Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, if he will review the guidance his Department provides to GPs on charging third parties for requesting subject access to patient medical records in respect of changes brought in with GDPR.

The implications of the General Data Protection Regulation (GDPR) on general practitioner (GP) practices have been raised with NHS England as part of the wider General Medical Services contract review discussions.

The Information Governance Alliance (IGA) co-ordinates advice on information governance issues to the health and care system on the behalf of the Department, NHS England, NHS Digital and Public Health England. The IGA has published a number of guidance documents to support compliance with the GDPR requirements by National Health Service organisations. The guidance documents will be kept under review and revised as necessary. However, as directed by the GDPR, GP practices will not be allowed to charge third parties for subject access to patient medical records.