Data Protection Bill [HL]

Written evidence submitted by Richard Parker, Senior Associate, Hill Dickinson LLP (DPB52)

1 Executive summary

2 The Access to Health Records Act 1990 c. 23 (AHRA) provides a right of access to the health records of deceased patients, in favour of the patient’s personal representative or any person who may have a claim arising out of the patient’s death.

3 AHRA makes provision as to the fees the can be charged for access to the records by the holder of the records. There are two types of fee that can be charged, the first of which is set by reference to the maximum fee prescribed for subject access under section 7 of the Data Protection Act 1998 c. 29 (DPA).

4 The Data Protection Bill [HL] 2017-19 (Bill) does not, in its current form, make the necessary minor and consequential amendments to AHRA to confirm the position in relation to fees when the DPA is repealed and replaced by the Bill. As a result, the position in relation to fees for access to health records of deceased patients is ambiguous and will have financial and administrative implications for both applicants (such as the personal representative of a deceased patient) and holders of records (such as NHS and private healthcare organisations).

5 Clarity in the law will be crucial to ensure that any ambiguity or confusion is avoided. Schedule 18 of the Bill should therefore be amended to include appropriate minor and consequential amendments to AHRA. The wording of the amendment will depend upon the intention of the Government and Parliament as to the fees that should be chargeable for access to the health records of deceased patients.

6 Introduction

7 This submission is made to the House of Commons Public Bill Committee in relation to the Data Protection Bill [HL] 2017-19.

8 This submission is made in a personal capacity by Richard Parker, a Senior Associate at Hill Dickinson LLP, who acts primarily for the public sector and advises healthcare organisations in relation to a variety of issues, with a particular emphasis on information governance.

9 Hill Dickinson LLP is a leading and award-winning international commercial law firm which, with a specialist Health team of over 100 lawyers and national coverage, is one of the leading firms providing legal advice and support to the NHS and private healthcare organisations.

10 The Access to Health Records Act 1990 (AHRA)

11 AHRA originally came into force on 1 November 1991. At that time, AHRA made provision for access in relation to wide range of applicants under section 3(1), including: [1]

(a) the patient; 

(b) a person authorised in writing to make the application on the patient's behalf;

(c) where the record is held in England and Wales and the patient is a child, a person having parental responsibility for the patient;

(d) where the record is held in Scotland and the patient is a pupil, a parent or guardian of the patient;

(e) where the patient is incapable of managing his own affairs, any person appointed by a court to manage those affairs; and 

(f) where the patient has died, the patient's personal representative and any person who may have a claim arising out of the patient's death.

12 AHRA was subsequently amended on a number of occasions to reflect other changes in the law. Significantly, on 1 March 2000, when the DPA came into force, a number of provisions under AHRA were repealed. [2] This included the repeal of subsections (a) to (e) (above). The result was that only section 3(1)(f) remained.

13 The reason for this was that the subject access right under section 7 of the DPA effectively replaced the rights set out in section 3(1)(a)-(e) of AHRA. However, as the subject access right under the DPA only relates to personal data – i.e. data relating to living individuals [3] - it did not replace the right in section 3(1)(f) to access the records of deceased patients.

14 Requests for access under section 3(1)(a)-(f) of AHRA required compliance within 21 days, whereas the equivalent time period for subject access under section 7 of the DPA was 40 days. This led to a commitment by the Government that all health records request should normally be handled within 21 days, notwithstanding the longer time period under the DPA, which is reflected in Department of Health guidance. [4]

15 Section 3(4) of AHRA currently provides that no fee shall be required for giving access other than the following:

(a) where access is given to a record, or part of a record, none of which was made after the beginning of the period of 40 days immediately preceding the date of the application, a fee not exceeding [such maximum as may be prescribed for the purposes of this section by regulations under section 7 of the Data Protection Act 1998]; and

(b) where a copy of a record or extract is supplied to the applicant, a fee not exceeding the cost of making the copy and (where applicable) the cost of posting it to him.

16 The above wording reflects these provisions as currently in force. The wording in square brackets was substituted by the DPA with effect from 1 March 2000, [5] replacing previous wording which referred to a maximum set under section 21 of the Data Protection Act 1984 c.35.

