GDPR: Transmitting results from secondary to primary care records

Question

In the UK, results of a blood (or other) test taken at a hospital (in secondary care) are stored in the hospital's records but are not automatically forwarded into primary care records (GP records) unless this is explicitly done so by staff at the hospital.

Article 20.2 of the GDPR states: "The data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible."

It is clearly technically feasible, since it is occasionally done.

Can I make a request under article 20.2 to ask my hospital to forward any test results I want to my primary care record (my GP)?

When I say "have the result forwarded", more specifically I mean copied so that the result ends up in both systems.

Background:

• I can view the results of all tests taken at my GP in an online portal (SystmOne portal).
• However, results of tests taken at my local hospital only appear in this portal sometimes, if the result has explicitly been forwarded by the hospital to my GP.
• I would like to ask the hospital to forward All results, so that I can easily view them in the online portal.
• I'm aware I can make a subject access request to the hospital for the results, but this takes several weeks and isn't as convenient.
• Additionally, this isn't just a "convenience of viewing my results" concern, it's also a concern that if my GP is unaware of some results that are held only by the hospital, and haven't been forwarded because they have been overlooked, surely that could cause problems in some cases.

The advice from the Information Comissioner's office states [1]:

What responsibilities do we have when we receive personal data because of a data portability request?

When you receive personal data that has been transmitted as part of a data portability request, you need to process this data in line with data protection requirements. In deciding whether to accept and retain personal data, you should consider whether the data is relevant and not excessive in relation to the purposes for which you will process it.

One could argue that the results of any test are relevant to an individual's healthcare and therefore, upon receiving the results, the GP would have a responsibility to retain them.

1: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/

Answer 1

Article 20 (Right to Data Portability) of the GDPR is a conditional right (as defined in Article 20, section 1, point a), and that condition is the legal basis of the data processing, in that the right defined in Article 20 applies when the legal basis is either consent or required for performance of a contract, and does not apply when the legal basis is anything else.

NHS England details the legal basis for their data processing in depth, and the only case where they use consent or contractual basis is in regard to NHS employees and other entities they are expected to have a specific contract with.

The majority of other data processing, including related to patient data, is done under "Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

NHS England details 10 specific legal basis they assume for processing data, none of them are based on consent, and only one of them is based on performance of a contract, which a patient will not have with NHS England.

Therefore, NHS patients in England (and having quickly reviewed Wales, Scotland and NI, they are all the same - excluded here for brevity) do not meet the conditions for having a right as defined under Article 20 (Right to Data Portability).

Further reading:

Its the British Medical Associations position that Article 20.2 - Data Portability of the GDPR does not apply to GP Practices as that article relies on consent being the basis of the data processing authority, and the BMA considers GP Practices to rely on the "legitimate interest" or "provision of health or social care" basis for processing and as such the right to data portability does not apply:

Data portability – This concept will generally lie beyond the scope of general practices. The right applies only when the lawful basis for processing under the GDPR is explicit consent or the performance of a contract. As set out above, GP practices will be reliant on the ‘legitimate interests’ and ‘provision of health or social care’ bases for processing.

While I cannot find their advice for secondary care (hospitals), I would be astounded if their view was any different as the same service is being provided.

NHS England itself affirms this view point:

Right to data portability

This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

I would take NHS Englands position to be position taken by all NHS secondary care establishments in England. NHS Wales, Scotland and NI all probably have similar wording on their websites.

Answer 2

I am not from the UK, but as I understand it, the medical system is all controlled by the government therefore the government that means there's only one controller.

The part of the law you cite is referencing transmitting the data, because it would be part of your right to have your data in that you may want another party to do something specific with it using their tools.

In terms of the UK Health system, its all one system. Therefore, its not really a legal issue. Just call the doctor and ask if he/she would put the data where you can see it online.