This site is intended for health professionals only

At the heart of general practice since 1960

Read the latest issue online

GPs buried under trusts' workload dump

Judge finds in favour of GP practice that refused to post medical records

Exclusive A GP practice has been told it does not have to post medical records to a solicitor, after a judge ruled in its favour.

In a recent court case, the judge ruled that the practice only needed to make medical records available to patients at reception and should not be forced to post the records.

Some experts have said this will have implications for GP practices who receive subject access requests and could help surgeries save hundreds of pounds a month. 

It follows the introduction of General Data Protection Regulation (GDPR) legislation in May 2018, which meant that practices were no longer able to charge a fee for producing copies of patient notes, but instead under a subject access request, patients could request them for free.

In Major v Darren Jackson & Ors, solicitor firm Fletchers took Barwell and Hollycroft Medical Centres in Leicestershire to court for not posting the medical records of their client – the patient - to them directly.

However, the judge ruled that the practice had fulfilled their obligations by making the records available for the patient to collect at the practice’s reception and that a practice who does this should not be subjected to applications for pre-action disclosure - a court order to share information with another party. 

Principle associate at Mills & Reeve LLP, who represented the practice, Claire Williams, said: ‘Our clients fulfilled their GDPR obligations, they acted in line with the ICO’s guidance and this was a wholly unwarranted attempt to make them incur costs and risk that they had no need to incur.’

On what this means for practices, she said: ‘Essentially, if GPs make the patient’s records available for the patient to collect from reception, then solicitors can no longer use this method to attempt to force the doctors to incur the costs and expense - and the additional risk - that is incurred from couriering them anywhere.

‘There will be situations where they do have to do a bit more. For example, if you had a paraplegic because of course they can’t just wander in and collect them.’

Locum GP, Dr Trefor Roscoe, said this new ruling would save GP time and money as practices get hundreds of requests a year.

He said: ‘I’m working at a practice as a locum at the moment which has 5,000 patients and they get about 10 requests a week for copies of records. They’re not all to do with legal cases, but a lot of them are.

‘This is saving every practice around the country hundreds of pounds every week and a lot of hassle.’

Dr Neil Bhatia, GP and IT lead at Oakley Health Group, said his practice which has around 30,000 patients on its list has been getting between 15 and 20 subject access requests for medical records per month.

He said: ‘Since May last year we’ve been inundated with subject access requests since they removed the cost implications. Everybody - not just solicitors, but criminal compensation board, the army, every organization DWP, every organization you can think of is using this as a way of getting information free of charge. Previously there was a fee.

‘We’ve been inundated with these and the guidelines were quite strict – you only had a month to produce these and [if you don’t meet the deadline] there’s always a possibility of monetary penalties.’

In January, the Government ruled out an exemption for GPs for GDPR subject access requests, as it would ‘weaken the rights of patients’.

Fletchers has been approached for comment.

Readers' comments (22)

  • Common sense at last!

    Unsuitable or offensive? Report this comment

  • Well done to all involved!

    Unsuitable or offensive? Report this comment

  • So grateful to the practice for having the nerve to challenge this. RESPECT.

    Unsuitable or offensive? Report this comment

  • Dear All,
    Good news but lets not be too hasty, Pulse has not reported the story correctly. In fact the case was not about GDPR or DPA 2018 directly. The Case was about what are known as the "Court Rules", in this case a rule that requires records to be disclosed. The Judge dismissed the case because he decided that the court rules were not applicable, because the records had already previosuly been made available under a SAR, therefore there was no need for the rule to be applied.
    Don't get me wrong, i'm as delighted with the result as you are but we cannot at the moment jump to too many conclusions about SARs. I imagine the GPC IT Team and BMA lawyers will be looking at this in detail.
    Regards
    Paul C

    Unsuitable or offensive? Report this comment

  • Practices though, it seems, are still stuck with the vast workload of producing copies of records 'for free'.

    Government departments - such as HM Tribunals and Courts Service - have stopped paying anything for copies of medical records and just give appellants (your patients) a letter demanding full copies of notes.

    Unsuitable or offensive? Report this comment

  • Congratulations to those involved. Utterly typical however that this was left to an individual practice to fight and that our alleged union the bma was nowhere to be seen.

    Unsuitable or offensive? Report this comment

  • There is software that will search and do redactions.
    A member of staff cross checks which had to be done before anyway.
    The record then goes onto encrypted disc and the patient gets that and when they request it they get the decode password.
    After that it is up them to sort out any papers for a 3rd party.
    Our manager reckons the discs are about £2.
    Better than £20+ for paper and postage .

    Unsuitable or offensive? Report this comment

  • Very generous of you Anthony, but entirely optional. Making records available within the Practice fulfils your SAR obligation. You can charge under Medical Records Act if you supply copies.

    Unsuitable or offensive? Report this comment

  • Neil Bhatia

    Personally, I think we can safely infer that disclosing the record in this way, where reasonable (i.e. the patient can collect it), fully upholds the data subject’s right of access and meets the requirements that disallow an order under CPR 31.17 (and probably CPR 31.16).

    Were you to make the record available for collection and not provide an alternative route if the patient was housebound/in prison/in a nursing home, then that could be deemed a contravention of Article 15.

    If you refuse to send the SAR to a third party and that results in either no disclosure (pt in prison) or an unsafe disclosure (patient has lost capacity) then that could be deemed a contravention of Article 15. Such situations are uncommon though.

    When it comes to civil actions, which the vast majority of SARs that we receive relate to, then the disclosure of records within civil claims is still governed by the Civil Procedure Rules (CPR). Disclosure in civil cases was clarified by the case of Dunn v Durham [2012] EWCA Civ 1654, which confirmed that the CPR was the correct regime under which to disclose and redact *documents*.

    There is case law about SARs, CPR, and DPA 1998 though, much of which would be applicable to DPA 2018:
    https://www.bailii.org/ew/cases/EWCA/Civ/2012/1654.html

    https://www.bailii.org/ew/cases/EWHC/Ch/2004/2509.html

    https://www.bailii.org/ew/cases/EWCA/Civ/2017/121.html

    https://www.bailii.org/ew/cases/EWHC/QB/2019/893.html


    Seeking remedy, where the patient refuses to collect the record and could perfectly do so, would have to go down the DPA s167 route. That is complex and expensive (as the judge says) and the court would view dimly on the costs involved when the alternative is simply for the patient to collect their own record. And no solicitor is going to risk high court costs for such a trivial matter – assuming the practice had not *refused* the SAR.

    The ICO has stated that practices are, of course, entitled not to disclose to a third party where they have concerns, but that there must no be a “blanket” policy of never disclosing to a third party (because sometimes we have to). It is important that a SAR policy reflects this, that all SARs are assessed individually, including the ability of the patient (or their spouse/partner etc) to be able to collect the SAR - as they do with all other forms, certificates, letters, results.....

    Neil


    Unsuitable or offensive? Report this comment

  • Paul,
    although the case was brought under the Court Rules the Judge confirmed that making the notes avaialble to the data subject fulfilled our obligations under GDPR. No solicitor will challenge this further as it would cost a fortune and they would loose.Happy to discuss directly. I have been following this casae since it started.

    Trefor

    Unsuitable or offensive? Report this comment

View results 10 results per page20 results per page50 results per page

Have your say