GPs advised on avoiding pitfalls of online patient record access by MDU

Since 31 March this year, practices have been contractually required to offer patients in England online access to summary information from their medical records, although some practices may decide to give patients access to their whole record.

The MDU has been contacted by a number of GPs with queries about giving patients access to their records online, and has produced guidance addressing common questions.1

Queries have included whether GPs need to limit access to sensitive information, how to deal with parents' requests to access children's records and what to do if a patient challenges the accuracy of a record.

Dr Beverley Ward, MDU medico-legal adviser, said:

"Making confidential information about patients available online has logistical difficulties, and practices will need to consider how to allow patients to access information securely, while being sensitive to any information which may cause distress.

"Fortunately, there is plenty of guidance available for practices and for patients2 but there are likely to be more queries about the accuracy and contents of records once patients begin to sign up for online access. For example, GPs may need to explain any abbreviations the records contain and will need to ensure test results are reviewed and discussed with the patient before they are uploaded to the online record.

"Another area of concern is requests by parents to access children's records. For children over 16, GPs should usually get their consent before granting access to someone with parental responsibility, but for under 16s the situation is more complicated. The RCGP suggests that full access for those with parental responsibility should be automatically switched off at age 11 and a discussion arranged with the child and parents to consider the extent of ongoing access. However, the age at which a child becomes competent will vary and it will be important to keep any access by parents under regular review."

The MDU advises GPs to consider the following when allowing patients online access to their records:

• How patients' ID will be verified and how the practice will record patients with online records access.

• The need to educate patients about keeping their information or log in details secure and the implications if they share these details with others.

• How practices will identify third party information which will need to be withheld.

• When to allow access to a child's records by someone with parental responsibility.

• The need to avoid the use of abbreviations that patients may not understand.

• The importance of giving patients the opportunity to correct inaccurate or incomplete records, but not amend content simply because they find it upsetting.