The EU General Data Protection Regulation (GDPR) comes into force on 25 May 2018, and the UK Government’s accompanying Data Protection Bill is currently making its way through parliament.
We have known for a long time that subject access requests will be free of charge under GDPR, unless ‘manifestly unfounded or excessive’. This applies to requests made by (or on behalf of) living patients to access their health records, and means current practice under which fees of up to £50 per request can be routinely charged will come to an end.
What has been less clear is how the law will change in relation to access to the health records of deceased patients by personal representatives and others with a claim arising out of a patient’s death. Such requests are dealt with under separate legislation, the Access to Health Records Act 1990 (AHRA), because health records of deceased patients fall outside of the definition of personal data and therefore the scope of the data protection law.
AHRA currently allows both an access fee (set in regulations made under the Data Protection Act 1998) and a copying and postage fee to be charged (section 3(4)). However, previous drafts of the Bill have not set out any amendments to AHRA, leaving some ambiguity as to the position come 25 May 2018.
That is, until now. The Bill is currently undergoing consideration by the Public Bill Committee of the House of Commons, and a new draft of the Bill, as amended by the committee, has been published today. Schedule 18 of the latest draft Bill now includes minor and consequential amendments to the Access to Health Records Act 1990, including that:
(1) Section 3 (right of access to health records) is amended as follows: (2) In subsection (2), omit ‘subject to subsection (4) below’;.and (3) In subsection (4), omit from ‘other than the following’ to the end.
Read alongside the AHRA, the effect of this seemingly innocuous looking wording is that no fee can be charged under AHRA, full stop. While it is possible this part of the Bill could be amended before being approved by parliament, there is now a very high likelihood that holders of health records will no longer be able to routinely charge fees under either GDPR or AHRA, from 25 May 2018.
The removal of fees for access to health records is already a concern amongst both NHS and private healthcare organisations, with the combination of an expected increase in requests and the removal of an existing stream of income giving rise to potentially significant financial implications.