“The 2013 Information Governance Review (Caldicott 2) recommends that “An audit trail that details anyone and everyone who has accessed a patient’s record should be made available in a suitable form to patients via their personal health and social care records” (Recommendation 1)Click here to see the review

Several practices have raised concerns about the lawfulness of displaying administrative staff names in addition to those of health professionals in patient online records access screens. This is within a particular view.

As Data Controllers under the Data Protection Act 1998 (DPA) practices are responsible for ensuring that they comply with its provisions in their management of personal data relating both to patients and staff. The purposes for which personal data are to be used must be transparent, processing must not be outside reasonable expectations of the subjects, and must not cause unwarranted detriment. The common law duty of confidence and other relevant laws must be respected.

Provided practices have informed their staff that their names will be displayed in records access screens, such disclosures will be lawful. To facilitate informing their staff, some practices have included information about this in their staff hand books.

Where a member of staff believes that substantial damage or distress may be caused, to him/herself or somebody else, they are entitled to request the practice not to disclose their names. Under the DPA such objections must be made in writing, and must specify why the disclosure would be harmful. Practices will need to consider such requests on a case-by-case basis.

To reduce queries from patients, some practices have added information regarding the need for admin staff to access the medical record to the consent form the patient completes when requesting record access.

Set up an online access report within SystmOne Clincical Reporting as follows:-
1. Reporting Menu
2. Click Clinical Reporting
3. Click New Report
4. Enter Name: Online Access
5. Enter New Catergory: Online Services
6. Find Registration Node and expand
7. Highlight Online Services, on right hand page Tick Requested for Online Services,
8. Click Ok Run Report
9. Once results displayed, Breakdown results by Services Granted
(Note this report does not work very well and is under development with TPP).

There is no way to Bulk remove access this needs to be actioned on a Patient by Patient basis.

No Guidance available at present, this is dependant on the individual practice online configuration.

Within the organisational set up of their Clinical System the practice can choose how many appointments a patient can book online at any one time.

Generally, depending on the variety of appointments on offer at the practice (GP and Nurse), this is set at a maximum of two appointments at any one time, per patient.

FROM RCGP WEBSITE
1. When someone requests online access to a child’s record, it is essential to establish that they have parental responsibility and right of access to the child’s record
2. Parent and carer access should not inhibit recording of safeguarding concerns in case an abuser will become aware that abuse has been detected. Such data should be redacted where the computer system has the functionality to do so, so that it is not visible online
3. On the child’s 11th birthday, GP computer systems will automatically restrict the scope of existing proxy access. Parental proxy access may be reinstated if, after discussion with the parent(s) requesting access, the child’s GP believes that proxy access would be in the child’s best interest.
4. From 11–16, a parent with proxy access will be able to manage certain elements of the young person’s record, such as demographic data, and make appointments and order repeat prescriptions, but they will not be able to see the young person’s past appointments or clinical record. Practices need to be aware that there may be some risk from the parent being able to see the current prescription record.
5. On the young persons’ 16th birthday, the systems will switch off all the remaining proxy access except where the young person is competent and has given explicit consent to the access.

On the child’s 11th birthday, GP computer systems will automatically restrict the scope of existing proxy access.

Parental proxy access may be reinstated if, after discussion with the parent(s) requesting access, the child’s GP believes that proxy access would be in the child’s best interest.

From 11–16, a parent with proxy access will be able to manage certain elements of the young person’s record, such as demographic data, and make appointments and order repeat prescriptions, but they will not be able to see the young person’s past appointments or clinical record.

Practices need to be aware that there may be some risk from the parent being able to see the current prescription record.

Best Practice: The Child needs to be interviewed and codes added for them to give them permission for access to the childs record – (example a 14 year old child may request the pill and not want the parent to know).

These are generated because the patients are requesting additional services via the account management menu i.e. are asking for additional services to be added to their access

1. Retrieve Patient Record
2. Click Administration Tree
3. Click Patient Details
4. Record Contact Details (Telephone Symbol)
5. Ensure preferred contact method is either set to Email or SMS at the top of the screen
6. Save Patient Record

Yes, practice can run a search for Patient Online Services in EMIS-WEB

Yes, there are two different tasks types :-

1. Task type: SystmOnline Repeat Requests – These are generated by the patient requesting medication while logged in to the SystmOnline website.

2. Task type: Online Services Prescription Requests – These are generated by the patient requesting medication using the SystmOne App on an iPhone, iPAD or Android device.

A parent has proxy access to child’s record – child is under 11 so no gillick codes added to record as they do not need to be.

1. Open Childs Record
2. Click Administrative Tree Locate Online Services
3. Amend Service Access
4. Add access end date to be when child turns 11.
5. Click set full/coded record start date(s) once box open ensure radio button in show full coded Click Ok
6. Save record

Access is now permitted to the Parent for proxy access to the Childs record via Online Services

Only the mother if parents are not married, both parents if they are married.

If the parents were married and then divorced, the responsibility would be the same as for any other issues. Usually after a divorce it is shared or there is a court order. “Best Interests” decisions also apply.

When they reach 11yrs proxy access should be switched off and Gillick competency assessment should be carried out.

RCGP Guidance
Some practices choose a different age (dependant on population and needs – this can be set in Clinical System).

If child has severe learning disabilities and unlikely to ever become Gillick Competent then this may not apply (in these cases the parent should be setup as “carer”).

NOTE FOR TPP SYSTMONE: In order to create an online account for a child under 16, a Read Code for Gillick competence must be added to the patients record.

Where the Child is Gillick Competent and the correct read code has been added, the Child should be given their own username and password for online access and can choose whether they want their Parent to have access (A parent cannot request proxy access if child is Over 11 years old).

Parent can request proxy access if child is not Gillick competent (parental responsibility applies).

NOTE: Proxy access is currently only available in the TPP SystmOne clinical system.

Personal vouching (if the patient is known) or record vouching can be applied

No. The practice have to be sure the account details given out are given to the correct person.

Practices could give details to clinician to hand out during a consultation as they can confirm identity face-to-face.

Current guidance is to assess “regularly”.

Most practices do this annually or during consultations.

Gillick competency doesn’t just apply to patient online – it applies to all healthcare decision making.

No, the patient should remain competent unless there is a medical condition – in which case best interest decision/carer access applies.

The Gillick Competency read code is prompted for when creating account for patients under 16.

Report the issue directly to NHS Choices using the link on website stating the information that is incorrect.