This site is intended for health professionals only

At the heart of general practice since 1960

Read the latest issue online

GPs buried under trusts' workload dump

Practices will have to provide information requests for free under new legislation

New European legislation will ban GPs from charging for providing personal data, in a move that could cost practices into the tens of thousands a year. 

The European General Data Protection Regulation (GDPR), which comes into force next May, scraps the fees that data providers can charge people for their information.

The new rules mean practices will have to provide a free electronic copy of a patient's data, instead of charging fees of up to £50 per 'subject access request'.

This is despite GPs estimating that the requests can cost practices up to £80 a time.

The European Union says that the change in legislation is designed to 'protect and empower all EU citizens data privacy and to reshape the way organisations across the region approach data privacy'.

However, GP leaders have warned that this is likely to increase the number of requests coming in.

Former GPC IT subcommittee chair Dr Grant Ingrams said: ‘Despite GPs campaigning for years that they should not personally have to bear the cost of [subject access requests] by patients it is disappointing that even the minimal amount that GPs could charge is being swept away.

'This will result in an increase in the number of requests and practices being significantly out of pocket. Coming at a time when practices are already on their knees this could be the last straw for some. ‘

Telford practice manager and practice partner Clive Elliott warned that practices will be left shouldering the burden of providing patients’ data, which will have a knock-on impact on frontline services.

It already costs his practice £80 a time to deal with a subject access request, with costs including staff time and redaction of third party data.

He estimates that the average practice currently subsidises the cost of SARs by £8,000 – a sum that will rise once demand increases when the requests are free for patients.

He told Pulse: ‘All of these costs have risen with no corresponding increase in funding for processing SARs whilst the maximum charge has remained the same for many years.

‘This gives all NHS organisations a stark choice: ask private sector profit making companies such as solicitors, limited companies and others including solicitors ‘service companies’ to make a contribution to cover the true cost or divert scarce NHS funding away from patient care to, in effect, subsidise the work of profit making organisations.’

‘If this is implemented, in a small practice such as ours we estimate it will cost us £12,000 taken from front line services to meet administration for others to profit from.

‘For us, this will mean the loss of a member of staff or we will simply not be able to deliver the service under the new legislation.’

BMA’s professional fees committee chair Dr Peter Holden told Pulse: ‘Medical records are not just a list of payments or transactions but a diary of somebody’s life which often includes third-party information.

‘In an ideal world of course patients would be able to obtain their records but only after the doctor had redacted them for any third party information. All of that takes time and money neither of which does the NHS possess in any spare capacity.’

He said GPs will face the bill ‘as unlike other businesses they are unable to adjust their pricing structure to factor in what might more broadly be called costs of compliance.’

What is the GDPR?

European General Data Protection Regulation (GDPR), which comes into force next May, scraps the fees data providers can charge people for their information

The new rules ‘are aimed at uniformly strengthening citizens’ rights while reducing burdens for companies and public authorities as well as adapting rules to the challenges of the digital era,’ according to the European Parliament.

It beefs up the rules which were introduced in 1995 before the digital revolution.

‘This change is a dramatic shift to data transparency and empowerment of data subjects,’ according to the EU GDPR website.

NHS Digital has published guidance on the legislation.

The new rules mean that patients can find out if their data is being processed, where it is being used and the reason why.

Providers will also have to hand over the information within 30 days, instead of the current 40 days.

Organisations which breach the legislation could be fined up to 4% of their turnover.

Other moves include ‘clear and affirmative consent' for the processing of private data, the right to know when data has been hacked and to object to profiling.


Readers' comments (26)

  • Is there a case for a national programme to digitise all old paper notes?

    Unsuitable or offensive? Report this comment

  • All stand together and say No.
    It may not be wrong for patients to have access, but it is certainly wrong for us to foot the bill.
    Come on BMA - are you on this one?

    Unsuitable or offensive? Report this comment

  • Neil Bhatia

    All the more reason to encourage patients to have secure online access to their full GP record

    Unsuitable or offensive? Report this comment

  • Any private organization can recoup the costs by increasing the price of their products or services. There in lies the problem having one monopoly employer

    Unsuitable or offensive? Report this comment

  • Ildiko Spelt

    Under new legislation practices will die....

    Unsuitable or offensive? Report this comment

  • We will just have to increase other private fees to compensate......need a letter to; say you shouldn't pay the bedroom and or council tax/need a bungalow/ESA appeal/need extra time in your exams/have to carry your insulin needles on board an aircraft etc etc, yada, problems £100 please.

    Unsuitable or offensive? Report this comment

  • what about after Brexit ?

    Unsuitable or offensive? Report this comment


    Unsuitable or offensive? Report this comment

  • AlanAlmond

    Death by a thousand cuts. Anyone who hasn’t left, isnt planning on leaving or doesn’t have a longer term plan to leave when they can is nuts. If you’re currently training to become a GP need to ask yourself what on earth you are getting yourself into.
    Let the service be staffed by folk trained in other lands. At least they can feel compensated they escaped where ever it was they were so eager to leave. But I cannt help thinking that with time, they’ll soon be wanting to go home again.

    Unsuitable or offensive? Report this comment

  • Cobblers

    Jeez I am so glad I am out of this shite.

