Advice obtained directly from the ICO states:
“As subject access requests made on behalf of others (including by insurance companies) are treated the same as a normal sar made directly by the data subject, the GP practice would not be able to charge a fee. “