17 The relevnt regulations made under section 7 of the DPA are the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000/191. Those regulations do not specifically refer to maximum fees for the purposes of section 3 of AHRA. However, in practice they have generally been regarded as providing that the maximum fee for access to the records of deceased patients under section 3(4)(a) of AHRA is the same as the maximum fee for subject access under section 7 of the DPA. Those maximum fees are currently £10 for health records held electronically, or £50 for health records held wholly or partially on other media (paper, x-ray film, etc). [6]

18 The additional fee for making copies and postage under section 3(4)(b) of AHRA is not linked to the DPA.

19 The Data Protection Bill [HL] 2017-19 (the Bill)

 

20 The Bill repeals the DPA in its entirety. [1]

21 In view of the history of the amendments to AHRA to coincide with changes in data protection legislation, it was expected that minor and consequential amendments would be made under the Bill, as was the case under the DPA. However, as currently drafted, the Bill does not provide for such amendments. [2]

22 The result is that, for the purposes of section 3(4)(a) of AHRA, there is no prescribed maximum fee. This creates some ambiguity as to whether the effect is that no fee can be charged, or if any fee can be charged (because there is no maximum limit). [3] A strict reading would appear to point to the latter.

23 It is arguable that the reference to the DPA in AHRA should be construed as reference to the Bill, in accordance with the Interpretation Act 1978 c.30. However, unless this is carefully considered, ambiguity could still arise given the significant changes to fees for subject access under the General Data Protection Regulation (GDPR), the Bill and any regulations issued under clause 12 of the Bill. In any event, reliance upon the Interpretation Act 1978 rather than express provision in the Bill should be avoided in the interests of certainty, as is the case already in respect of many of the minor and consequential amendments already provided for in the Bill.

24 Proposed amendment

 

25 Schedule 18 of the Bill should be amended to include minor and consequential amendments to AHRA to avoid the ambiguity described above from arising.

26 The wording of the amendment will depend upon the intention of the Government and Parliament as to the fees that should be chargeable for access to the health records of deceased patients. This submission does not address what that intention or policy is or should be. Therefore, specific wording for proposed amendment is not included with this submission.

27 Broadly speaking, the options appear to be:

(a) Repeal section 3(4)(a), in which case no such fee will be payable.

(b) Amend section 3(4)(a) to provide that the fees that can be charged are the same as under the GDPR and the Bill for subject access. This is a similar approach to that employed now under the DPA, though the practical implications will be different due to the changes to fees for subject access under the GDPR and the Bill. This would achieve parity in fees chargeable for access of records of both living and deceased patients.

(c) Amend section 3(4)(a) to specify a specific fee (or provide a regulation-making power under which such a fee can be prescribed). This would enable fees for access to the records of deceased patients to be kept at the same level as they are now. While this is not an option in relation to subject access (due to the requirements of the GDPR), it is permissible in relation to access to records of deceased patients (as this falls outside of the scope of the GDPR).

28 Under any of these options – or if no amendments are made to the Bill – the separate fee under section 3(4)(b) for making copies and postage would still be chargeable. There is no equivalent fee under the GDPR or the Bill, so consideration could also be made as to whether this provision should be repealed or amended.

29 All of these options have financial and administrative implications for both applicants (such as the personal representative of a deceased patient) and holders of records (such as NHS and private healthcare organisations). However, in any event, clarity in the law will be crucial to ensure that any ambiguity or confusion is avoided.

Richard Parker
Senior Associate, Hill Dickinson LLP

20 March 2018


[1] s. 3(1), as enacted.

[2] DPA, Schedule 16, Part I, para. 1.

[3] See DPA, s.1.

[4] See Guidance for Access to Health Records Requests, Department of Health, February 2010, para. 16.

[5] DPA, Schedule 15, para. 12.

[6] Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000/191, Reg. 3 and Reg. 6.

[1] DPA, Schedule 18, para 23.

[2] Bill 153 2017-19, as brought from the Lords (18 January 2018)

[3] For reasons not set out here, this situation does not appear to be avoided by the Interpretation Act 1978.

 

Prepared 22nd March 2018