A parent you've never met asks for their child's dental/medical records. What do you do?
A dental practice contacted us recently with a question that comes up more often than you'd think. A man rang, said he was the separated father of one of their young patients, and asked for a copy of his child's records. Nobody at the practice had ever met him.
It's an awkward spot. Say yes too quickly and you could hand private information to the wrong person. Say no too quickly and you could refuse someone who has every right to it. Here is how we suggest handling it. The same guidance holds true for medical records.
Start with guardianship, not parentage
The Dental Council's guidance on children in dentistry says parental or guardian consent is needed before treating anyone under 16, while a 16 or 17-year-old can consent as if they were an adult. Notice the word "guardian". It matters just as much when someone asks for a child's records.
The Council's page focuses on consent and safeguarding rather than records requests, so the data protection side is worth spelling out. Being a biological parent, or having access rights to a child, is not the same as being a guardian. Married parents both hold guardianship, and that continues after separation or divorce. An unmarried father doesn't automatically have it, so he may need to show it, for example through a statutory declaration or a court order.
Six steps for your team
Don't answer on the spot. Ask for the request in writing and log it. Don't confirm, by phone or at reception, that the child is even a patient. That alone is sharing information.
Check who they are. Ask for photo ID and compare what they tell you (the child's name, date of birth, address) with the file.
Confirm guardianship. If it isn't already clear from the file, ask for evidence such as a marriage certificate, statutory declaration or court order.
Check the file for restrictions. Look for any safety order, protection order, custody or access order, or an instruction limiting this parent's contact.
Share only the child's data. Records about the child's care and treatment can go out. The other parent's contact details, payment details and any notes about them should be redacted, as that is their personal data.
Reply formally and on time. You have one month under GDPR, which can be extended in complex cases. Confirm the outcome in writing, with reasons if you refuse or restrict access.
When to stop and escalate
Pause and speak to the practice principal or your Data Protection Officer before releasing anything if:
guardianship can't be confirmed, or you're unsure of the requester's identity
a court, safety or protection order is noted on the file
the two parents are giving conflicting instructions
there's any hint of risk or conflict, or the request seems aimed at something other than the child's care, such as separate family law proceedings
Why a written process helps
Requests like this rarely arrive at a convenient moment. They land on whoever is at reception, often by phone, often from someone upset. A simple written procedure means that person isn't left improvising, the child's information stays protected, and the practice can show it acted fairly and on time.
We'd suggest adding these steps to your staff induction and keeping them alongside your Child Safeguarding Statement.
This is general guidance, not legal advice. If a request is contentious, unclear or involves a court order, get advice before you respond. If you'd like help putting a procedure in place, get in touch with the Privacy Path team.