Medical Records

This page will cover:

Your right to see your health records
The Hampshire Health Record
Remote Consultations
Secondary uses of your medical records
Opt-out form for data sharing schemes
Secure online access to your GP medical record
Sharing information from your GP record

If you would like any further information about primary or secondary uses of your GP record, opting out, the NHS Databases, access to your medical record, confidentiality, or about any other aspect of NHS data sharing or your medical records, then please do contact the surgery’s Data Protection Officer, Laura Taw.

We provide a confidential service to all our patients, including under 16s. This means that you can tell others about a visit to the surgery, but we won’t. You can be sure that anything you discuss with any member of this practice, family doctor, nurse or receptionist will stay confidential.

Even if you are under 16 nothing will be said to anyone including parents, other family members, care workers or tutors without your permission. The only reason why we might have to consider passing on confidential information without your permission, would be to protect you or someone else from serious harm. We would always try to discuss this with you first.

If you are being treated elsewhere, for example at a hospital or clinic, it is best if you allow the doctor or nurse to inform Andover Health Centre of any treatment that you are receiving.

Confidential patient data will be shared within the health care team at the practice, including nursing staff, admin staff, secretaries and receptionists, and with other health care professionals to whom a patient is referred. Those individuals have a professional and contractual duty of confidentiality.

Confidential and identifiable information relating to patients will not be disclosed to other individuals (including NHS or CCG management staff) without their explicit consent, unless it is a matter of life and death or there is a serious risk to the health and safety of patients or it is overwhelmingly in the public interest to do so.

In these circumstances the minimum identifiable information that is essential to serve a legal purpose may be revealed to another individual who has a legal requirement to access the data for the given purpose.That individual will also have a professional and contractual duty of confidentiality. Data will otherwise be anonymised if at all possible before disclosure if this would serve the purpose for which the data is required.

We are sometimes asked to provide information for the purposes of education, audit or research or for the purposes of health care administration. In all cases the person to whom such information is released is bound by a duty of confidentiality.The information disclosed is kept to the minimum necessary for the purpose and is always anonymised if at all possible. Andover Health Centre Medical Practice is registered as a Data Controller under the General Data Protection Regulation .

Who can directly access your surgery held electronic GP medical record, if needed and if appropriate:

All our GPs and trainee doctors
All our practice nurses and nurse practitioners
All our community (district) nurses
All our midwives
All our admin team and receptionists
All our health care assistants
Our visiting medicines manager support staff
Clinical staff from Winchester Hospital A&E via data streaming
Clinical staff from Mid Hampshire Healthcare Limited (GP out-of–hours access hub) via data sharing
Support staff from EMIS (responsible for our GP software system)

Who cannot access your surgery-held electronic GP medical record without your explicit consent:

The Department of Health
NHS England
NHS Digital
Medical researchers, pharmaceutical companies, journalists

We will always try to respect your wishes if you do not wish for your data to be used in a particular way, unless to do would mean that we could not provide you with safe and effective medical care.You have the right to object to the uploading of your medical record to any or all of the NHS Databases (such as The Summary Care Record or The Hampshire Health Record).

You have the right to object to primary uses of your medical record; that is the sharing of your data with health professionals outside of the surgery for the provision of direct medical care, if you so wish.

For example, you can opt-out of the Summary Care Record and/or the Hampshire Health Record, and/or the local data sharing GP access hub with Mid Hampshire Healthcare Limited.

You have the right to object to secondary uses of your medical record; that is the sharing of your data for purposes unrelated to your direct medical care (such as health care planning, audit, research, commercial or political uses), if you so wish.

Opting out of secondary uses will prevent all such extractions of data and their processing for secondary purposes, including the Hampshire Health Record, national audits, risk stratification schemes, extraction of sick note data to the DWP, mandatory data extractions to NHS Digital, and any future secondary extractions and uses of your personal confidential data. You can opt-out of any or all of these data sharing schemes.

Opting back into data sharing

You can opt back into any or all of these schemes, at any time, if you have previously opted out. Our administration team can always tell you what you have, and have not, opted out of. Be careful opting back in to particular schemes; opting back into one scheme might automatically opt you back into another.

Your right to see your health records

A health record is any record of information relating to someone’s physical or mental health that has been made by (or on behalf of) a health professional. This could be anything from the notes made by a GP in your local surgery to results of an MRI scan or X-rays.

Health records are extremely personal and sensitive. They can be held electronically or as paper files, and are kept by a range of different health professionals both in the NHS and the private sector.

