Londonwide LMCs

This resource forms part of our safe working pack.

This page was updated on 15 November 2023 to include a mention off Docman letters added to patient records at EMIS practices may not be visible to patients viewing their records within the NHS App.

Key info

Following the imposition of the most recent GP Contract, all practices are now contractually obliged to provide prospective record access to coded information (including results), documents and free text for all their patients. The only exception is when a patient has expressly requested that access not be given or they are identified as at risk. The BMA have issued a joint statement with Refuge and 20 other organisations to highlight concerns that accessibility to these records will have implications for survivors of domestic abuse, which could put them at greater risk. The contract also states prospective access must be given to new patients on registration unless they decline that access.

Vision practices are not currently affected by automatic access because the software does not support it yet.

GPCE continues to support the policy of extending access to patients’ online records in principle but they are clear that any risk to patient safety or practice stability is not acceptable and must be mitigated as far as is reasonably possible. We have collected key statements and guidance issued by GPCE over the last year:

In November 2022 their initial concerns were explained in this statement.
On 4 September 2023 GPCE wrote to the Department of Health and Social Care outlining their concerns around redaction facilities, safety risks and workload.
On 6 October 2023 GPCE published updated guidance for practices outlining actions that practices may need to take depending on where they are in the process for the accelerated access to records programme implementation, including a template data protection impact assessment.
On 2 November 2023, GPCE updated their guidance to include sections on: carrying out a data protection impact assessment (DPIA), implementing an opt-in model, implementing an opt-out model, providing access to patient records, communicating with patients, and bulk enablement for EMIS practices.

Any practice that has not been able to safely provide prospective automatic access risks being in breach of contract and will be subject to potential action from commissioners. Please get in touch with your commissioners, GPCE or LMC who can provide support and advice.

Steps practices should have taken

Complete a DPIA if they have not already done so, either using the GPCE’s suggested template or their own, detailing the practice’s circumstances, the identified risks and mitigations for those risks and documents the decision that the practice has taken/decided to take. Your Data Protection Officer (DPO) can provide advice and assistance with the DPIA. GPCE have provided advice on carrying out a DPIA.
Consider if there are any other actions to take depending on the conclusion of their DPIA. GPCE provide guidance on the different implementation models for providing access to prospective records.
Make sure all staff in the practice are trained and aware of the approach the practice is taking on access to records. Ensure all practice staff are aware that the information they enter into the record the patient may be able to see, that they know when it is necessary to redact information from the patient view and how to do this, and that staff have received training on how to handle queries. Training is provided in the RCGP toolkit.
Ensure staff are prepared and expect to field more queries from patients viewing their records for the first time. There is a table of commonly found abbreviations in medical records that practices can use to signpost patients to. There is also a list of abbreviations available in the NHS App.
Consider advertising the change to access in waiting rooms and on the practice website. There is no obligation to write out to or to contact all patients, but we have produced this template letter explaining some of the risks that come with records access, where a practice feels it may be useful to write to a patient or cohort of patients.
Consider promoting the use of the NHS App.

Practices may wish to consider having a standard form of words to issue in any instances where a patient is unhappy that that record access has not been provided automatically. Practices still have some obligations regarding ensuring they have systems in place to manage reviewing/redacting records where access is requested and encouraging patients to take up access to their records.

What practices should have completed in the run up to 31 October

EMIS practices were given until 19 September 2023 to request their system provider automatically enable their patients’ access, with ‘bulk enablement’ process slots being assigned for dates in October. Practices who did not request a slot prior to the deadline or subsequently sent an email to EMIS requesting bulk enable access had to enable each patient record individually, unless they are notified by EMIS that any late request for bulk enabled access has been accepted and scheduled.
TPP practices had to update their systems themselves following instructions set out in a user guide on the FutureNHS platform. It is reported that it took a practice about an hour to complete.
TPP and EMIS practices could access and NHS support team via: gprecordaccess@nhs.net.
Practices granting access manually needed to decide if they wished to seek consent from each patient prior to granting access, and determine a road map to consult all patients before the end of October. For any patient where a ‘104’ SNOMED code was applied because they were thought to be at higher risk also needed to be consulted. The only exception was not giving prospective access is if the patient asks not to have it.
If a practice batch coded their patient list, they needed to manually review each patient and grant access or document dissent.

Contractual obligations

Practices should be aware of their contractual requirements regarding offering online access to medical records. The updated contract requires all practices to provide their patients with online access to new (prospective) health information in their GP records (unless exceptions apply) by 31 October 2023.

The specific requirements are set out in schedule 1, para.5 of the updated GP contract.

The BMA GPCE continue to believe that redaction tools are not fit for purpose and are seeking to rectify this. They continue to push back firmly on this and seek solutions.

GPCE data protection impact assessment (DPIA) template

On 6 October 2023 GPCE published updated guidance for practices outlining actions that practices may need to take depending on where they are in the process for the accelerated access to records programme implementation. GPCE say they continue to support the principle of online records access for patients, provided it is safe for patients, and safe for GPs and their teams but GPCE remains concerned about certain aspects of the programme, which they have outlined previously.

To reflect the general risks GPCE have identified, the BMA have completed a general data protection impact assessment (DPIA) on behalf of the professions. GPCE advises practices to complete their own DPIA taking into account their practice’s particular factual circumstances, either using the suggested GPCE template DPIA which is based on the Information Commissioner’s Office’s one or their own bespoke template. In addition to the sample DPIA, GPCE has prepared guidance in the form of an FAQ, outlining actions that practices may need to take depending on where they are in the process of implementation and what conclusions they reach after completing a DPIA. There are also additional resources including SMS templates, wording for practice websites and an application form template for online access for an opt-in model.

Letters added to EMIS records via Docman

Some patients may not be able to see documents added to their record in EMIS via Docman, this is due to these documents being stuck in a ‘provisional’ state within EMIS. Docman say they are working on a fix for this which will also be applied retrospectively to documents which are not currently showing in the NHS App. Docman do not believe affected practices need to proactively communicate this issue to patients, but have provide some suggested text that can be added to the practice website page explaining records access to their patients, if a practice has one:

“We understand that some of our patients may have encountered difficulties viewing certain documents (e.g. letters from the hospital) due to a software problem. We sincerely apologise for any inconvenience this may have caused. We are pleased to inform you that this issue has been resolved for new documents being added onto the system. It may take up to a month for older documents to become visible.

“Your GP team will have been able to access the letters so your care will not have been affected during this time.”

Note: our template letter explaining some of the implications of records access to patients may be a useful source for practices considering creating a webpage.

Automatic access to patient records