Thank you for your request for information about the following:

Request

1) The number of "Our records show that your medical exemption certificate entitling you to free NHS prescriptions is about to expire" letters sent out in 2025, where a) the patient had already successfully renewed their certificate prior to the letter being handed over to Royal Mail and b) the number where the patient had not yet attempted to renew their certificate.

6) The costs incurred to issue, print and send physical plastic exemption cards via post in the year 2025 - instead of using a digital database of eligible patients as the single source of truth of eligibility.’

The NHS Business Services Authority (NHSBSA) received your request on 7 February 2026.

We requested clarification regarding Q5 on 4 March 2026:

Please note that it is not known exactly how many e-mails are held regarding the topic at hand. These are not stored centrally and could amount to hundreds of e-mails. Locating these would involve a manual search of all e-mail inboxes, since there would be no simple search term that could be used. It would involve a manual search and interpretation of whether an e-mail is in scope for this request. We believe carrying out such a search would place a disproportionate burden on the NHSBSA to fulfil the request including searches, interpreting whether an e-mail fits the description of your request, work to determine if there is exempt information and redactions.

If the request did not ask for e-mails, then the remainder of the request could be answered relatively easily. Please can you confirm if you would like to exclude this from your request.

We received your response on 6 March 2026:

Thank you for your response. I'm somewhat confused that it sounds like NHSBSA has no workable email e-discovery capability which would be very surprising to me, can I ask some clarifying questions please:

Would the email search be possible if I constrained to a specific time window, or are you suggesting it wouldn't be workable regardless?

We have handled your request under the Freedom of Information Act 2000 (FOIA).

Our response

1. The number of "Our records show that your medical exemption certificate entitling you to free NHS prescriptions is about to expire" letters sent out in 2025, where -

a) the patient had already successfully renewed their certificate prior to the letter being handed over to Royal Mail and

b) the number where the patient had not yet attempted to renew their certificate.

The NHSBSA does not hold the information requested at the granular detail outlined in (a) and (b); however, we can confirm that 244,219 medical exemption certificate reminder letters were issued in 2025.

2. The total postage and printing/stationery costs associated with sending these notifications out via post, instead of a digital contact method such as email or NHS app push notifications.

The NHSBSA does not hold the requested information.

This is because we order postage materials in bulk for a number of services and therefore cannot identify what was spent on sending notifications for medical exemption certificates via post only.

3. The costs to design, print and distribute FP92A forms to GP surgeries that were incurred in the calendar year 2025.

The NHSBSA does hold the cost to print FP92A forms to GP surgeries. The total cost is £9,513.49.

The NHSBSA does not hold the remaining requested information. This is because the NHSBSA is not responsible for designing or distributing FP92As to GPs; however, NHS England may hold this.

You may wish to redirect your request to NHS England via:

NHS England NHS England PO Box 16738 Redditch B97 9PT Telephone 0300 311 22 33 Email: england.contactus@nhs.net Web http://www.england.nhs.uk/contact-us/foi/

Following the announcement on 13 March 2025 regarding the disbanding of NHS England, please be assured that at this time they can be contacted for information as normal.

4. The total postage costs incurred by maintaining a Freepost address for these forms to be sent to.

The NHSBSA does not hold the requested information.

This is because we cannot split the total cost of postage between medical exemption and maternity exemption certificate postage costs.

5. Any internal emails, papers or feasibility studies conducted/produced with the aim of modernising the process to waste less taxpayer money, and with the aim of allowing patients or GP surgeries to apply for and/or view exemption certificates digitally.

Section 12 (Exceeds the Appropriate Limit):

The NHSBSA cannot confirm or deny if the full scope of the requested information is held, as doing so would exceed the appropriate limit under section 12 of the FOIA.

We estimate that the cost of complying with your request would exceed the non-central Government limit of £450. The limit has been specified in The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (https://www.legislation.gov.uk/uksi/2004/3244/contents/made) and represents the estimated cost of one person spending 18 hours in determining whether the NHSBSA holds the information, and locating, retrieving, extracting and checking the information.

Please see the following calculations which sets out the estimated cost for compliance with this request:

The colleagues from the relevant 19 departments of the following directorates will need to search their email inbox to confirm if the requested information in scope is held:

• Chief Executive Office (includes 1 department)
• Data, Digital and Technology (includes 10 departments)
• Customer Operations (includes 4 departments)
• Portfolio Management (includes 1 department)
• Strategy, Performance, Business Development and Growth (includes 3 departments)

The headcount, as of 21 April 2026, for the relevant teams of the above directorates is 2,915.

We reasonably estimate it will take a minimum of 5 minutes and a maximum of 45 minutes to search email inboxes and review the contents of the email to determine if it falls in scope of Q5.

5 minutes x 2915 headcount = 242.9 hours (minimum) 2 hours x 2915 headcount = 5,830 hours (maximum)

In addition, the following locations will need to be searched to confirm what information is held in scope of this request:

• Records Storage Systems – 30 minutes per department. 30 minutes x 19 = 9.5 hours.
• Project Management Tools and Systems – 1 hour per department. 1 hour x 19 = 19 hours.

Minimum total = 242.9 hours + 9.5 hours + 19 hours = 271.4 hours Maximum total = 5,830 hours + 9.5 hours + 19 hours = 5,858.5 hours

In accordance with the duty to advise and assist under section 16 of the FOIA 2000, please be advised that due to the way the information is held and what information is requested, it would not be possible to reduce the scope of the request within the appropriate limit.