To do so, you will need to make your request in writing (or by email) to the Andover Health Centre Medical Practice. This is known as a subject access request.

We will need your name, address, DOB, and ideally an up to date contact telephone number.

You do not have to give a reason for applying for access to your health records. However, to save the NHS time and resources, it would be helpful if you would inform us, if you do not need access to your entire health record, of the periods and parts of your health records that you require, along with details which you may feel have relevance (such as a consultant name, location, diagnosis).

How can I access my records

You should receive a reply to your request within 21 days. You have the right simply to view your records, but not to receive a copy in a permanent form.

You should also be aware that in certain circumstances your right to see some details in your health records may be limited in your own interest or for other reasons (for instance, to protect the privacy of third parties).You also have the right to have information explained to you where necessary (such as medical abbreviations). We can provide you with a printout of the information requested.

Summary care record

In common with all GP surgeries, Andover Health Centre is required to extract and upload information from GP records to the national Summary Care Record (SCR) database, one of a number of NHS databases.

Your Summary Care Record will contain all medication prescribed for you in the preceding 6 months, any repeat medication issued over the preceding 18 months, and any allergies or adverse reactions to medicines. The information will potentially be available to healthcare professionals across England, for the purpose of your direct clinical care (a “primary” use of your information).

The SCR is therefore a nationally available database. The information is extracted and uploaded to NHS Digital, who is therefore the data controller for the Summary Care Record database.

Who can access the Summary Care Record

Your SCR can be accessed by the following:

Clinicians at SCAS NHS 111
A&E Departments in England & Wales

Who cannot, or does not, access the Summary Care Record

Your SCR cannot be accessed by the following:

Our community staff (district nurses, midwives and health visitors)

Our community nurses keep their own clinical record, but with your consent they can view our EMIS Web clinical system. If you do not wish to have, or continue to have, a Summary Care Record then you can opt-out at any time.

If you do opt-out, your uploaded data will be “blanked”, no one will be able to access it, and no further information about you will be uploaded from your GP record. Opting out of the Summary Care Record will also automatically prevent your medical record from being uploaded to the Hampshire Health Record and will also mean that you will not be able to be seen at the extended hours GP Access hubs in Andover or Winchester.

If you do opt-out, or if you have already opted out, then you can opt back in at any time and have a Summary Care Record created.

Further information about Summary Care Records is available from:

If you wish to opt out of the Summary Care Record then simply fill in the opt-out form in this factsheet and hand it in to the surgery. The Summary Care Record is just one way by which you can make your information available to other healthcare professionals.

Andover Health Centre uploads information from GP records to the Hampshire Health Record (now known as the Care and Health Information Exchange, CHIE).

Hampshire health record

The Hampshire Health Record (HHR) is a complicated, central database managed by NHS South, Central and West CSU (the data processor for the uploaded information).

Detailed information from your GP medical record will be extracted and uploaded to the HHR database. Andover Health Centre Medical Practice remains the data controller for the uploaded information.

Information about you from certain hospital trusts, community services, social care records and mental health services will also be extracted, uploaded to the HHR, and combined with your GP data. This combined record is then made potentially available to medical personnel across Hampshire and parts of Surrey, for your direct clinical care (a primary use of your information).

The HHR is therefore a regionally available database. Organisations currently extracting and uploading information to the HHR database:

University Hospital Southampton NHS Foundation Trust
Portsmouth Hospitals NHS Trust
Hampshire Hospitals NHS Foundation Trust (including Winchester and Basingstoke)
Solent NHS Trust
Southern Health NHS Foundation Trust
Care UK (Southampton and Portsmouth treatment centres)
Hampshire County Council
Almost all GP practices in Hampshire & IOW

All these organisations can also access your uploaded GP record. Organisations that allow processing of your uploaded data for secondary (research) purposes:

Some (but not all) GP practices
University Hospital Southampton NHS Foundation Trust
Portsmouth Hospitals NHS Trust

Organisations that do not upload to the HHR, but can nevertheless access your uploaded GP record:

South Central Ambulance Service (SCAS)
Hampshire GP out of hours (Portsmouth/Southampton etc)
North Hants Urgent Care (Basingstoke)
Portsmouth City Council
Southampton City Council

However, neither:

Salisbury District Hospital
Frimley Park Hospital
The Royal Surrey County Hospital
The Royal Berkshire Hospital
Surrey and Borders Partnership NHS Trust extract and upload information to the HHR

Neither:

Salisbury District Hospital A&E
SCAS NHS 111 use or access the HHR

Our community staff (district nurses and health visitors) have access to the HHR, though it is not used by the health visitors, and infrequently by our district nurses. Our community nurses already have full access to the GP records of our patients (through our EMIS Web clinical system) on a read only basis, one time only with your explicit consent.

