<Practice name>
<Practice address>

<Date>

Dear Sir/Madam,

Thank you for your medical records Subject Access Request. We formally decline to undertake this.

We draw your attention to section 12.12, ‘Access to patient records from insurers and mortgage providers’, on page 112 of The Information Governance Review, ‘Information: To Share Or Not To Share?’ published in March 2013:

The Panel also heard concerns that insurers and mortgage lenders may seek to use their influence to request whole records from GPs, as a condition of supplying insurance or a mortgage. The General Medical Council has issued specific guidance for GPs and the British Medical Association and the Association of British Insurers (ABI) have produced joint guidelines to allow relevant data about patients to be shared appropriately with insurers on a basis of explicit, written consent.

In addition, principle 3 of the Data Protection Act offers further safeguards as it allows organisations to hold only ‘adequate, relevant and not excessive’ personal data about an individual. This means insurers and mortgage lenders cannot hold more information about an individual than they need. The Act also requires organisations to identify in advance and then request only the minimum amount of data needed for a particular purpose.

The Review Panel concluded that these guidelines, combined with the safeguards offered by the Data Protection Act offer sufficient to prevent inappropriate sharing of whole records with insurers and mortgage lenders.

In line with the recommendations of the Caldicott Review Panel, we suggest that you apply for a PMA report in the normal way. Alternatively, the patient may apply for a copy of their records having made a pre-payment of £50 to the practice and is at liberty to send you any or all of their medical records.
We cannot guarantee that the patient may withhold part of their medical record. You have a duty not to hold any more information than you require.

We would further advise you that we believe your actions to be in breach of the Data Protection Act. Statements in the press by representatives of the insurance industry confirm that a medical record Subject Access Request in this context is excessive, breaching principle 3, and as this practice is not in a position to determine that fair processing has taken place, principle 1 may also have been breached. If we receive another similar request from your company we will be compelled to report the matter to the Information Commissioner.

Yours faithfully,

<signature>