All GMS and PMS practices are now contractually required to provide online booking of appointments, ordering of repeat prescriptions and patient access to summary information held in the record. The aim is to allow patients to be better informed and more involved in their own healthcare.

Wider online access will, it is anticipated, be mandated in due course. This will have a significant impact on doctors and practices. The RCP has published detailed guidance on preparing for wider online patient access, including sample patient registration forms and patient information sheets.

Patient rights of access

Patients already have the right to request access to their records using a Subject Access Request (SAR) under the Data Protection Act 1998. So, what is new? The principal difference is that with a SAR the practice has 40 calendar days to comply with the request. This allows time in which to review and consider the records before disclosure. With online access a patient does not need to give any notice and may be able to see what has been written in their records instantly.

There could be real benefits, for example in reducing the time currently taken up with copying and sending records and results to patients in response to an SAR. Online access may promote a patient’s trust in the practice and allow mistakes in the record to be identified and corrected. On the downside, if patients have an unrealistic expectation of their role in amending the records, this may lead to conflict. Practices could also be subject to complaints if patients or others see items online that are harmful, distressing or a breach of confidence.

At present, the GMS/PMS contract specifies that practices only need to provide summary information online, not the full record – ie data relating to medications, allergies and adverse reactions. There may be advantages to some patients having greater access online, such as those with chronic conditions who will be able to see their test results and hospital letters.

Practices who want to take this further step will have to consider carefully which patients they will offer this service to, and whether the information will first be seen and signed off by a clinician. Another point is whether records will be disclosed prospectively, or will the whole past record be accessible? It may be easier to allow patients more access over time than to restrict access once it has been granted.

Third party and information with potential to cause harm

Doctors entering details in records to which patients will have access will need to remember they are writing for two audiences – the records will still serve their primary purpose of documenting the essential clinically-relevant information, but they will also be read by the patient. Wording that is not understood by, or which alarms patients may cause distress and you may find further consultations are needed to explain to them.

Where there is risk of harm from patients viewing their records, caution will need to be exercised. Practices will also need to consider the possibility that third parties might inappropriately gain access to patient information. For example, in cases of domestic abuse patients might be coerced into sharing their log in details. You will also need to take care regarding allowing parents to access their children’s data. As a child matures and gains capacity over decisions about their healthcare and records, parental access may no longer be appropriate.

Third party and potentially harmful material should be identified and immediately excluded from online disclosure, at least until the information can be properly considered and any necessary consent obtained. In the future, it is anticipated that read codes on GP computer systems could be set to make an episode available or unavailable for online access.