GP surgeries in Hampshire do not (or very rarely) access the HHR. We already have full access to the GP record. Andover Medical Practice no longer permits the HHR to process uploaded GP information for secondary purposes.

You have the right to prohibit the upload of your information to the HHR if you wish; that is, to opt-out. If you do not wish to have a Hampshire Health Record created, or maintained for you, then you may need to opt-out:

The Hampshire Health Record is similar to, but not the same as, the Summary Care Record If you have opted out, or now opt-out, of the Summary Care Record (SCR) then you will automatically be opted out of the Hampshire Health Record. You do not need to take any further action
The Hampshire Health Record is completely unrelated to EMIS Web data streaming

If you have opted out, or now opt-out, of EMIS Web data streaming, then you will automatically be opted out of the Hampshire Health Record. You do not need to take any further action.

You cannot prohibit many of the hospitals and other trusts that are associated with the HHR from extracting and uploading information that they hold about you to the HHR. You can however opt-out of the HHR entirely by filling in the opt-out form in this booklet and handing it in to the surgery.

Opting out of the HHR entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is “blanked” or made unavailable, and that no further information is uploaded.

Opting out of the HHR entirely will also ensure that no personal confidential information about you from other organisations or trusts is stored or maintained in the HHR database.

Your GP record, hospital record, community records, mental health records and social care records remain unaffected if you opt-out. They remain, as always, available to those organisations’ clinical staff as required.

Opting out of the HHR will have no direct impact on any NHS or private organisation’s ability to offer you medical care.

Further information about The Hampshire Health Record is available from:

www.hampshirehealthrecord.info

Our (draft) Data Protection Impact Assessment (DPIA) for the HHR can be downloaded from our website. If you wish to opt out of the Hampshire Health Record then simply fill in the opt-out form in this factsheet and hand it in to the surgery.

The Hampshire Health Record is just one way by which you can make your information available to other healthcare professionals.

Remote consultations

From time to time our GP Federation manage GP services for Out of Hours and front of house A&E at Winchester Hospital. The GP that you see will be able to prescribe medication, if required at the time.

As part of this service, the GP that you see will necessarily require access to view your full GP record and permission to record that consultation directly in your GP record. These types of GP appointments are known as “remote consultations”.

Any opt-outs that you might have expressed to other types of NHS data sharing, such as the Summary Care Record, the Hampshire Health Record, or any secondary uses of your GP information, will not prevent you from making such an appointment, assuming you consent to allow temporary remote access to your GP record when you are seen.

Any accesses to your GP record for remote consultations are recorded and auditable, and are only permissible in this way if you have given your explicit consent at the time of the consultation.

Secondary uses of your medical records

Any accesses to your GP record for remote consultations are recorded and auditable, and are only permissible in this way if you have given your explicit consent at the time of the consultation.

A Type 1 opt-out will then prohibit extraction and uploading for all of the following secondary uses:

Risk stratification schemes
National clinical audits (such as the National Diabetes Audit)
The Clinical Practice Research Datalink (CPRD)
Extraction of de-identified information about you concerning any eMed3 Statement of Fitness to Work reports (i.e. sick notes), uploaded to NHS Digital, and subsequently passed by NHS Digital to the Department of Work and Pensions
All extractions and uploading of identifiable information about you to NHS. Digital, for any secondary purpose (so-called GPES extractions)

It is therefore, the single, unitary, secondary uses, opt-out. Andover Health Centre no longer permits secondary processing of GP information uploaded to the Hampshire Health Record.

Andover Health Centre extracts and uploads information to the National Diabetes Audit, uploads for risk stratification for case finding, and to the CPRD.

Secondary use objections (either Type 1 or Type 2) will in no way affect how healthcare professionals provide you with direct medical care, or prevent them accessing your medical record if and when appropriate, and with your explicit consent. Secondary uses are not about information sharing between healthcare professionals.

You can express a Type 2 opt-out as well (sometimes referred to as a 9Nu4 opt-out, after the flag added when expressed). The Type 2 opt-out acts to control information about you as held by NHS Digital.

NHS Digital holds information about you obtained from a variety of sources, such as hospital trusts, mental health services, maternity records, community records, collectively known as Hospital Episode Statistics (HES). It also holds some information from your GP record.

A Type 2 opt-out, when present in your GP record, should prevent identifiable information about you being disseminated, shared or sold, by NHS Digital, for purposes other than your direct care.

