Following changes to the 2023/2024 GP contract, all GP
We all worked hard when this programme came into effect, to identify those patients who might be at risk of having access to their health record online, and now it has become somewhat ‘business as usual’.
But how are we identifying risk going forward? How do we ensure those being given automatic access to their online record on their 16th birthday are not at risk? What about newly registered patients who we don’t have much information about? What about those patients who disclose to us now that having access to their record could make them unsafe?
Most of us have enough on our plates to be searching for the ‘unknown unknowns’, so we need to have robust processes in place to manage these scenarios above, in the interests of safeguarding our patients. In this first piece in a series on Records Access for Digital Good Practice, I outline my views on what we need to be doing to manage patients having access to their record, going forward.
Header
How do we manage this safely going forward?
How do we manage this safely going forward?
Patients under 16 were excluded from the national records access programme. However - going forward - every patient has been, and will be, given full prospective records access on their 16th birthday. They won’t be able to suddenly see historic information, but any new information entered in their record from their 16th birthday onwards will be visible to the patient online. The vast majority of these young people will benefit from having access to their health record, but a very small number could be at risk. As a reminder, we should be considering withholding full records access if:
- The patient is unable to keep their record secure e.g. if a parent/carer is still booking appointments and managing their health for them, or if they have a coercive partner who might force them to share access and use this to extend their control.
- The patient has an ongoing risk of serious harm e.g. someone with severe anxiety where access to their record 24/7 would significantly worsen their anxiety.
- Ongoing access to the records would place someone else at risk e.g. if records access could lead to escalated violence or aggression to general practice staff or an identified individual.
The first scenario above is far more likely than the subsequent ones. In the case of young people, it’s important that the 16-year-old is aware that full consultation notes and documents will become visible on their NHS App (or equivalent). Imagine the scenario where they attend the practice to discuss contraception, and this is then viewed by a parent who is still managing appointments on their behalf.
There are two elements to managing this for your registered 15-year-old patients:
- Proactively inform your patients on their 16th birthday that they now have full records access, what this means, and explain their responsibilities to keep their log-in safe and to report any inaccurate (or 3rd party) information they see on their record.
- Run searches to identify those few patients who would be at risk of harm from accessing their online records when they turn 16. This could be done twice yearly by the practice’s Child Safeguarding lead (here is an off-the-shelf search to identify all patients who are in the 6 months before turning 16 years old). This list could then be run against the same searches we used to prepare for the Records Access programme, to identify any code in their record related to abuse, vulnerability or lacking capacity for example.
When you (or your practice’s child safeguarding lead) identify a patient at risk of harm from having automatic access to their prospective record, adding the SNOMED
This might also be the moment to flag such a patient to the practice’s Adult Safeguarding lead for adding to a safeguarding register, depending on their circumstances.
For more comprehensive guidance on managing online services for children and young people, see the RCGP Online Services Toolkit: Children and Young People Record Access.
The risk for newly registered patients is largely mitigated by their online access resetting to the date they register with their new GP
- Some practices may choose to wait for their GP2GP transfer to complete, and then run searches on all new patients to ensure there are no codes or diagnoses that would mean giving them online access automatically would be a bad idea. This is time-consuming, manual and does not eliminate the risk because the accuracy of the search results depends on the quality of coding at the previous practice.
- Another option is to build an ‘online access agreement’ into your registration process. The RCGP offers a template here. The benefit of this process is that you’re informing the patient of their ability to see their prospective record as well as their responsibilities to keep their data safe and to inform the practice of any inaccuracies. It also gives the patient to opt-out of prospective access if they don’t want it. I’m currently working with both NHSE and Healthtech-1 to see if we can automate this process within the digital Register with a GP
General Practitioner Service, which is now mandated. Watch this space. - A final option is to not take any approach to identifying risk in newly registered patients, but treat every entry recorded in the notes as one appropriate for every patient to see. This means being alert and curious in interactions with patients as to whether or not online viewing is appropriate and redacting from online view where necessary. It also means explicitly asking about coercion or 3rd party access in consultations with young people about sexual activity and contraception and addressing online access directly in consultations about domestic abuse and coercive control.
It may not be clear that a patient is at risk of harm from having access to their full online record until sometime after they have registered, and of course patients can become at-risk at any stage in their lives.
In a similar vein to the final bullet-point above, the safest way to proceed with records access is to be curious to risk in consultations and interactions with patients (including receptionists and other non-clinical staff) and ensure that there is a clear escalation process for all staff to share a concern about an interaction they have experienced.
It is also crucial to write in the notes in a way that is factual, sensitive and free from judgement. All practice staff must know how and when to redact information from online view - namely when the information being shared with the patient would likely lead to significant harm (or to an identifiable people), if it contains third party information not already known to the patient, or for any other reason would not be provided under GDPR.
Finally, where non-clinical staff are adding information to a patient’s record, such as documents received, there must be a clear process for them to follow before making that document visible to the patient online. I have put together a proposed document workflow which you can amend for your own purposes.
A final note on SNOMED
The following codes will either block (‘104’) or unblock (‘106’ if entered after a ‘104’) a patient getting automatic access to their online record:
- 1364731000000104 Enhanced review indicated before granting access to your own health record
- 1364751000000106 Enhanced review not indicated before granting access to your own health record
Because we have already gone live with the national Records Access programme, these codes will only have an effect in three scenarios:
- A 15-year-old who has not yet been given online access but will be on their 16th birthday
- An existing registered patient without an online services account, who may request one in the future
- A newly registered patient who has not yet been given an online services account at the practice
These codes will NOT alter existing access. This is done manually through the ‘onlines services’ function in the EMIS’ registration module. So how do we keep track of what decisions have been made about online access?
The following SNOMED
- 1290311000000106 - Online access to own health record granted following enhanced health record review
- 1290301000000109 - Online access to own health record withheld following enhanced health record review
- 1290331000000103 - Online access to own health record declined by patient
More Resources
Hungry to learn more about Records Access? The Records Access TeamNet Page is full of useful resources, and I’ll include below a list of recordings of webinars and podcasts you can catch-up on:
- Primary Care UK Podcast on Records Access (Sept 2023)
- Records Access: EMIS Functionality Updates (July 2023)
- Accelerating patient online access: Safeguarding update (May 2023)
- Medical Record Keeping - Fit for Patient Access? (May 2023)
- Prospective Records Access - What Next? (Nov 2023)
- Language Matters - Adapting to Transparent Medical Recording Keeping (Feb 2024)
Coming soon on Records Access:
- Records Access - Checking and changing online access settings
- Records Access - Responding to patient queries and requests about access
- Records Access - Avoid the pitfalls and make the most of the benefits