Subject Access Requests (SAR)

You have the right to ask an organisation if they're using or storing your personal information. You can also ask them for copies of your personal information.

This is called the right of access and is also commonly known as making a Subject Access Request (SAR).

You can make a SAR to NHS Cheshire and Merseyside Integrated Care Board (ICB) if they are using or storing your personal information.  This applies to:

• Members of the public whose personal information the ICB uses and stores information about them, such as All Age Continuing Care records
• Someone acting on a person’s behalf (for example, a solicitor or family member), provided they have appropriate authority (such as written permission from the person or power of attorney document)
• Members of ICB staff, including former members of staff.

The Information Commissioners Office (ICO) provides guidance for making a SAR, including what you should include in a SAR at: Getting copies of your information (SAR) | ICO. The ICB recommends that you read this before submitting a SAR so as to help the process to progress as smoothly and as timely as possible.

 

NHS Cheshire and Merseyside Integrated Care Board (ICB)

NHS Cheshire and Merseyside – the Integrated Care Board (ICB) for the region – is responsible for planning and commissioning NHS services for our population, which includes the care you receive at your GP practice, local pharmacy, NHS dentist, NHS opticians, or at hospital.

However, please note that to access your GP Records, Hospital Records, or Community Health Records, you will need to make a SAR to each of the organisations that you have attended.  This is because NHS Cheshire and Merseyside ICB do not hold, and cannot access, your health records, nor can they request them on your behalf from such organisations.

 

Key information to note

Timelines for responding to a SAR

The ICB normally has one month to reply to your request, however if your request is unclear, the ICB may stop the clock until you explain what information you are looking for.

If we require you to provide confirmation of ID, the clock only starts when you have provided this. We will ask for proof of ID if you’ve asked for sensitive information, such as health or finance information and if we do not recognise your details. For example, if you send a SAR from an email address that doesn’t match the one in our records or you use an online service that doesn’t require you to login.

If you’ve made a number of requests or your request is complex, the ICB may need extra time to consider it. This could result in an additional two month period for the ICB to respond to you. We would confirm this with you within one month of getting your request and explain why they are taking longer.

It is important to note that there needs to be an agreement between both the ICB and the individual submitting a SAR that the request can be progressed before the start of the time period in which the ICB needs to respond formally.

Complexity/provision of information

We will likely ask you for more information if:

1. we have lots of information about you and we need to narrow down the search.
2. we will struggle to respond to the SAR without it, e.g. it is not clear what you are asking for. 
3. You have made a similar SAR in the past and we need to confirm if you want the same information or new information.

When we ask for more information, we will stop dealing with your request until you reply (e.g. by email, letter or phone). Whilst you do not need to give us the requested information, if you do it may help us to find the information you want.

If you choose not to provide this additional information you must reply to us, even if it is just to say you aren’t giving us the information that we have asked for.

 

How do I make a SAR and what happens next?

To make a SAR to NHS Cheshire and Merseyside ICB, please email: cmicb.sars@miaa.nhs.uk*

As suggested by the ICO, we suggest you include the following information in a SAR:

• a subject line or header that says "subject access request";
• the date you’re making the request;
• your name (and any other names where relevant, e.g. your name before you were married);
• your job title(s)
• your work email address;
• employee number, or similar information that can help identify you;
• what personal information you want (be specific about the information you’re asking for, and where relevant say what information you don’t need);
• details, key words, or dates that will help the ICB find the information you want;
• the Departments / names of staff / job titles of who is likely to hold the data that your SAR concerns;
• the reason you want the information (you don't have to include this, but it will help the ICB find what you need); and
• how you would like to receive the information (e.g. electronically by email, or printed and sent by post) and if you have any accessibility requirements (e.g. large fonts).

Once you make a SAR to cmicb.sars@miaa.nhs.uk, you will receive an automatically generated email from the Information Governance Team.  Once your SAR has been triaged, you will receive an update with regards to the key next steps in completing your request.