5. After regulation 71, insert—
71ZA.—(1) Where a contractor holds the medical record of a registered patient (“P”) on its computerised clinical systems, the contractor must promote and offer to P the facility to access online the information from P’s medical record which is held in coded form other than—
(a)any excepted information, or
(b)any information which the contractor’s computerised clinical systems cannot separate from any free-text entry in P’s medical record.
(2) The contractor must, if its computerised clinical systems and redaction software allow, offer to P the facility to access online the information (other than any excepted information) entered onto P’s medical record on or after the relevant date (the “prospective medical record”).
(3) If P accepts an offer made under paragraph (2), the contractor must, as soon as possible, provide P with the facility to access online P’s prospective medical record.
(4) But the contractor may—
(a)delay providing the facility to P, if the contractor considers that providing P with it is likely to have an adverse impact on its provision of essential services;
(b)delay giving P online access to any information added to P’s prospective medical record after the facility is provided to P, if the contractor considers that providing P with access to that information is likely to have an adverse impact on its provision of essential services.
(5) If the contractor decides to delay providing P with access to the facility or giving P access to any information, it must notify P—
(a)of that decision (including the period for which it anticipates access will be delayed), and
(b)when the facility, or that information, becomes available.
(6) In this regulation, “relevant date” means—
(a)1st April 2020, where P became a registered patient before 1st October 2019;
(b)in any other case, 1st October 2019.
(7) For the purposes of this regulation and regulation 71ZB, information is “excepted information” if the contractor would not be required to disclose it to P in response to a request made by P in exercise of a right under Article 15 of the GDPR.
(8) For the purposes of paragraph (7), “GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018(1).
71ZB.—(1) A contractor must provide a registered patient (“P”) with the facility to access online relevant medical information if—
(a)its computerised clinical systems and redaction software allow it to do so, and
(b)P requests, in writing, that it provide that facility.
(2) In this regulation “relevant medical information” means any information entered on P’s medical record other than—
(a)any information which P can access online via a facility offered in accordance with regulation 71ZA(1) or (2), or
(b)any excepted information.”.
2018 c. 12. Section 3(10) is amended, with effect from IP completion day, by S.I. 2019/419. “IP completion day” has the meaning given in section 39(1) of the European Union (Withdrawal Agreement) Act 2020 (c. 1).