    Why are GPs still 'Data Controllers' and subject to SAR requests? The data are on remote servers and the records 'belong' to the SoS for Health.

    GPs are data adders not controllers. Submit your SAR to the SoS Agent *unt.

    Or is that too easy?

    Unsuitable or offensive? Report this comment

  • FFS

    Unsuitable or offensive? Report this comment

  • Second Cobblers's opinion. Decades being told that patient records legally (in law) belong to the SoS. Surely the latter's problem? Any legal experts able to advise?

    Unsuitable or offensive? Report this comment

  • Neil Bhatia

    The GP practice is the data controller in law, undisputedly.

    Clinical system suppliers, eg EMIS, act as data processors, holding our patient's data, on their servers, on our behalf. We control it, so we are the data controllers.

    The SoS might "own" the records but, until patients die, the Lloyd George notes are under our control and the *electronic* GP record is too (even after the patient dies).

    Unsuitable or offensive? Report this comment

  • Can we still invite folk to come to the surgery to do their own trawl of the notes they require, obviously they will need to provide patient consent,pay a service charge for rented space and be police checked before they can do it..As it is free another task to go to the bottom of the pile to be done at our convenience when we have done work which we are actually paid for probably never.

    Unsuitable or offensive? Report this comment

  • Sue me easily done hand back the contract and the membership of all our useless organisations that are supposed to represent us.

    Unsuitable or offensive? Report this comment

  • Thank you Neil. Sort of knew it was another of those crazy assymetric arrangments in NHS GP, where one is loaded with grief and risk with no access to any benefit. Doomed! Doomed!

    Unsuitable or offensive? Report this comment

  • We should all go private to prevent more silly laws that we cannot react to so we can balance the books. In other countries patients carry their own notes like the maternity ones and can blame no one if they loose it. Turn out the lights offer a possible solution to deal with the problem. Thanks!

    Unsuitable or offensive? Report this comment

  • This is providing access to the data for free,not for admin time of materials used.Let the patient or the money grabbing ambulance chasers do the work.We just need MDO guidence how this can be done by those wanting the information.Consent,access controlling access and indemnity.This is an argument for the patient controlling their own records,and carrying them with them.The spine seems to becoming a irrelivence as it ever was.Anyway as data is now stored centrally in servers there is a awful lot of rubbish in patients records.All those letters reviewed is stable carry on rev 6months.In the old days would have been paper pruned,now is costing more and more as this trite is stored digitally.Who pays we all do through our taxes.What a mess.

    Unsuitable or offensive? Report this comment

  • "A free electronic copy of patient data". What about printed copies - especially if requested in paper format? Also "...adapting rules to the challenges of the digital era..." so what about non-digital data like old paper records? Is that included? I wonder if those drafting this even thought about its application to large, complex medical records.
    Would be helpful if electronic copies of records could actually be easily created. Last time I tried, with Emis PCS you can only create a pdf file of the data protection summary using an add-on pdf printer program, which is most probably not approved. Docman images can only be printed (as XPS files) electronically one by one. Old paper records could certainly be scanned to pdf rather than photocopying, which would be useful if any future requests, but just as time-consuming the first time.
    Would be tempting to create the desired documents in an obscure format that is user-unfriendly to read or impossible to print!
    Introduction May 2018. Leave EU March 2019. Let's hope it's not incorporated into UK law!

    Unsuitable or offensive? Report this comment

  • Relevant website as per link in the article or its homepage at: (if anyone has the will to look at it).
    Looks like this was passed in April 2016 after a consultation period and with a 2 year transition period.
    Was excited by para 1 but exempted by para 2h.
    Did the BMA know about all this? Did they make any representation during the consultation period? Do they care about its effect on GPs?
    I think I know the answers: Probably, but not interested. No. No.

    Unsuitable or offensive? Report this comment

  • Rogue1

    As the medical notes are the property of the DoH, and in most cases on a computer owned by EMIS, why are we being involved. We don't own this information. We only access it on a daily basis, provided there isn't a problem with the IT link.
    Surely, there is a good case for patients who want this to contact the DoH or EMIS. We only access their data which the patient can do via the Summary Care record (we can help set up a password, if necessary).

    Unsuitable or offensive? Report this comment

  • Please note that I am a previous chair of GPC IT Subcommittee. I am not the current deputy chair, who is Dr Bea Bakshi. Therefore not my fault ;-)

    Unsuitable or offensive? Report this comment

  • Apologies for the mix-up - we've corrected this now. Thanks for pointing it out!

  • Would be nice to submit SAR requests to DoH, but they would be insensitive to third party information and make a mess of it, and patients will complain to..... GPs.
    Needs Union action - is there one for GPs?

    Unsuitable or offensive? Report this comment

  • Just Your Average Joe

    Thanks to Brexit - can we shelve this policy with the Tamiflu left over from a couple of years back!

    Unsuitable or offensive? Report this comment

  • Rogue1

    Don't patients have access to their records on line now. Get them to register and see what they want, not my problem

    Unsuitable or offensive? Report this comment


    The new regs state that you can charge if the request is excessive. The old regs said we could charge £50 because they recognised the request was excessive as it required us to trawl through the notes to check for harm and third party data.

    So maybe we can charge and indeed in principle we can charge the full cost rather than the £50.


    Unsuitable or offensive? Report this comment

Have your say