Processing and access of data
37.—(1) Subject to paragraphs (2) and (4), the provider must on the request of the Health Board—
(a)allow the Health Board to access practice data and patient records;
(b)produce or disclose practice data and data within patient records to the Health Board or to any person authorised in writing by the Health Board; and
(c)produce or disclose any other information to the Health Board which is reasonably required in connection with the Health Board’s functions.
(2) A request under sub-paragraph (1) must be made—
(a)after consideration of whether the relevant information could be so provided in compliance with the 1998 Act, and any directly applicable EU instrument relating to data protection;
(b)in accordance with directions given to the Health Board by the Scottish Ministers under section 2(5) of the Act that have been consulted upon by a body representative of general medical practitioners providing primary medical services in accordance with a general medical services contract or a section 17C arrangement; and
(c)for a purpose mentioned in sub-paragraph (3).
(3) The purposes mentioned in sub-paragraph (2)(c) are—
(a)medical diagnosis of or provision of healthcare to patients;
(b)the planning, including workforce planning, and management of health and social care services; or
(c)where information is reasonably required in connection with the agreement.
(4) The provider must produce any information relating to a request made in accordance with sub-paragraph (1)(b)—
(a)by such date as has been agreed as reasonable between the provider and the Health Board; or
(b)in the absence of such agreement, within 28 days of the request being made.
(5) In this paragraph—
(a)“access” includes access by way of any computerised system, information management & technology system or software; and
(b)“disclose” includes the provision of information by electronic means.