Practices are under ‘increasing pressure’ from their ICBs to boost the number of patients with online access to medical records, according to GP leaders.
Despite this pressure, the BMA’s GP Committee reminded practices that any ‘mitigations’ identified by their Data Protection Impact Assessment (DPIA) should be followed in order for records access to be ‘legal’.
Pulse understands that NHS England is monitoring records access via a regular feed of information from system suppliers which shows the number of patients who have access or who could access their records if they sign up to the NHS App.
As a result of this, the BMA believes those practices with low access numbers – which are likely to be those with higher numbers of SNOMED 104 exception codes – are being targeted.
In last year’s GP contract, NHS England stipulated that all practices need to offer automatic access to prospective records via the NHS App by 31 October 2023.
But in December, 20% of practices had still not yet complied with the contractual obligation.
After abandoning plans for a legal challenge over this requirement, the BMA advised practices to carry out a DPIA before enabling records access, and to consider an opt-in model if risks are identified.
This was based on ‘grave concerns’ about the safety of vulnerable patients having full record access and the projected workload that GPs would take on.
Now, the union has said: ‘The BMA understands that some Integrated Care Boards (ICBs) are putting increasing pressure on practices to comply with the contractual requirement to provide online access to the prospective medical record for their registered patients, whether those patients have requested that access or not.
‘The BMA advice remains valid: we would encourage practices to follow their Data Protection Impact Assessment (DPIA) and put in place the mitigations identified, in order to be confident that the change to the processing of personal data is legal under the Data Protection Act.’
In February, the Information Commissioner’s Office (ICO) responded to the BMA’s concerns, stating that as long as GP practices ‘remain in control’ of deciding which records are made available, they will ‘remain able to mitigate any risks to the rights and freedoms of individuals’.
The union has said the ICO ruling supports their advice to carry out a DPIA and to put in place any mitigations before granting patient access to ensure the process is legal.
The update in May continued: ‘Should the practice’s DPIA identify an opt-in model as a way of mitigating against the risk of harm, we recommend you demonstrate to your ICB team how you are approaching this, and advertising to those in your practice population who do not yet have online access.
‘Should there be a long waiting list to process opt-in applications, we would recommend engaging with your ICB and seeking mutual agreement (with your LMC if necessary) around which parts of the overall practice contract should be prioritised.’
A spokesperson for NHS England said ‘record numbers of patients’ can already view their GP records on the NHS App, with 18.6 million views last month compared to the 9.6 million average last year.
‘NHS England is committed to increasing patient access to their health information, and we expect all GP practices to have implemented this in line with their contracts, and to speak with their ICB if there are any issues,’ the spokesperson added.
The national commissioner warned that ICBs have been asked to follow up with practices that have not provided access, and they may follow a contractual route where practices are not compliant with their contractual requirements.
Under the ICO’s ruling, GP practices can put in place sufficient mitigations which still enable them to meet their contractual obligations, according to NHSE.
Last month, a report by an influential non-profit organisation argued that the NHS should move away from its current model where GPs are the sole data controllers of patient records.
GP Directors on boards of ICBs /PCNs collaborating with NHSE backed by NHS managers of variable backgrounds and ability are leading this increased pressure on Primary care.
‘ICB’ is just the blanket term to disguise the real source of significant amounts of the harm across the NHS leading to patient suffering and in PCNs where quality is plummeting but PCN CDs are becoming richer and younger generation GPs are forced to work in supermarkets and other alternatives.
ICBs, PCNs, NHSE could not destroy the NHS we used to take pride in without the collusion of these highly remunerated leadership GP/Manager /Director groups.
We dragged our heels on this and then just did it and I have to say we haven’t even noticed. Has not created any problems that have made us regret doing it.
I think they are more important battles to be fought over the coming months.
Centreground has good points.
But why should overworked GPs surgeries do anything to promote forcing patients to access their records online, when that is not even basic healthcare, but just some gimmick. if anyone should be forcing online access it is public Health or the Data Controllers – which are no longer GP surgeries (despite Government and DoH still trying to mislead everybody into believing it is GPs fault if their data is accessed.
The GP Contract requirement is an obligation enforced by the controlling authority – the DoH and several private server providers are now the ‘Data Controllers’, not individual GP Partnerships !
Quite right DC. Take it off our hands and let NHSE manage this nightmare