting previous identity details.

IMPORTANT: This may impact cancer-screening invitations; you may need to make a note or request screenings manually.

• If a GP refuses to update your personal details, you should ask for reasons in writing and consider whether a formal complaint to your healthcare provider is necessary.