18 June 2013 - Post by:Joan Whybray
Did you know how fiddly it is getting and keeping medical information about someone for the purpose of granting an ill-health early retirement pension? I was reminded of this when advising some pension scheme trustees who were updating their ill-health procedures. I had to focus on an area that is often considered to be the preserve of pension administrators, rather than pension lawyers. It isn’t as simple as asking the member for the information. You have two completely separate regimes to get past: data protection and access to medical records.
The first thing to look at is the consent form. The consent form, as you’d imagine, is the means by which a pension scheme member consents to the release of his medical records (usually from a GP) for consideration by the trustees. However, it’s not quite that simple. A person (or, for these purposes, the trustees of the pension scheme) can’t apply to see someone’s medical records unless they have notified the individual they intend to do so, and that individual has given his consent. The notification sent by the scheme must inform the member of their rights under the Access to Medical Reports Act 1988, and it is these details which are usually included in the consent form.
The consent form should inform the member, among other things, that he may:
* withhold his consent to the release of his medical records;
* consent to the release of his medical records, without viewing them himself first; or
* consent to the release of his medical records, but only after the member has viewed them himself first.
There is a fairly rigid timetable for various bits of the process. For example, if someone wants to review their medical report before it goes to a pension scheme, he or she has 21 days (from the date of the application by the pension scheme to the GP) to contact their doctor to get access to the report before it is sent off. This means that there will always be a minimum 21 day delay in the papers going to the trustees – trustees should plan ahead to ensure that these timings are built into the process for considering the member’s request.
Stephen Richards has already looked at the challenges of data protection for pension schemes (Data protection for pension schemes: are you compliant?) but data protection requirements are even more complicated when it is comes to medical data. Medical information constitutes “sensitive personal data” under the Data Protection Act 1998. That means that before medical information can be processed by the scheme, the member must give his “explicit consent”. You might think this isn’t too difficult a requirement; however, what if the member consents to the release of medical information in relation to a certain time-frame, but his GP releases medical information from the years preceding or following that period? What if the member completes the consent form in an ambiguous manner? We’ve seen both happen.
Trustees have to get this right. Work out exactly what the pension scheme needs to see to process an ill-health pension request, and exactly what the member consents to release. Any ambiguities should be cleared up as soon as possible. If things do go wrong, at best you may have to start the whole information-gathering process over again. At worst, in cases of serious breaches of the Data Protection Act, you face potentially heavy fines from the Information Commissioner’s Office.
Joan Whybray is an associate at Allen & Overy LLP