Better data protection laws should not drain general practice

The UK introduced the General Data Protection Regulation (GDPR) on 25 May 2018, binding big and small organisations alike to following strict data protection principles.
 
While it’s great that the UK is implementing measures to protect its citizens’ personal data, the introduction of GDPR has created a situation in which an existing task, the processing of subject access requests (SARs), is placing additional pressure on practices by leaving them to cope with an increased number of requests that they are no longer in a position to charge for. 
 
Before 25 May 2018, practices could charge patients a small fee – usually up to £50 – to respond to their SARs. However, since making the switch to the new data protection legislation, practices have been instructed to respond to these requests for free, even when it’s a third party – such as a solicitor – who has submitted the request on behalf of the patient.
 
As an NHS patient, part of me welcomes the move. It makes sense to get access to your medical records for free, especially if they’re digital records, as this saves the practice the costs of printing the request.
 
However, GDPR has now closed a tap that used to drip a small but steady stream of income into practices.
 
Practices now work laboriously to respond to SARs for free, within a month from submission date. What has not changed since the introduction of the Data Protection Act 2018 is the way they deal with these requests and the time they need to allocate to these tasks.
 
In a letter sent to LMCs, GPC policy lead for IT Dr Paul Cundy said that it takes up to 30 minutes of GPs’ time to review patient records, while admin staff need to focus up to one hour of their time to each SAR, ‘including receiving, processing, tracking and despatching them’.
 
As it becomes easier to access one’s medical records for free, it makes sense that a growing number of practices are experience a surge in these types of requests, from both patients and third parties.
 
As Dr Cundy said ‘companies who would once have had to pay out of their own pockets – such as solicitors and insurance firms – are bombarding practices with requests,’ since the introduction of GDPR.
 
We are almost three months in to GDPR, but there is still confusion about when practices can charge for this type of request, and the general rule is that they should not ask for money.
 
According to the Information Commissioner’s Office (ICO), practices can in fact charge for SARs ‘where the request is manifestly unfounded or excessive’, so that the administrative costs of complying with the request can be covered.
 
So, in cases when practices are requested to provide physical copies of SARs, would we legitimately be able to say that the request is excessive – as the records might be available in digital form? In which case we could apply this rule so that practices don’t need to cover the administrative costs of this work?
 
There is no clear answer – not yet. The BMA is currently seeking clarity on what the ICO meant by ‘manifestly unfounded or excessive’, which I feel can be highly subjective.
 
What practices can do, in the meantime, is write to their local MP to raise the issue. You can use Dr Cundy’s template letter to ask your MP to do anything in their powers to bring the issue to the table at a national level.
 
It would be ideal, of course, if the Government could compensate practices for these losses. It would have been great if it had paid closer attention to the Review Body on Doctors’ and Dentists’ Remuneration (DDRB) report, recommending a 4% total uplift for independent contractors, which practices could possibly have used to cover these additional costs.
 
But alas, that option has now been overruled. Perhaps the NHS could still invest an extra £2.5bn by 2020/21 on top of the additional funding already announced in the GP Forward View (GPFV), as suggested by the RCGP? Some of this funding could then be diverted towards the costs of processing SARs.
 
The NHS has been promised new money after prime minister Theresa May announced in June that an extra £20bn a year will be added to the pot by 2023.
 
Hopefully, some of the new funding will finally recognise the challenges that practice managers and their teams face, which as rightly highlighted by the RCGP, have increased in intensity since the introduction of the GPFV.