Rights regarding NHS lost test results

This is a situation that unfortunately does arise and it engages several overlapping areas of law and regulation. Here is a clear breakdown of your position.

Your legal rights:

1. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the NHS is a data controller responsible for keeping your personal health data safe, accurate, and available. Losing test results is potentially a breach of the security principle under Article 5(1)(f) UK GDPR and the storage limitation and integrity obligations. You have the right to be informed if a personal data breach has occurred that poses a risk to your rights and freedoms. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

2. Under the NHS Constitution for England, you have the right to access your health records and the right to have any errors in your records corrected. You also have the right to expect the NHS to keep your data confidential and secure.

3. Under the common law duty of care, a healthcare provider owes you a duty to manage your care competently. If lost results led to a delay in diagnosis or treatment, and that delay caused you harm, you may have a clinical negligence claim. The key elements would be breach of duty, causation, and quantifiable harm.

4. Under the Access to Health Records Act 1990, which covers records of deceased persons, and the broader data subject access right under Article 15 UK GDPR, you are entitled to request copies of your records to understand what has happened and what was or was not retained.

Practical steps you should consider:

1. Ask the hospital or GP practice in writing to explain what has happened to your test results, when they were lost, and what steps are being taken to locate or reconstruct them. Ask whether a Datix incident report or equivalent has been filed internally.

2. Request that the test be repeated promptly at no cost to you and with clinical priority given the delay. The NHS should do this as a matter of course.

3. Make a formal complaint through the NHS complaints procedure. In England this is governed by the Local Authority Social Services and National Health Service Complaints (England) Regulations 2009. You must normally complain within 12 months of the incident or within 12 months of becoming aware of it. The organisation has a duty to investigate and respond.

4. If you are not satisfied with the response, you can escalate to the Parliamentary and Health Service Ombudsman (PHSO), which can investigate NHS complaints in England.

5. If you believe a data protection breach has occurred, you can report it to the ICO. The ICO can investigate and, in serious cases, take enforcement action against the trust or practice.

6. If the lost results caused you actual harm, for example a delayed cancer diagnosis or progression of a condition that could have been treated earlier, you should take advice on a clinical negligence claim. These claims are subject to a three-year limitation period from the date of knowledge under the Limitation Act 1980 and must comply with the Pre-Action Protocol for the Resolution of Clinical Disputes.

7. Keep a written record of everything: dates, names of staff you speak to, what you are told, and any symptoms or deterioration in the meantime.

Important considerations:

If the lost results have not caused you any actual physical or psychological harm, your options are primarily the complaints route and the data protection route. Compensation in negligence requires proof of injury or loss caused by the breach.

However, under UK GDPR Article 82, you may be entitled to compensation for material or non-material damage caused by a data protection breach, even without a clinical negligence claim. Non-material damage can include distress, though the courts have generally expected the distress to be more than trivial.

If there is any clinical urgency, for example you were awaiting results for a suspected serious condition, make this clear immediately to your GP or the relevant hospital department and press for the test to be repeated without delay. Your health comes first, and the complaints and legal routes can follow.