Skip to main content
Hafan

Advice for GPs and practice staff on the Freedom of Information Act (FOIA) and responding to requests for information

What are our responsibilities to respond to FOI requests?

GPs provide primary medical services under contract to the NHS in England and Wales, and to the HSC in Northern Ireland. This means that, under Schedule 1 of the Freedom of Information Act (FOIA), the contracted person(s) at the practice must respond to requests for information, and must make some information available proactively. Although FOI is devolved in Scotland, GPs there have equivalent statutory duties.

We know that, as GPs and practice staff, you’re under pressure and have many competing priorities. But our casework has shown that you may not be aware that you must respond to requests for information from anyone, not just patients. For example, FOIA is often used by researchers, journalists and interested members of the public.

We accept that practice managers might act as a point of contact for requests, and handle them on behalf of the GP or other contracted parties.

The legal time limit to respond to a request is usually 20 working days. You must respond to requests, although there are exemptions under FOIA that mean you might not have to provide the information that’s been asked for. You should also consider whether the requester has a right of access under other legislation, such as the UK GDPR, or the Access to Health Records Act 1990 (AHRA) (or the Access to Health Records (Northern Ireland) Order 1993).

How should we respond to requests?

The following are examples of the type of requests you may receive and how to respond:

A husband asks to see information about his wife’s treatment.

It’s very unlikely that you’d have to disclose this under FOIA, which has an exemption for personal information. You could advise him that his wife can make her own request for the information under data protection legislation. If he has a valid power of attorney, you should likely deal with it as a request on her behalf, again under data protection legislation. Or, if she is deceased, you should check whether he’s entitled to access the information under the Access to Health legislation. 

A researcher asks for statistical information about prescribed drugs.

You should potentially provide this information under FOIA, as long as it’s anonymised so that individual patients are not identifiable. 

A former employee asks for a copy of your patient confidentiality policy.

You might publish this already, in which case you can point them towards your publication scheme. Otherwise, it’s likely that you should provide this under FOIA.

What practical steps should we take?

You should:

    • flag this advice with your practice staff;
    • add “freedom of information” to the agenda for an upcoming practice meeting to check everyone is aware that they must look out for, and respond to, requests for information;
    • check that your practice has a system in place for logging when you receive and respond to FOI requests. Our FOI and EIR request tracking template can help; and
    • consider staff training on FOI. Our FOIA and EIR training videos can help.

How can the ICO support us?

We want to support GPs and practice staff to comply with FOIA. Our website is full of practical advice and resources, including detailed explanations of the different FOIA exemptions.

Our Guide to managing an FOI request covers key issues you need to know about, including:

    • What is a valid FOI request?
    • When do you have to respond?
    • What do you have to tell the requester?
    • What information do you need to publish proactively?

You should also find these specific resources helpful:

We’re always here to help – our business advice team can give you advice, or you can call our Helpline on 0303 123 1113.