NHS England have published guidance on information sharing with the Infected Blood Compensation Authority (IBCA) to support claims from those who have been impacted. GPs, along with other NHS organisations, may receive requests from the IBCA for medical information. The IBCA will only make these requests on behalf of people claiming compensation where the information is needed to support claims, and after this has been discussed with the person claiming compensation.
The IBCA has been set up as the statutory independent body to deliver infected blood compensation to people who have been infected and affected by contaminated blood products. It has been created through the Victims and Prisoners Act 2024 (VAP Act 2024), which sets out IBCA’s duties and obligations. Section 53 of the VAP Act 2024 gives the IBCA the legal powers to require that any person provides information for the purposes of any matter connected to the administration of the infected blood compensation scheme, this includes personal data such as medical records or information.
If a GP receives a request for medical information, these should not be treated as subject access requests as they are a request for information under the statutory powers of the VAP Act 2024. The NHS England guidance says practices should respond within seven days with either the requested data or an explanation of what data is held, where it is held and timeline for when it will be provided. If the person claiming compensation is nearing the end of their life, the IBCA will confirm this in their request and ask the practice to deal with the request as a priority.
It is lawful for a GP to share the requested data under data protection legislation;
- Using the lawful basis UK GDPR is Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;’ which covers public functions and powers that are set out in law; or where they are required to perform a specific task in the public interest that is set out in law. The law reference is the statutory basis set out in the Victims and Prisoners Act 2024 (VPA 2024), c.21, part 3, section 53.
- And as it is health data (special category data) the Article 9 condition is 9 (2)(g)- Reasons of substantial public interest (with a basis in law) and when using this condition one of the 23 substantial public interest conditions set out in paragraphs 6 to 28 of Schedule 1 of the DPA 2018 must also be met. For this request that is paragraph ‘6. Statutory and government purposes.’
In addition, the VPA Act 2024 sets aside the common law duty of confidentiality in Sub-section (6) in s53 of the VPA 2024.
“(6) Except as provided by subsection (7), a disclosure of information authorised by or required under this section does not breach— (a)any obligation of confidence owed by the person making the disclosure, or (b)any other restriction on the disclosure of information (however imposed).”
NHS organisations have been advised to have a single point of contact, please check with your GP DPO whether they are acting as a single point of contact or if the request may come directly to the practice or a nominated person for a group of practices. All correspondence from IBCA will come from an email address ending in ibca.org.uk.
Additional patient registration questions
From 16 June 2025 patients registering with a GP via the NHS online registration form have been asked if they received a blood transfusion prior to 1996, as part of the response to the infected blood scandal.
Where a patient confirms they have received a pre-1996 transfusion practices are expected to review the information, offer hepatitis C testing if appropriate and be prepared to talk the patient through why having received such a transfusion is of concern. NHS England suggest that hepatitis C screening could be included in the appointment that practices are now required to offer newly registered patients within six months.
Patients born after 31 December 1995 will not be show the questions when using the registration form.