It will not prevent NHS Digital disseminating, sharing, or selling, information about you that is either effectively anonymised (i.e. cannot identify you), or aggregated (i.e. just numbers).

The 9NU4 opt-out, particularly in conjunction with an additional opt-out that you can make directly to NHS Digital is the only way that you can have any control over the way that NHS Digital handles your information.

With a Type 1 or Type 2 opt-out in force, you will still be invited to cervical screening, breast screening, bowel cancer screening, diabetic retinopathy screening, abdominal aortic aneurysm screening, and any other current or future national screening programmes, if you are eligible, the Type 1 and Type 2 opt-outs do not prevent these programmes in any way.

Nor will a Type 1 or Type 2 opt-out prevent you from taking part in medical research, with your explicit consent. Detailed factsheets about Type 1 and Type 2 opt-outs, and links to further sources of information, can be found within that site.

If you wish to opt out of secondary uses of information from your GP record, then simply fill in the opt-out form in this factsheet and hand it in to the surgery.

Data processors

Andover Health Centre uses data processors to perform certain administrative tasks for us, particularly where these involve large numbers of patients.

EMIS Health Ltd

EMIS Health hosts our electronic GP patient records database at their secure servers in Leeds. As such, they are acting as the data processor in this. You are unable to opt out of sharing your data with EMIS Health Ltd.

Docman Ltd

We have a contract with Docman Ltd to manage our incoming correspondence. Correspondence is scanned and stored on a secure server, accessible by the clinician through our clinical system. You are unable to opt out of this service.

Lexacom Ltd

We have a contract with Lexacom Ltd to manage our digital dictation. The GP dictates any letter and this is held on a secure server until the medical secretary transcribes it. You are unable to opt out of this service.

Accuro Ltd

We have a contract with Accuro Ltd to outsource transcribing. We use this service when the medical secretary is on leave or when her workload reaches a certain point. This is to reduce delays in getting letters sent. You are unable to opt out of this service.

Accurx

We have a contract with Accurx to send messages and information via text message.

Hampshire County Council

We also have a contract with Hampshire County Council (HCC) to enable them to invite patients for an NHS Health Check on our behalf. Again, we provide demographic data, plus date of birth, to HCC, who then create and post the letters of invitation out. You can opt out of having your data shared for the purposes of NHS Health Check invitations from HCC.

Clinical Practice Research Datalink

We have a contract with the Clinical Practice Research Datalink (a governmental, not-for-profit research service). We occasionally submit anonymised primary care records for public health research to them. You can opt out of having your anonymised data submitted to CPRD.

eConsult Ltd

We have a contract with eConsult Ltd to allow patients to contact the practice via an online portal. You can choose not to use this service as it is patient initiated.

Online access to your medical records

Patient Access is the name of the software module offered by GP surgeries (such as running Andover Health Centre the EMIS GP records system.

Patient Access enables you to do the following online (or via a smartphone app):

Order repeat prescriptions
Update your contact details (address, phone numbers)
Access key information from your electronic GP record securely online

You can look at www.patient.co.uk/patient-access to get an idea of what it’s like. This facility is free, both to the surgery and to patients. To apply for Patient Access, ask at reception for a registration form, or download one from our website.

Once registered, you can logon and use Patient Access on a computer, tablet or via a smartphone app, freely downloadable for Android (Google Play) and iOS (iTunes). You can potentially have access to your full electronic GP record including consultations, medication, allergies, vaccinations, GP and hospital letters, blood test results and x-ray/scan reports.

You are also able to check the results of any blood tests or x-rays requested by your GP, download them, print them off at home, take them to hospital appointments etc.

You are then able to show your GP record, if you wish, to any healthcare professional that you might see, anywhere in the world (e.g. in a GP out-of-hours centre, A&E department or hospital), directly, or by permitting secure temporary access, or by exporting your record to a secure mobile device. Whether you have these facilities enabled or not will not affect your care from the surgery, it is simply an additional benefit that is on offer.

Patient Access has absolutely nothing to do with the national NHS Databases, such as the Summary Care Record or the Hampshire Health Record, or any other secondary uses of your GP record.

Opting out of any or all of the NHS Databases does not prevent you from using Patient Access:

With Patient Access, no data is uploaded to any database, government-controlled or not
With Patient Access, the only person with access to your record via the secure website is you
With Patient Access, your GP remains the data controller for your information

The benefits of online access to your medical records

There are a number of benefits to being able to access your medical records online.

