Records Access

Patients under 16 were excluded from the national records access programme. However - going forward - every patient has been, and will be, given full prospective records access on their 16th birthday. They won’t be able to suddenly see historic information, but any new information entered in their record from their 16th birthday onwards will be visible to the patient online. The vast majority of these young people will benefit from having access to their health record, but a very small number could be at risk. As a reminder, we should be considering withholding full records access if:

• The patient is unable to keep their record secure e.g. if a parent/carer is still booking appointments and managing their health for them, or if they have a coercive partner who might force them to share access and use this to extend their control.
• The patient has an ongoing risk of serious harm e.g. someone with severe anxiety where access to their record 24/7 would significantly worsen their anxiety.
• Ongoing access to the records would place someone else at risk e.g. if records access could lead to escalated violence or aggression to general practice staff or an identified individual.

The first scenario above is far more likely than the subsequent ones. In the case of young people, it’s important that the 16-year-old is aware that full consultation notes and documents will become visible on their NHS App (or equivalent). Imagine the scenario where they attend the practice to discuss contraception, and this is then viewed by a parent who is still managing appointments on their behalf.

There are two elements to managing this for your registered 15-year-old patients:

1. Proactively inform your patients on their 16th birthday that they now have full records access, what this means, and explain their responsibilities to keep their log-in safe and to report any inaccurate (or 3rd party) information they see on their record.
2. Run searches to identify those few patients who would be at risk of harm from accessing their online records when they turn 16. This could be done twice yearly by the practice’s Child Safeguarding lead (here is an off-the-shelf search to identify all patients who are in the 6 months before turning 16 years old). This list could then be run against the same searches we used to prepare for the Records Access programme, to identify any code in their record related to abuse, vulnerability or lacking capacity for example.

When you (or your practice’s child safeguarding lead) identify a patient at risk of harm from having automatic access to their prospective record, adding the SNOMED Systemised Nomenclature of Medicine code ‘1364731000000104 Enhanced review indicated before granting access to your own health record’ before their 16th birthday will ensure they won’t be given full prospective access. Best practice would then be to offer to meet with the young person to discuss the pros and cons of records access for them. Realistically, most clinicians will wait until the patient contacts the practice asking for access.

This might also be the moment to flag such a patient to the practice’s Adult Safeguarding lead for adding to a safeguarding register, depending on their circumstances.

For more comprehensive guidance on managing online services for children and young people, see the RCGP Online Services Toolkit: Children and Young People Record Access.
 

The risk for newly registered patients is largely mitigated by their online access resetting to the date they register with their new GP General Practitioner practice. This means the new GP General Practitioner will not inherit any risk entered in the record by a previous surgery. However, this new patient may well be at risk of harm from seeing their notes going forward, so how do we identify that risk and what do we do about it? We have some options:

1. Some practices may choose to wait for their GP2GP transfer to complete, and then run searches on all new patients to ensure there are no codes or diagnoses that would mean giving them online access automatically would be a bad idea. This is time-consuming, manual and does not eliminate the risk because the accuracy of the search results depends on the quality of coding at the previous practice.
2. Another option is to build an ‘online access agreement’ into your registration process. The RCGP offers a template here. The benefit of this process is that you’re informing the patient of their ability to see their prospective record as well as their responsibilities to keep their data safe and to inform the practice of any inaccuracies. It also gives the patient to opt-out of prospective access if they don’t want it. I’m currently working with both NHSE and Healthtech-1 to see if we can automate this process within the digital Register with a GP General Practitioner Service, which is now mandated. Watch this space.
3. A final option is to not take any approach to identifying risk in newly registered patients, but treat every entry recorded in the notes as one appropriate for every patient to see. This means being alert and curious in interactions with patients as to whether or not online viewing is appropriate and redacting from online view where necessary. It also means explicitly asking about coercion or 3rd party access in consultations with young people about sexual activity and contraception and addressing online access directly in consultations about domestic abuse and coercive control.
    

It may not be clear that a patient is at risk of harm from having access to their full online record until sometime after they have registered, and of course patients can become at-risk at any stage in their lives.

In a similar vein to the final bullet-point above, the safest way to proceed with records access is to be curious to risk in consultations and interactions with patients (including receptionists and other non-clinical staff) and ensure that there is a clear escalation process for all staff to share a concern about an interaction they have experienced.

It is also crucial to write in the notes in a way that is factual, sensitive and free from judgement. All practice staff must know how and when to redact information from online view - namely when the information being shared with the patient would likely lead to significant harm (or to an identifiable people), if it contains third party information not already known to the patient, or for any other reason would not be provided under GDPR.

Finally, where non-clinical staff are adding information to a patient’s record, such as documents received, there must be a clear process for them to follow before making that document visible to the patient online. I have put together a proposed document workflow which you can amend for your own purposes.

A final note on SNOMED Systemised Nomenclature of Medicine codes, which can be very confusing.

The following codes will either block (‘104’) or unblock (‘106’ if entered after a ‘104’) a patient getting automatic access to their online record:

• 1364731000000104 Enhanced review indicated before granting access to your own health record
• 1364751000000106 Enhanced review not indicated before granting access to your own health record

Because we have already gone live with the national Records Access programme, these codes will only have an effect in three scenarios:

1. A 15-year-old who has not yet been given online access but will be on their 16th birthday
2. An existing registered patient without an online services account, who may request one in the future
3. A newly registered patient who has not yet been given an online services account at the practice

These codes will NOT alter existing access. This is done manually through the ‘onlines services’ function in the EMIS’ registration module. So how do we keep track of what decisions have been made about online access?

The following SNOMED Systemised Nomenclature of Medicine codes are just for auditing purposes. They won’t affect a patient’s online access, but can be useful to use so you can see that a decision has been made and recorded in their notes:

• 1290311000000106 - Online access to own health record granted following enhanced health record review
• 1290301000000109 - Online access to own health record withheld following enhanced health record review
• 1290331000000103 - Online access to own health record declined by patient