Under the updated data protection regime a patient’s request to access their records (commonly known as a subject access request (SAR) must now be processed free of charge and within one month.
SARs: Multiple requests
Therefore your response to any subsequent copy of the same records from the solicitors should be along the lines;
“Thank you for your request. We have already recently provided under GDPR Article 12 rules a copy of the records you have requested to the Data Subject via an intermediary. Under GDPR any intermediary, agent or third party is considered to be the Data Subject themselves. Therefore your request, being a duplication
of the SAR request already actioned, falls under Article 12(3) and becomes a chargeable action. Article 12(3) allows “the controller may charge a reasonable fee based on administrative costs”. Our costs in this matter will be £[X] [insert your fee]. Alternatively, you may wish to secure copies of the requested data that has been already disclosed from the Data Subject themselves or their representatives.” (October 2020)