Access abroad

You may be in another country and taken ill. You may decide to allow the doctor temporary access to your records (a personal decision). All they need is access to the internet and your login details (or you login for them). When access to your record by that doctor is no longer needed, just change your password.

A&E/ Outpatients/Out of Hours GP

If you are going to see a healthcare professional in hospital you can allow them to see your records online if there is a computer in the room, or print out the relevant information and take it with you.

Relatives having access

Only if you wish you could share all your records with relatives or just part by printing the part you wish to share.

Information for forms

If you need to know when you had your immunisations, what allergies you have or major diagnoses, you can look them up.

Correcting information

You can see if there are incorrect entries in your GP record, or missing information, and speak to your GP about these.

Medication information

You can easily check information about any medication prescribed by clicking on the button listed next to your medication in the list. This also includes information on how to take the medication. You can check what results mean or check a condition. There are links to support groups, such as Diabetes UK.

Security

It’s as safe as internet banking IF you keep your passwords and security questions secure. You wouldn’t leave your bankers card and pin numbers lying around (particularly at work) and then wonder how someone managed to withdraw money from your account.

Don’t leave your passwords where they can be found. This may also include at home if you don’t want family members to view your records. Don’t use obvious ones such as names, birthdays or anniversaries etc.

Disadvantages

There are also a number of disadvantages.

Forgotten history

There may be something in your history you don’t want any family members to see. It might be information you had put to the back of your mind and are now confronted with it!

Complex information

The record is designed to be used by doctors for doctors. There will be abbreviations and technical terms. However, most patients understand most of what they read and the information buttons linked with problem titles offer detailed explanations. Please ask if you do not understand.

3rd party info

You might want to tell the doctor something about your spouse/partner/child in confidence:

If the doctor records the information and the patient then sees this it could cause problems
If the doctor doesn’t then vital information may get lost or forgotten
The information may be malicious and again cause problems

Making your medical information available

Patient Access allows you to make your medical information available to health professionals outside of our surgery, if and when you want, anywhere in the world.

You may choose:

Only to view your medical record yourself
To allow others (e.g. relatives or carers) access to it, temporarily or permanently
To allow healthcare professionals access to it, anywhere in the world, on a temporary basis
Or any combination of the above

How would this work

Allowing relatives or carers access to your medical record online via Patient Access is easy, you will simply need to give them your login details. If ever you change your mind, you can reset your password. Allowing doctors, nurses, pharmacists and other healthcare professionals access, home or abroad, is also straightforward.

Patient Access allows you to grant temporary access to your record for 24 hours via a unique link and secured using an access code.

Such access could be:

At an out-of-hours GP centre, perhaps at night, bank holidays, or at the weekends
At an A&E department
At a GP surgery in a different part of the country (if you have need to be seen there)
At a community pharmacist
During a hospital out-patient consultation with a specialist
If you are admitted to hospital for any reason
If you are taken ill abroad

Your Patient Access medical record viewer account can be accessed, either:

By yourself
By a carer/relative with you
By providing the medical staff where you attend with your login details

The address for accessing the details via the internet is www.patient.emisaccess.co.uk.

Patient Access also allows you to export your medical record and either print it off, or save it securely to a mobile device, and then take it with you to show a healthcare professional as needed. Patient Access is just one way by which you can make your medical information available to other healthcare professionals.

Sharing information from your GP record

When it comes to allowing healthcare professionals outside of the GP surgery access to your GP record, you have a number of choices.

You do not have to allow any such access – by opting out of all such schemes
You can allow nationwide access to limited information from your GP record (allergies and medication) by not opting out of the Summary Care Record
You can allow your entire GP record to be extracted, uploaded, combined with information from hospital trusts, mental health services and community services, and made available regionally – by not opting out of the Hampshire Health Record
You can control access to your GP record, completely and personally, by allowing temporary secure online access to your GP record – should you have chosen to enable this (i.e. opted in) In theory, your information is available to healthcare professionals worldwide, should you allow it in any given situation
If you have enabled secure online access for your GP record, then you can export your record and either print it off or save it securely on a mobile device, and then take it with you to show a healthcare professional when needed
You can choose to share information in many other ways – for example, medical alert cards (such as MediPal, Steroid alert cards, Biological therapy cards, rare diseases cards, even bus pass cards), medical alert jewellery (such as MedicAlert, SOS Talisman), Zaptag, Tap2Tag and EIO smart cards
You can also choose personal health apps such as Evergreen Life or SiKL, and the Apple iPhone emergency Medical ID feature You can have any combination of the above, opting out of any particular data sharing schemes, and/or opting in to any that you wish to