Letter requesting consent to obtain medical report and medical report consent form

When you require a medical report from an employee's GP or consultant, you will first need their written consent in order to comply with the Access to Medical Reports Act 1988. You should write to the employee with an explanation of their rights under this Act and enclose a consent form for them to sign authorising the production and release of a medical report.

Signed consent

Before making an application to the employee's doctor or consultant for a medical report, you must first notify them and request their consent in writing to it being obtained. In doing this, you will need to provide an explanation of the employee's rights under the Access to Medical Reports Act 1988. This Act gives individuals the choice as to whether or not to consent to your seeking a medical report about them from their GP or consultant and it also gives them the right of access to any medical report prepared about them before it is supplied to you. The employee can also then withhold consent to its supply at that stage or ask the doctor to make corrections to it before it's supplied to you. As an alternative to requesting a medical report from the employee's own GP or consultant, a doctor you appoint may examine the employee and produce an independent medical report, but again only with the employee's consent (otherwise, it’s a breach of privacy, civil trespass and criminal assault). The Access to Medical Reports Act 1988 does not apply to doctors who are not, or have not been, responsible for the clinical care of the employee, but that doesn't mean you don't still need consent.

Future employment

You can't force an employee to be examined by a doctor or to give consent to a medical report being prepared. However, if your employee refuses consent in these circumstances, you will be entitled to base any subsequent decision on the future of the employee's employment on the relevant facts available, without the benefit of expert medical evidence.

Data protection

The employee’s consent here is required to ensure compliance with the Access to Medical Reports Act 1988. We’ve made clear that the consent request doesn’t constitute a request for the employee’s consent to your processing personal data concerning their health under the UK GDPR. Make sure that you have an additional lawful condition for processing such special category personal data (as well as having a lawful basis for processing), e.g. the processing is necessary for the purposes of carrying out your obligations or exercising your rights under employment law. It must also be in accordance with an appropriate policy document you have in place, which explains both your procedures for securing compliance with the UK GDPR data protection principles in connection with the processing of such special category personal data and your policies as regards the retention and erasure of such personal data. Make sure your processing is also in accordance with your privacy notice for staff. Although your privacy notice will set out how and why personal data will be processed throughout the employment lifecycle, it’s still advisable to provide privacy information on particular occasions, at the point the personal data is collected, so we’ve covered the purposes of the medical report and the lawful bases for processing it in our letter.