2.—(1) The National Health Service (General Medical Services Contracts) Regulations 2015(1) are amended as follows.
(2) After regulation 67 insert—
67A.—(1) This regulation applies if a contractor, or a person acting on behalf of a contractor, makes a request to a patient (“P”) for P to disclose their ethnicity to the contractor so that information can be recorded in P’s medical record (a “relevant request”).
(2) If P, or where P is a person to whom paragraph (4) applies, an appropriate person, discloses P’s ethnicity in response to the relevant request, the contractor must record P’s ethnicity in P’s medical record.
(3) If P, or where P is a person to whom paragraph (4) applies, an appropriate person, indicates that they would prefer not to disclose P’s ethnicity in response to the relevant request, the contractor must record that response in P’s medical record.
(4) This paragraph applies to a person if they—
(a)are a child, or
(b)lack the capacity to respond to the relevant request.
(5) Any information recorded in accordance with this regulation may only be processed if the processing is necessary for medical purposes.
(6) Nothing in this regulation authorises the processing of personal data in a manner inconsistent with any provision of the data protection legislation.
(7) In this regulation—
“appropriate person” means a person who is acting on behalf of P and is—
where P is a child—
a parent of P, or in the absence of both of P’s parents, the guardian or other adult who has the care of P,
a person duly authorised by a local authority to whose care P has been committed under the Children Act 1989(2), or
a person duly authorised by a voluntary organisation by which P is being accommodated under the provisions of that Act;
otherwise—
a relative of P,
the primary carer of P,
a donee of a lasting power of attorney granted by P, or
a deputy appointed for P by the court under the provisions of the Mental Capacity Act 2005(3);
“data protection legislation”, “personal data” and “processing” have the same meanings as in the Data Protection Act 2018 (see section 3 of that Act)(4);
“medical purposes” has the meaning given for the purposes of section 251 of the Act.”.
(3) In regulation 68(2), in the definition of “Summary Care Record”, after “any other data” insert “(other than any information recorded in accordance with regulation 67A)”.