Subject Access Request (SAR)

Managed Service for the NHS

OSS provides a managed service to deal with full or partial requests for patient records,
otherwise known as Subject Access Requests (SAR). This service will deal with every
element of a SAR from end to end, relieving the pressure this brings to GP Practices. The
service is fully GDPR compliant and has been fully vetted by Information Governance
and Security Managers on behalf of all health boards in Scotland as well as the
Information Commissioners Office (ICO).

Background

OSS has a long and successful relationship with the NHS including GP Practices and Medical Centres. We were approached by several clients to enquire if we could be utilised for SAR requests. After taking a step back and building step by step procedures that would allow us to fulfil the same obligations of the practice we ran a pilot. The Pilot was extremely successful and was rolled out one area at a time. We have worked hand in hand with the NHS and the LMC for each area.

Process

• Records collected on a weekly bases
• Records prepared and copied
• Records redacted for third party information
• Records posted recorded delivery to requesting company
• Paper Records returned to the practice on the next collection
• Free Back scanned copy of paper notes
• OSS deals with all queries from requesting company

Benefits

• Free up valuable staff time which can be better utilised for patient care
• Save Money – Average cost per request for a practice to process a SAR is £80.00 based on 5 month pilot with detailed reporting as well as NHS own findings.
• Full back scanned copy of paper record made available for upload to GP System
• Save direct costs on postage and stationary
• SAR processed in less than 5 days
• Increase staff moral
• No printing of electronically head patient records required

Other Info

• Service vetted by NHS information governance and security team on behalf of NHS Scotland as well as ICO.
• All LMC’s and MDDUS have been made aware of this service with no issues or concerns raised
• Data processing agreement in place between practice and OSS to cover GDPR Legislation
• No contracts in place for the service – you can try the service and stop at any time
• OSS has a proven track record with over 12 Years’ experience servicing the NHS
• OSS has worked closely with many GP Practices for large scanning projects
• Collection and delivery by OSS staff
• NHS sponsored NHS.net email account for secure file transfer
• All staff are Disclosure Scotland vetted
• All staff sign a non-disclosure agreement
• All staff are GDPR trained