Oct 09

Accelerated Access to Records Update

The BMA has issued new guidance for practices concerning the contractual requirement for practices to provide patients with online prospective access to their full record.

As you’ll be aware, there are longstanding concerns about this new requirement, both in terms of the additional workload imposed on practices, and the safety for patients of a mass switch on of online access.

This will prospectively include the coded record, records of consultations, test results, all documents and associated free text, for all patients. Practices’ contracts require them to abide by this, by 31 October 2023.

The BMA has published  guidance for practices about what their options are:

GP contractors are data controllers of the GP-held medical record, and as such the Data Protection Act (DPA) 2018 and UK GDPR are paramount and must be observed by GPs instituting any new form of data processing. The new contractual requirements require changes to the way that GP contractors as data controllers process their patients’ personal data, and as such a DPIA (Data Protection Impact Assessment) is required by law.

It’s important to bear in mind that the DPA is primary legislation and has primacy over the contract variation which was a determination of the Secretary of State.

The BMA has completed a general DPIA on behalf of the profession reflecting general risks which GPCE has identified. Practices will now need to complete their own DPIA taking into account their particular individual circumstances. You can use the suggested BMA template which is based on the ICO’s, or develop your own if you wish (the BMA FAQs are helpful in guiding you through the process).

The BMA DPIA has identified a number of risks which may be mitigated by operating an opt-in model (i.e. providing access only to patients who request access, as opposed to providing access to all patients who have opted out). Practices who want to operate an opt-in model can take this action until 31 October 2023, which is the date by which GP contracts require access to be given to all patients who have not opted out. This could be via batch-coding with the ‘104’ code and then asking all patients if they wish to opt-in to access. The BMA has produced guidance on how to operate an opt-in model for practices that wish to operate this.

Action practices need to take:

  1. Complete a DPIA. You can use the suggested BMA template or develop your own.
  2. Personalize the DPIA to take into account your practice’s particular circumstances.
  3. Save the existing 104s
  4. Batch code the remainder 104 if the practice comes to the same conclusion as the BMA DPIA.
  5. Send AccuRx to the patient list with mobile numbers, to seek opt outs.
  6. Keep a waiting list of those who wish to seek access, and send them a consent kit to complete. Same for parents seeking proxy access for <16s and others for those lacking capacity.

Additional resources published by the BMA:

Whilst the sample SMSs are a tad too long for AccuRx, practices can attach them into a document, like a MED3.

We realise this is complex issue and a large amount of information to digest. Please remember the LMC is here to support you – if you have any queries please email humberside.lmcgroup@nhs.net.