Accelerated Access to Records

Part of the Government’s imposed 2023/24 GP contract in England, included practices contractually obliged to provide patients with online prospective access to their records. Practices’ contracts require them to abide by this from 31 October 2023.

The LMC has become aware that the ICB is writing to those practices that made an appropriate decision to use an ‘opt-in’ approach to try and force them into turning on access for everyone. If this affects your practice, please read this section.

This prospective online access includes the following for all patients:

  • the coded record and any associated free text
  • records of consultations along with any associated free text
  • test results
  • all documents

Legally, GPs must act in the interests of their patients and as data controllers look to mitigate data protection risks. Practices are required to carry out a Data Protection Impact Assessment (DPIA) exploring the risks and any possible mitigations as part of the implementation of this programme. The requirement to comply with appropriate legislation is included in the GP contract, and this will always take primacy over any contractual term.
The BMA’s General Practitioners Committee England (GPCE) are supportive of patients having access to their records as long as this is safe for patients and safe for GPs.

GPC England continues to put forward the case for making access to records on an opt-in basis. The risks include:

  • Harm to patients through the exposure to upsetting investigation results, consultation entries, documents or a serious diagnosis without adequate preparation or an opportunity for the GP (or hospital doctor) to counsel the patient in a supportive environment.
  • Inadequate redaction software provision leading to pressure to over or under redact third-party data or material that may cause serious harm.
  • Risks to patients in abusive relationships with access being gained to their medical record by coercive partners or other family members.
  • Patients seeing third party confidential data.
  • Workload implications of rolling the project out at what is a very busy time in general practice with no additional workforce or funding in place to help support this.
  • Patients being given access with no warning when some may not even want that access.

If your practice undertook a DPIA and identified risks that you cannot mitigate against then the DPA requires you NOT to implement the contractual requirement.

In this case you should be promoting an opt-in approach and informing your patients how they can apply which could include information via your website, posters in the waiting room, and targeted text messages.

We discussed this at the LMC Board meeting and resolved that as there has been no change in data protection legislation, risks, and that the BMA guidance is extant3, that the LMC will continue to support practices who follow the BMA guidance.

For information, suggestions, advice or support please contact the LMC.

Additional guidance:

Last Updated on 24 January 2025