The findings echo the result of a GPonline investigation last month, which found that over half of GP practices had seen an increase in SARs since the GDPR was introduced in May, resulting in extra workload and costs for practices.
According to a BMA poll of 1,500 GPs, practices received an average of 11.7 SARs requests last month compared with just 8.5 a month before the GDPR was introduced - a rise of 36%.
The survey also found that, on average, more than three-quarters (77%) of requests were made by companies acting on behalf of the patient, such as solicitors.
SARs cover requests for access to records by patients, or by third parties who have been authorised to have access by the patient. Before the new regulations came into effect, GPs were allowed to charge a fee to cover the administrative costs of completing SARs, but GDPR means that information must now be provided free of charge.
GP workload
Producing the information required by a SAR can also involve significant work for practices because they need to check each record to ensure they are not unwittingly providing details about any third parties. Last month, GPonline found that some practices were spending over seven hours a week dealing with SARs, for which they receive no funding.
GPC chair Dr Richard Vautrey said: ‘These findings reflect what we’d been hearing anecdotally for some time – that GP practices are facing a significant increase in the number of subject access requests now that GDPR legislation has come into force, meaning the double hit of an increase in work and a decrease in funding, at a time when most are already under enormous pressure.
‘While patients have every right to access their own medical records, the majority of these requests are from companies potentially exploiting a system by which they no longer have to pay out of their own pocket and so the cost is transferred to the NHS – coming at a serious price for general practice.’
Before the GDPR came into effect the BMA recommended that practices could charge up to £50 for providing a hard copy of records to patients, or up to £10 for computerised records. Some practices would charge more than this for solicitor requests.
Government support
Dr Vautrey said he wanted GP practices in England to be provided with funding and support to meet the requirements of the GDPR and that the GPC were pushing for this in contract negotiations.
‘If practices are expected to meet the demand for these requests and practices are unable to charge a fee for reports to cover their costs, then the government must provide funding, and we are actively pushing for this in ongoing contract negotiations,’ he said.
‘Furthermore, if the secretary of state for health and social care is serious about his digital revolution in the NHS, he should commit to an IT solution that would allow all practices to offer patients access to their entire record in a safe and secure way. This would relieve GPs and their staff of some of the administrative workload burden of dealing with such requests, prove far more cost effective in the long-term and empower patients by having a greater understanding of their care.’
Earlier this month, Scottish health secretary Jeane Freeman pledged to provide data protection officers at 'no cost' to practices to ease some of the impact of GDPR.
