The Government and NHSE have unilaterally mandated (i.e. without consultation from General Practice as data controllers of patient records) that from November 2023 all patients must have automatic prospective access to their patient records, regardless of any consent process or safety checks.
As the data controllers of our patients’ records we are aware that not all patients would wish this process to be automatically enabled without their consent. There are also patient cohorts that may be not suitable to have automatic access to records due to potential risks of harm to the patient’s welfare.
We have conducted our own Data Protection Impact Assessment (DPIA) in accordance with the Information Commissioner’s Office (ICO) requirements, and have identified ongoing potential risks re: automatic prospective access and safeguarding patient safety and welfare. These ongoing risks and concerns regrettably in our view, remain unresolved by NHSE and the Government.
The Practice is keen to provide prospective access to those patients (or their verified representative) who wish to have this access. However, rather than providing automatic unchecked access, we are opting for a more robust and controlled process where patients (or their representative) must have their identity verified, read and sign a consent form, before our team are able to run clinical assurance checks prior to granting access. This is to ensure that all patients (or their representative) requesting access to their patient records understand all potential risks (including safe keeping of their confidential health records), and also to enable us to maintain our duties and legal responsiblities as the data controllers of patient records.
Key considerations and risks about prospective online access to records:
- Forgotten history
There may be something you have forgotten about in your record that you might find upsetting.
- Abnormal results or bad news
If your GP has given you access to test results or letters, you may see something that you find upsetting to you. This may occur before you have spoken to your doctor or while the surgery is closed, and you cannot contact them.
- Choosing to share your information with someone
It is up to you whether you share your information with others – perhaps family members or carers. It’s your choice, but also your responsibility to keep the information safe and secure.
- Coercion
If you think you may be pressured into revealing details from your patient record to someone else against your will, it is best that you do not register for access at this time.
- Misunderstood information
Your medical record is designed to be used by clinical professionals to ensure that you receive the best possible care. Some of the information within your medical record may be highly technical, written by Specialists and not easily understood. If you require further clarification, please contact your Specialist team or the Practice for a clearer explanation. Please note that this could impact on the availability of appointments for more urgent clinical problems.
- Information about someone else
If you spot something in the record that is not about you or notice any other errors, you must log out of the system immediately and contact the Practice as soon as possible.
So what does this mean in practice?
Those patients that wish prospective records access will be added to a waiting list for our admin team to arrange formal verification, consent and clinical assurance checks.
From these checks, should there be an identified need for further discussion between the patient (or their representative) with a GP prior to granting prospective records access, this will be arranged.
We anticipate that this process should not take significantly longer than 40 days to process, but this may be subject to other factors such as volume of requests, staffing levels and other clinical priority areas that we may be mandated to focus on by NHSE e.g. winter flu and covid19 pressures.
We hope that this process will run smoothly for both patients and the Practice, but more importantly we feel very strongly that this is the safest approach to minimise any risks of harm to patients and data breaches.
Thank you for your support and understanding.
For more info
Seeing your medical records www.patients-association.org.uk/seeing-your-medical-records
What you need to know about your GP online record www.england.nhs.uk/wp-content/uploads/2017/09/what-you-need-to-know-about-your-gp-online-record.pdf
Commonly found abbrevations in medical records www.nhs.uk/nhs-app/nhs-app-help-and-support/health-records-in-the-nhs-app/abbreviations-commonly-found-in-medical-records
Joint letter from BMA and Refuge regarding concerns over automatic prospective access to patient records www.bma.org.uk/bma-media-centre/bma-and-refuge-highlight-medical-record-access-concerns-for-survivors-of-domestic-abuse
Joint letter from BMA and Refuge regarding concerns over automatic prospective access to patient records refuge.org.uk/news/joint-letter-on-concerns-around-survivors-medical-records-on-nhs-app