A request lands with a deadline attached
An employee who went through a difficult absence case asks for a copy of everything your service holds about them. It may be part of a dispute with their employer, so the request is detailed and the stakes are high. Your administrator starts with the clinical system, then realises there are emails with HR about the case in a shared inbox, a GP letter scanned into a folder, audiometry results on a device laptop, and records from before the service changed systems.
Every item has to be found, checked, and reviewed by a clinician for anything that should not be released, such as third-party information. The deadline is running from the day the request arrived.
Why these requests take so long
The request itself is simple. The problem is that your service's information about one person is not in one place, and the review needs clinical judgement as well as admin work.
- Case notes live in the clinical system, but correspondence lives in email.
- Surveillance data sits in device software or a separate results store.
- Records from a previous system are in an archive nobody knows how to search.
- Reviews for third-party information and redaction are done on printed pages.
- The deadline is tracked in someone's calendar, if at all.
What must be released, withheld or redacted is a question for your data protection adviser and clinicians. The practical problem is gathering it all in time for them to make those decisions properly.
What slow SARs cost
Missing a deadline creates a complaint and a problem with the regulator. Rushing the review risks releasing something that should have been withheld, or missing a document that later turns up in a dispute. Each request pulls an administrator and a clinician away from casework for a long stretch.
| Source of information | Typical search today | What we build |
|---|---|---|
| Clinical system | Printed or exported by hand | Full record export for the person |
| Email with HR and the employee | Searched by name in several inboxes | Linked emails gathered by case reference |
| Scanned letters and reports | Folders searched by name | Documents already linked to the case |
| Surveillance results | Device laptop or separate store | Results linked to the employee record |
| Previous system archive | Often not searched | Indexed archive with a search |
How we build SAR handling
- A request log with the date received, identity check status and the deadline your data protection adviser confirms.
- A search that gathers everything linked to the person across the clinical system, linked emails, documents and results.
- Where a previous system's records exist, we index the archive so it can be searched in the same way.
- A review screen where a clinician or your data protection lead marks each item to release, withhold or redact, with a reason.
- Redaction done on screen and recorded, rather than with a marker pen on paper.
- A final pack generated for sending, and a log of exactly what was released and when.
The decisions stay with your adviser and clinicians. We make sure they have everything in front of them with time to decide.
After the next request
The deadline is on a screen, not in a calendar. The gathering takes a search instead of a week of hunting. Clinicians review on screen with reasons recorded. And if the release is ever challenged, the log shows exactly what was provided and why anything was withheld.
Building this often shows up other gaps too, such as emails about cases never being linked to the case record, which is worth fixing for its own sake.
Is this where you are?
- SARs are handled from scratch each time.
- Case-related emails are not linked to case records.
- Old system records are hard or impossible to search.
- Redaction is done on paper.
- Deadlines have come close, or been missed.