Online access to records in primary care poses many medico-legal questions.

Manage the risk

The MDU offers the following advice to GP practices offering online access to records.

  • The 2015 contract requires practices to promote online access for patients to book appointments, order repeat prescriptions and view summary information.
  • Patients should be given information about the possible benefits and risks of online access.
  • Consider the possibility that patients may be coerced into sharing information with others.
  • Children are likely to gain capacity over access to their records as they mature and continued access by their parents may no longer be appropriate.
  • Practices will need to exercise judgement before agreeing to make additional information from the records available online. To ensure the judgement is seen to be fair, practices may wish to write a policy for how access requests will be considered.

All GMS and PMS practices are now contractually required to provide online booking of appointments, ordering of repeat prescriptions and patient access to summary information held in the record. The aim is to allow patients to be better informed and more involved in their own healthcare.

Wider online access will, it is anticipated, be mandated in due course. This will have a significant impact on doctors and practices. The RCP has published detailed guidance on preparing for wider online patient access, including sample patient registration forms and patient information sheets.

Patient rights of access

Patients already have the right to request access to their records using a Subject Access Request (SAR) under the Data Protection Act 1998. So, what is new? The principal difference is that with a SAR the practice has 40 calendar days to comply with the request. This allows time in which to review and consider the records before disclosure. With online access a patient does not need to give any notice and may be able to see what has been written in their records instantly.

There could be real benefits, for example in reducing the time currently taken up with copying and sending records and results to patients in response to an SAR. Online access may promote a patient’s trust in the practice and allow mistakes in the record to be identified and corrected. On the downside, if patients have an unrealistic expectation of their role in amending the records, this may lead to conflict. Practices could also be subject to complaints if patients or others see items online that are harmful, distressing or a breach of confidence.

“It may be easier to allow patients more access over time than to restrict access once it has been granted.”

At present, the GMS/PMS contract specifies that practices only need to provide summary information online, not the full record – ie data relating to medications, allergies and adverse reactions. There may be advantages to some patients having greater access online, such as those with chronic conditions who will be able to see their test results and hospital letters.

Practices who want to take this further step will have to consider carefully which patients they will offer this service to, and whether the information will first be seen and signed off by a clinician. Another point is whether records will be disclosed prospectively, or will the whole past record be accessible? It may be easier to allow patients more access over time than to restrict access once it has been granted.


Photo credit: Getty Images

Third party and information with potential to cause harm

Doctors entering details in records to which patients will have access will need to remember they are writing for two audiences – the records will still serve their primary purpose of documenting the essential clinically-relevant information, but they will also be read by the patient. Wording that is not understood by, or which alarms patients may cause distress and you may find further consultations are needed to explain to them.

Where there is risk of harm from patients viewing their records, caution will need to be exercised. Practices will also need to consider the possibility that third parties might inappropriately gain access to patient information. For example, in cases of domestic abuse patients might be coerced into sharing their log in details. You will also need to take care regarding allowing parents to access their children’s data. As a child matures and gains capacity over decisions about their healthcare and records, parental access may no longer be appropriate.

Third party and potentially harmful material should be identified and immediately excluded from online disclosure, at least until the information can be properly considered and any necessary consent obtained. In the future, it is anticipated that read codes on GP computer systems could be set to make an episode available or unavailable for online access.

Case scenario

A patient with long-standing insulin dependent diabetes asked for access to her HBA1C results online. The GP felt that this could empower the patient to manage her own condition. The patient read the practice’s patient information leaflet and accepted it was her responsibility to keep her log in details secure and that the practice reserved the right to withdraw access. It was agreed that HBA1C results would be available online to the patient prospectively once they had been seen and signed off by the GP.

This page was correct at publication on 12/08/2015. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.