Please see the following link to view the section 12 in full - https://www.legislation.gov.uk/ukpga/2000/36/section/12

Nevertheless, even if we could comply with this question within the appropriate limit, the following exemptions would apply to the information in scope:

Section 31 (Law Enforcement):

Some of the requested information in scope of Q5 is exempt under section 31(1)(a) of the FOIA (law enforcement) as disclosure would be likely to prejudice the prevention or detection of crime.

The information includes security measures which could be exploited by a potential cyber-attacker. If a cyber attacker is aware of this, it will provide vital information and knowledge to assist them in future attacks.

Section 31 is a qualified, prejudice-based exemption and is subject to the public interest test. This means that not only does the information have to prejudice one of the purposes listed, but before the information can be withheld, the public interest in preventing that prejudice must outweigh the public interest in disclosure.

Public Interest Test:

Considerations in favour of disclosure:

• The inherent public interest in openness, transparency and accountability of public authority dealings.
• The public need that public authorities are spending money wisely and getting best value for money.
• Contribute to public understanding of the NHSBSA’s procedures and actions.

Considerations against disclosure:

• Disclosure would be likely to offer cyber criminals’ insight into the strengths of NHSBSA’s cyber security. This could ultimately result in a future cyber-attack. Cyber security measures are in place is to protect the integrity of patient, confidential and corporate information and it is in the public interest to ensure those cyber security measures are protected.
• The public interest in maintaining the integrity and security of the NHSBSA’s systems.
• The public interest in preventing cyber-attacks and similar against the NHSBSA’s systems.
• The occurrence of a future cyber-attack would prejudice the NHSBSA’s legal duty to safeguard personal information from loss, theft, inappropriate access, or destruction and therefore it is not in the public interest to disclose information.
• A cyber-attack could have severe consequences for the NHSBSA’s services and therefore have a direct impact on members of the public receiving those services.
• The inherent public interest in ensuring that public authorities can safeguard themselves from cyber-attacks which links to the protection of public funds.

Conclusion:

The NHSBSA recognises that there is a public interest in disclosure of the information to promote transparency and assurance in relation to the NHSBAA services; however, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information as more weight is afforded to the arguments outlined above in maintaining the security and integrity of the NHSBSA’s systems.

Section 36 (Prejudice to effective conduct of public affairs):

The requested information is exempt under section 36 of the FOIA 2000. Specifically, the following sub-sections:

• Section 36(2)(b)(ii) – disclosure would be likely to inhibit the free and frank exchange of views for the purposes of deliberation; and
• Section 36(2)(c) – disclosure would be likely otherwise to prejudice the effective conduct of public affairs.

The NHSBSA’s role is to deliver the medical exemption certificate service on behalf of the Department of Health and Social Care (DHSC). While we can look at administrative changes to the service, it is not within our remit to fully reform the service. Any changes would require policy updates as directed by the DHSC and stakeholder engagement with DHSC, NHS England, GP Practices and their system suppliers.

Due to the approval process required, even if these proposals were suggested by the NHSBSA, it may not be taken forward or approved following required stakeholder engagement, for example, the buy-in of GPs across the country. Disclosing this information in the public domain would likely lead to public confusion, misinterpretation and result in a mistrust of public services.

Furthermore, disclosing the information without engaging the above stakeholders could lead to both stakeholder and public misunderstandings around suggested automation or service reform.

Likewise with Section 31, Section 36 is a qualified, prejudice-based exemption and is subject to the public interest test.

Public Interest Test:

Considerations in favour of disclosure:

• Disclosure demonstrates transparency of public organisations.
• Disclosure demonstrates accountability of public organisations.

Considerations against disclosure:

• There is an inherent public interest in allowing free and frank discussion and formulating opinion which could be negatively impacted by the disclosure of potentially misleading information which has not been agreed and is subject to change.
• It is in the public interest to protect public confidence by not disclosing this information whilst it is still hypothetical which would cause confusion and leading to mistrust or reputational damage.

Conclusion:

We recognise that there is a public interest in the disclosure of information which facilitates transparency and accountability of public bodies and to enable the public to understand decisions affecting their lives and to contribute to public understanding and participation.

However, there is also a public interest in the NHSBSA having the space to have free and frank discussions regarding NHS policy which could be negatively impacted by the disclosure. We considered the impact of this would likely result in NHSBSA officers being reticent in recording information which may subsequently become public as a result of the FOIA 2000.

Having undertaken the balancing exercise, we have concluded that the weight afforded to the public interest in maintaining the exemption at this time outweighs the public interest in disclosure. 

6. The costs incurred to issue, print and send physical plastic exemption cards via post in the year 2025 - instead of using a digital database of eligible patients as the single source of truth of eligibility.

The NHSBSA does hold the requested information. Please refer to the attached data.

Data Queries

Please contact foirequests@nhsbsa.nhs.uk ensuring you quote the above reference if you have any specific questions regarding this response; or, if you feel you may be misunderstanding or misinterpreting the information; or, if you plan on publishing the data.

Reusing the data and copyright

If you plan on producing a press or broadcast story based upon the data please contact communicationsteam@nhsbsa.nhs.uk. This is important to ensure that the figures are not misunderstood or misrepresented.

The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988 and is subject to NHSBSA copyright. This information is licenced under the terms of the Open Government Licence detailed at:

http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Should you wish to re-use the information you must include the following statement: “NHSBSA Copyright 2026”. Failure to do so is a breach of the terms of the licence.

Information you receive which is not subject to NHSBSA Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated. Please obtain their permission before reproducing any third party (non NHSBSA Copyright) information.