GPs across England took urgent action over the weekend to remove a GP Connect functionality from their systems, following instruction from the BMA.
Removing a GP Connect update which permits third parties to add codes to patient records was one of BMA GP Committee England’s suggestions for potential industrial action to commence on 1 August, depending on the result of a ballot of GP partners which will close on Monday 29 July.
But the GPC instructed practices on Friday to do so immediately after finding out NHS England was making moves to prevent this action.
The GP Connect Update Record API was rolled out in March to connect practices’ systems to community pharmacy and enable updates as part of the Pharmacy First scheme.
The GPC said that while the functionality currently only permits Pharmacy First updates, ‘this is about its future potential’ which will be ‘the biggest workload dump imaginable’, and on Friday last week asked practices to take action immediately to switch it off.
GPC England chair Dr Katie Bramall-Stainer said that practices needed to ‘take steps now’ as the BMA has been ‘alerted to recent communications from NHS England’ opposing this action.
A BMA update sent to GPs on Friday said: ‘Originally one of the actions within our GP practice survival toolkit, we are inviting GP partners to follow our guidance and take steps now to remove the GP Connect functionality which permits third parties to add codes to GP patient records.
‘We have been alerted to recent communications from NHSE (NHS England) to TPP and EMIS to frustrate this step, and remove GPs’ rights as the data controller to control this, by the start of July.
‘We will be writing urgently to TPP and EMIS to remind them of their legal responsibilities as data processors, but in the meantime advise practices to take action as soon as possible.’
In a video message sent to GPs, Dr Bramall-Stainer said: ‘When this function was designed, NHS England said they did not want an off switch. But under GDPR, you as the practice are the data controller over the patient record. TPP and EMIS are the data processor and the patient is the data subject.
‘So actually, as the data controller, you do need to have the ability to control what goes into the patient record by third parties.’
She added that the GPC had been informed that NHS England ‘have asked for that off switch to be removed’ by today (1 July) and told practices that the weekend was ‘a critical window’ to act.
‘Do it this weekend, you’re the data controller, you carry the responsibility. This is not a breach. This is in fact protecting you under information governance, law and GDPR,’ Dr Bramall-Stainer said.
Yesterday GPC England deputy chair Dr David Wrigley said that GPs across England have acted this weekend ‘on an important aspect over how our patients records are used’.
In a post on X, he said: ‘We have no issue with their use in A&E or hospital wards or outpatients but we worry this free-for-all proposed by NHSE will clog up the records and leave GPs with responsibility for other people’s decisions and prescriptions which diverts us away from direct patient care in our surgeries.’
TPP confirmed it has ‘recently received’ a ‘request from NHS England’ to remove the option for practices to opt-out of incoming Pharmacy First Update Record messages, but that they ‘are not making this change’.
A spokesperson said: ‘We are currently in discussions with NHS England regarding this. We will keep practices updated and no changes will be made without significant prior notice.
‘We want to reassure practices that there are no planned changes to the controls that practices already have in SystmOne regarding Pharmacy First Update Record.
‘The controls regarding Pharmacy First Update Record are already available to each practice. There is no need to email TPP if you wish to amend these.’
Pulse has contacted NHS England and EMIS for comment.
Rhetorically speaking, GPs have prevented an industrial scale legal Cyber attack from NHSE and a large scale legal GP computer hacking exercise in my opinion.
Second that
As I have warned before, NHS plans to remove ‘effective’ control over the data from GPs (and give it to Palantir), despite the data subjects not wanting to allow this. However, it looks like they would like GPs to keep the legal ‘responsibility’ whikst removing ‘authority’ from them! This is legally scary.
You wonder to what extent a GP is an independent GP or an employee? How did GPs come to this sorry state under the Tories?
You wonder to what extent a GP is an independent GP or an employee? How did GPs come to this sorry state under the (14 years too long) Tories?
trying to sneak a data hack is not exactly conducive to building a trusting relationship. shows how much respect NHSE have for us
Credit to the BMA, KBS and local LMCs for recognising this, highlighting the issue and providing clear instructions on what action take as very effective joined up thinking and implementation.