GDPR: Transmitting results from secondary to primary care records
<p>In the UK, results of a blood (or other) test taken at a hospital (in secondary care) are stored in the hospital's records but are not automatically forwarded into primary care records (GP records) unless this is explicitly done so by staff at the hospital.</p>

<p>Article 20.2 of the GDPR states: "The data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible."</p>

<p>It is clearly technically feasible, since it is occasionally done.</p>

<p>Can I make a request under article 20.2 to ask my hospital to forward any test results I want to my primary care record (my GP)?</p>

<p>When I say "have the result forwarded", more specifically I mean <em>copied</em> so that the result ends up in both systems.</p>

<p>Background:</p>

<ul>
<li>I can view the results of all tests taken at my GP in an online portal (SystmOne portal).</li>
<li>However, results of tests taken at my local hospital only appear in this portal sometimes, if the result has explicitly been forwarded by the hospital to my GP.</li>
<li>I would like to ask the hospital to forward <em>All</em> results, so that I can easily view them in the online portal.</li>
<li>I'm aware I can make a subject access request to the hospital for the results, but this takes several weeks and isn't as convenient.</li>
<li>Additionally, this isn't just a "convenience of viewing my results" concern, it's also a concern that if my GP is unaware of some results that are held only by the hospital, and haven't been forwarded because they have been overlooked, surely that could cause problems in some cases.</li>
</ul>

<p>The advice from the Information Comissioner's office states [1]:</p>

<blockquote>
  <p><strong>What responsibilities do we have when we receive personal data because of a data portability request?</strong> </p>
  
  <p>When you receive personal data
  that has been transmitted as part of a data portability request, you
  need to process this data in line with data protection requirements.
  In deciding whether to accept and retain personal data, you should
  consider whether the data is relevant and not excessive in relation to
  the purposes for which you will process it.</p>
</blockquote>

<p>One could argue that the results of any test are relevant to an individual's healthcare and therefore, upon receiving the results, the GP would have a responsibility to retain them.</p>

<p>1: <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/" rel="nofollow noreferrer">https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/</a></p>

<p><a href="https://gdpr-info.eu/art-20-gdpr/" rel="nofollow noreferrer">Article 20 (Right to Data Portability)</a> of the GDPR is a conditional right (as defined in Article 20, section 1, point a), and that condition is the legal basis of the data processing, in that the right defined in Article 20 applies when the legal basis is either <strong><em>consent</em></strong> or <strong><em>required for performance of a contract</em></strong>, and does not apply when the legal basis is anything else.</p>

<p>NHS England <a href="https://www.england.nhs.uk/contact-us/privacy-notice/nhs-england-as-a-data-controller/" rel="nofollow noreferrer">details the legal basis</a> for their data processing in depth, and the only case where they use consent or contractual basis is in regard to NHS employees and other entities they are expected to have a specific contract with.  </p>

<p>The majority of other data processing, including related to patient data, is done under "<em>Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.</em>"</p>

<p>NHS England details 10 specific legal basis they assume for processing data, none of them are based on consent, and only one of them is based on performance of a contract, which a patient will not have with NHS England.</p>

<p>Therefore, NHS patients in England (and having quickly reviewed Wales, Scotland and NI, they are all the same - excluded here for brevity) do not meet the conditions for having a right as defined under <strong><em>Article 20 (Right to Data Portability)</em></strong>.</p>

<p>Further reading:</p>

<p>Its the <a href="https://www.bma.org.uk/" rel="nofollow noreferrer">British Medical Associations</a> position that <a href="https://gdpr-info.eu/art-20-gdpr/" rel="nofollow noreferrer">Article 20.2 - Data Portability</a> of the GDPR does not apply to GP Practices as that article relies on consent being the basis of the data processing authority, and the BMA considers GP Practices to rely on the <a href="https://www.bma.org.uk/-/media/files/pdfs/employment%20advice/ethics/gps-data-controllers-under-gdpr-mar2018.pdf?la=en" rel="nofollow noreferrer">"legitimate interest" or "provision of health or social care"</a> basis for processing and as such the right to data portability does not apply:</p>

<blockquote>
  <p><strong><em>Data portability</em></strong> – This concept will generally lie beyond the scope of
  general practices. The right applies only when the lawful basis for
  processing under the GDPR is explicit consent or the performance of a
  contract. As set out above, GP practices will be reliant on the
  ‘legitimate interests’ and ‘provision of health or social care’ bases
  for processing.</p>
</blockquote>

<p>While I cannot find their advice for secondary care (hospitals), I would be astounded if their view was any different as the same service is being provided.</p>

<p><a href="https://www.england.nhs.uk/" rel="nofollow noreferrer">NHS England</a> itself <a href="https://www.england.nhs.uk/contact-us/privacy-notice/nhs-england-as-a-data-controller/" rel="nofollow noreferrer">affirms this view point</a>:</p>

<blockquote>
  <p><strong><em>Right to data portability</em></strong> </p>
  
  <p>This right is only available where the legal
  basis for processing under the GDPR is consent, or for the purposes of
  a contract between you and NHS England. For this to apply the data
  must be held in electronic form. The right is to be provided with the
  data in a commonly used electronic format.</p>
</blockquote>

<p>I would take NHS Englands position to be position taken by all NHS secondary care establishments in England.  NHS Wales, Scotland and NI all probably have similar wording on their websites.</p>

gdpr