Subject Access & GDPR Records Officer – Onsite

NHS Professionals

Aylesbury

On-site

GBP 27,000 - 31,000

Full time

38 hours ago

Be an early applicant

Application generator

Get a reply from this employer — a resume and cover letter tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

NHS Professionals is seeking a dedicated administrator to manage Subject Access Requests at Stoke Mandeville Hospital. This role requires careful handling of patient information under GDPR and related acts, with emphasis on timely responses within statutory deadlines.

You will verify IDs, redact sensitive data, log progress in Trust systems, and coordinate with external storage/providers as needed. The position is onsite, 37.5 hours per week, Band 3, with starts ASAP for a duration of six months.

Responsibilities

To process Subject Access Requests (SARs), medico-legal requests and other requests for patient information in accordance with the GDPR, Data Protection Act 2018 (DPA18) and the Access to Health Records Act 1990, ensuring all requests are completed within statutory timeframes.
To exercise independent judgement, following data protection guidance, in determining what information can be released, obtaining appropriate consent and disclosure sign-off, and escalating complex, sensitive or high-risk cases to the Access to Health Records Officer where required.
To verify the identification and consent of requestors prior to disclosure of personal and sensitive information, maintaining accurate and auditable records of decisions made.
To utilise Trust systems, including the electronic patient record and case management systems, to log, track and monitor the progress of all requests, ensuring records are accurate, complete and retrievable.
To identify, locate and retrieve records, both electronic and paper, across Trust sites, including casualty cards, x-rays and records held by other departments, co-ordinating with any external storage or retrieval provider as required.
To review and prepare collated information for disclosure, applying redactions as directed and checking for third-party or other sensitive information prior to release.
To act as a point of escalation for complex enquiries from solicitors, police, coroners, external agencies, patients and relatives, using tact, discretion and sensitivity, including when dealing with distressed or bereaved individuals.
To advise Trust staff at all levels on the requirements of the GDPR, DPA18 and the Access to Health Records Act 1990 in relation to their duties and responsibilities.
To monitor progress against statutory deadlines, proactively flagging cases at risk of breach to the Access to Health Records Officer / Deputy Medical Records Manager, and reporting any data security incidents or breaches of confidentiality in line with Trust policy.
To propose and help implement improvements to departmental working procedures and practices.
To undertake regular audits and quality checks of own and team members' work to ensure accuracy and compliance, feeding back findings to the Team Leader.
To produce regular activity and performance reports as requested by the Access to Health Records Officer.
To respond effective and professionally to telephone, written and in-person enquiries, ensuring patient confidentiality is maintained at all times, escalating to the Team Leader where necessary.
To travel to other Trust sites as required to retrieve records or attend meetings and training.
To undertake any other duties commensurate with the band, as reasonably directed by the Access to Health Records Officer or Deputy Medical Records Manager.