Patients’ right to access

Under the General Data Protection Regulations 2018, patients can request the information we hold about them, just like any other organisation. All GP practices in England are required to provide online access to more detailed medical records to registered patients. For more information about information governance and patients’ rights see the 🔒IG Homepage.

Both Patient Access and the NHS App provide secure online access for registered patients to NHS services, including viewing their medical records.

• Anyone deemed competent can access their own medical record, or give proxy access to another person or multiple people (e.g. an employed or unpaid carer, partner, parent or other family member).
• This includes under 16s deemed Gillick competent accessing their own record without a guardian proxy.

Changes to online access

It may not be suitable for some patients to access their full medical records (e.g. if there are safeguarding concerns, in domestic abuse cases, or known mental health issues).

Patient Access will still require Reception to validate the patient’s photo ID to be given access (see Patient Access section below).

Best practice

We should be aware and mindful that patients will be able to see new records after November 2023. Some changes to your workflow may be necessary:

• Consultation notes should always be accurate, up-to-date, relevant, and not disrespectful
• Consultations that contain sensitive information should be redacted as they are entered onto EMIS by clinicians (e.g. because of a safeguarding concern, or if we want to capture a difficult encounter with a patient)
• Documents that contain sensitive information should be redacted as they are checked and filed by the Clinical Admin team (documents will not be visible to the patient prior to being checked anyway)
• It should be noted that although documents may be hidden, results cannot be restricted
• To restrict visibility of a document, find the document in the consultations tab then follow steps to hide a consultation
• Referrals that contain sensitive information should be redacted as they are made by the Clinical Admin team
• To restrict visibility of a referral, find the referral in the consultations tab then follow steps to hide a consultation

Patient Access

Anyone can make a Patient Access account via the Patient Access app or website. However, to access the range of full range of Patient Access features (e.g. ordering repeat prescriptions etc.) they must link their account to their GP practice. This can be done by getting a ‘registration letter’ from Reception, or if the patient links their NHS login to Patient Access.

How to create a ‘registration letter’

1. The patient must come to the surgery with some form of photo ID (e.g. driving license, passport)
2. Open the patient’s EMIS record
3. Go to: EMIS button → ‘Registration’ → ‘Registration’ → click on tab ‘3. Online Services’
4. Click ‘Add online user…’ → ‘Add current patient’
• In the ‘ID Verification’ tab, add details of photo ID patient has brought
• In the ‘Access’ tab → ‘Record access’ section → ‘Detailed coded record’ section → select ‘Use detailed coded record settings’ AND ‘Show all record, but only show documents and free text from’ AND select date 30th Nov 2023
5. When the pop-up appears asking how you want to issue the PIN document, select ‘Both email and print’ if available, or just ‘Print’ if not
6. Either send a copy of the document to the patient via Accurx, or print a copy for the patient to take

The patient can then link their account with this information through Patient Access themselves. However, if the patient is not sure how to do this or asks for help, follow the steps here with the patient or send the link to them for guidance.

Restricting online access

For patients where it may not be suitable for them to access their full medical record (e.g. if there are safeguarding concerns, in domestic abuse cases, or known mental health issues), follow the steps below to restrict access via EMIS (for both Patient Access and the NHS App).

Identifying patients

Reinstating online access

If a patient is deemed suitable to access their medical record (e.g. an under 16, someone that was previously flagged for enhanced review) their individual settings will need to be updated for them to access their medical record (through either Patient Access and the NHS App).

Auditing online access

EMIS searches should be run once a month. This is to check that patients and proxies that have been given access or restricted access are still appropriate. This includes:

• Reviewing whether patients with SNOWMED CT code ending 104 or 109 that restriction is still necessary
• If restriction is considered no longer necessary - SNOWMED CT code ending 106 should be added, and online access should be edited to allow full access to coded and free text information from the date of adding 106 code (see how to do this here)
• If a patient with code 104 or 109 has made an account using NHS App to access their medical record, access should be restricted as detailed here
• Ensuring that any under 16s that have access to their medical record also have Gillick competency coded on their records
• Reviewing proxy users for patients turning 16 (who can now access their own record)