We are providing patients using the NHS Wales App the ability to access their GP health records, up to their detailed coded GP health records. (This is exactly the same as My Health Online).
Practices should already have Summary Care Records (SCRs) enabled for all patients as standard. This is shown in the practice global settings, or EMAS Manager.
GP practices are encouraged to promote and offer patient access through the App to information from their detailed coded records (DCRs). The practice should have a process in place for handling DCR requests.
Some points to consider include:
When switching on Investigations at a Patient level, be mindful of the way results are displayed to patients within their account.
Due to the way these are managed in the clinical system, a delay of 72 hours is in place before results are visible via the App, giving a Practice time to process and file laboratory results. All remaining configurable options can be considered for activation including:
Practice staff should be aware:
If your practice uses EMIS, your staff should also be aware that:
NHS Wales recommends that documents and any option capable of displaying free text should not be activated at a Practice or Patient level at this time. All remaining configurable options can be considered for activation at a Practice and Patient Level.
While enabling patients to view their medical records through the NHS Wales App will be beneficial to most patients, there may be challenges for a minority, particularly where access to information could cause serious mental or physical harm to the patient or a third party.
The importance of safeguarding patients or any third party who may be affected by making information available from any harm is paramount. It may be appropriate to redact specific information entered into the GP medical record or prevent the patient from having access.
A vulnerable patient’s record may contain information that may cause them physical or mental harm and the patient must not see.
In some circumstances there may be safeguarding plans in place and known to the practice. You should consider switching off access to parts of the record where you consider a patient vulnerable to coercion, where giving access to the record to them is likely to cause harm to their physical or mental health or that of others. This functionality already exists in general practice systems.
There may be other circumstances where, in the opinion of the GP practice, access to information from detailed coded records would not be in the patient's best interest.
For example:
Certain sensitive situations may require a more considered approach to access. Some information can be considered particularly sensitive.
Here are some examples:
As the NHS Wales App uses NHS login, most patients can get access to the GP online services available through the App without the practice having any involvement.
If patients do not already have a GP online services account, when they create one online, they will get the practice's default level of access to these services. Generally, that means they can book appointments and request repeat prescriptions as well as their Summary Care Record.
Guidance on coercion and other considerations can be found in RCGP guidance on GP online services
To prevent a patient from having access to the default services, you will need to adjust the settings within their patient record online services details in your clinical system.
If you need to revoke patient access to appointment booking or record access, it is important to do it within the individual patient's online account settings. If you simply delete their whole online access account, a new one will automatically be created the next time they use the NHS Wales App.
You may be concerned about conflict with a patient when you make the decision to restrict or deny their access.
Where a patient is refused access or given significantly restricted access, consider whether a face-to-face discussion between the clinician and the patient is necessary. Early involvement and transparency with the patient can help to avoid conflict and complaints.
In response to safeguarding concerns, the Royal College of General Practitioners is updating its GP Online Services toolkit, in collaboration with safeguarding experts. This will cover situations where concerns may arise, and the steps clinicians could take to mitigate these risks.
The GP Practice will be the Controller of Personal Data processed in relation to the delivery of GP services provided by the NHS Wales App within the meaning of the UK General Data Protection Regulation and the Data Protection Act 2018. The practice will therefore have overall responsibility for ensuring that all data processing is undertaken in accordance with the Act.
Policies and procedures used by the GP practice for offering patients access to their Detailed Coded Medical Record should be approved by the Data Controller before the service is implemented by the practice.
Practices should:
You can check standards against the Welsh Information Governance Toolkit self-assessment tool.