The General Data Protection Regulation (GDPR) has caused disruption for GP practices since it came into law in May 2018, not least because it means practices can no longer charge patients for copies of their records.
The technical term for this process, whereby a patient (subject) requests data held on them, is a subject access request (SAR). The previous maximum charge of £50 per request was already considered inadequate because significant administrative time and effort can be involved.
A digital solution to SARs is expected in the next three years, so patients can access their own data rather than making a request to the practice. In the meantime, the new contract for 2019/20 promises £20 million in recurrent funding over the next three years to cover the increased costs associated with SARs.
Here are some tips on how to mitigate the loss of funding and minimise the time your practice spends on these requests.
A number of organisations appear to be taking advantage of the new data regulations to get a copy of medical records for free, rather than paying a fee for a medical report under AMRA (Access to Medical Records Act). A BMA survey found practices had received over a third more SARs since the GDPR came into force, with most requests from solicitors or insurers. This is a misuse of the legislation and frowned on by the Information Commissioner.
Solicitors are entitled to make a SAR on behalf of a patient, if they are acting on their client’s instructions. However, in such cases you can insist that the information is given to the patient rather than the solicitor. Many solicitors won’t like this, as it means the patient could potentially tamper with the information prior to passing it on to them. If they raise this objection, point out that the request should be made using AMRA (which is chargeable) to get a copy of the records.
Patients may make a request because they want information about a specific consultation – it’s worth asking the patient what the purpose of the request is. They may be happy with a particular letter being printed off, or a specific consultation.
Practices (GMS and PMS) have been required to offer patients online access to their medical records since April 2015. They are only required to offer access to coded entries, but can also offer access to documents and free text too. So, depending on the request, suggesting they sign up for online access may fulfil the patient’s requirements. You have to be clear that this does not include access to old paper notes (although the records will include summarised information from that time). But it should help you to divert some requests.
Many CCGs now require practices to show they are increasing their number of online service users, so offering the service when patients request records will also help your efforts to sign people up.
Of course, encouraging online access also temporarily increases workload, so you will need a streamlined and robust process for checking records. There are tools to help you redact electronic records where necessary. For example www.igpr.co.uk includes a free record screening tool which is used by around 1,500 practices. The iGPR tool is a piece of software which is installed on the PC alongside the clinical system; it downloads the patient information to a file in the form of a PDF, and checks this against a database of possible sensitive words. This include words like ‘TOP’, ‘third party’, ‘wife’, ‘abuse’; the list can be added to by a practice. For each occurrence of the word, the operator would check the entry and decide whether it needed redacting from the online record.
Of course, no piece of software is infallible. Nor is manual redaction. But if there was a third party breach, the Information Commissioner would want assurance that there was an adequate procedure in place to redact the record, and by having both human and automated redaction processes, as well as a robust procedure, the position would be more defensible.
Again, depending on why patients are making the request, they may be happy with the electronic part of their notes. This doesn’t technically fulfil all the requirements of a SAR, but so long as the patient is aware of this and satisfied with what you provide then it may suffice. Again, using a tool like iGPR to support redaction makes the process more robust. All the clinical systems offer a process for printing the patient record (which is what practices currently do when the patient is being deducted).
In the interests of saving paper and postage, you may wish to consider saving the file instead of printing it – it can be emailed directly to the patient, or saved on CD or flash drive. However, there are security considerations with these methods. You may decide that the file needs to be password protected, but a safer option is to encrypt them. Again there are tools that allow you to do this with emailed files, for example, Egress Switch is a free tool that encrypts emails and requires the recipient to register to access it.
If none of the above is suitable, you may need to provide a full copy of the electronic and Lloyd George notes. The first thing you can streamline is the process by which patients request this. Always get it in writing. Your best option is a form which makes it very clear what the patient is requesting, who they are (including proof of identity), why they are requesting the information and what the timescale is.
Some Lloyd George notes are really heavyweight. Your admin team could spend up to four hours processing a request that you are no longer able to charge for. It may be worth employing the services of a company who do the actual copying of the notes on site for you. This can be more cost efficient and if you are scarce on admin resource, it’s an extra pair of hands. For example, Scan and Collate www.scanandcollate.co.uk offer a periodic service where they attend the practice and copy notes onto a password-protected CD. They charge a call-out fee and a fee per record.
Remember the notes still need to be redacted for third party references, and you need to have a robust confidentiality agreement with the company in place and complete a Privacy Impact Assessment (PIA) for the new data flow.
You are no longer obliged to post the record to the patient free of charge, and many practices are taking a stand and insisting the patient collect the copy of the record. If the patient refuses, you could offer to post it at their expense.
Key changes around handling SARs since the GDPR came include: the reduced time frame for responding, cut from 40 days to 30 days; the abolition of charges; the requirement to provide electronic copies of records; and the increased volume of requests. One thing in our favour, however, is that we are only obliged to provide one free copy of records. So if the patient requests more than one, or makes a request shortly followed by another, you can charge a reasonable fee for an additional copy. Remember you do need to provide any new part of the records for free. So it’s important to keep good records of what has been provided in the past so you don’t have to do it free of charge again. There are many ways to do this, but a good way may be to put a code onto the patient record that shows that the patient has been provided with a full copy of their records.
Patients know that the NHS is under a lot of pressure. It is worth explaining how much it is costing the practice to provide copies of notes, and that this is money that has now been removed from another budget previously used to provide patient care. Patients may then think twice before asking for their whole records if one of the other less costly options will suffice.
Jennie Dock is Practice Manager at Hedge End Medical Centre, in Hampshire, which has a list size of just over 15,000 patients
Or, please register for a free trial to access all of the guides and unlock all features.
© Cogora 2024
