Patient online services: provision of online access to coded information in medical record and prospective medical records
5.—(1) For regulation 71ZA substitute—
“Patient online services: provision of online access to coded information in medical record and prospective medical records
71ZA.—(1) Where the contractor holds the medical record of a registered patient (“P”) on its computerised clinical systems, the contractor must—
(a)provide P with the facility to access online information entered onto P’s medical record on or after the relevant date (the “prospective medical record”); and
(b)promote and offer to P, in accordance with paragraph (2), the facility to access online the information from P’s medical record held in coded form.
(2) For the purposes of paragraph (1)(b), the contractor is taken to be—
(a)promoting the facility to P where P is encouraged to utilise the practice’s digital services and to interact with the practice via online access;
(b)offering the facility to P where it is freely available to P if P shows interest in the facility or requests access in writing to their medical records held in coded form.
(3) Where a person (“R”) applies to become a registered patient of the contractor, the contractor must, as part of the registration process—
(a)make information available to R about the practice’s digital services and about how R may interact with the practice via online access; and
(b)inform R in writing that on becoming a registered patient, R will be provided with the facility to access R’s prospective medical record (unless R chooses not to be provided with that facility).
(4) The contractor must configure its computerised clinical systems so as to allow its registered patients the facility to access online information entered onto their medical record.
(5) In this regulation, “relevant date” means—
(a)if the contractor has not provided P with the facility to access online P’s prospective medical record under this regulation as in force immediately before 15th May 2023, the day on which the contractor does provide the facility under paragraph (1)(a); or
(b)31st October 2023,
whichever is the earlier.
(6) Where—
(a)the contractor has not, before 15th May 2023, provided P with the facility to access online P’s prospective medical record; and
(b)P makes a request in writing to the contractor on or after 15th May 2023 but before 31st October 2023, to be provided with that facility,
the contractor must provide that facility to P by the end of the compliance period or by 31st October 2023 whichever is the earlier.
(7) Where—
(a)the contractor has not, before 1st November 2023, for whatever reason, provided P with the facility to access online P’s prospective medical record; and
(b)P makes a request in writing to the contractor on or after 31st October 2023 to be provided with that facility,
the contractor must provide P with that facility by the end of the compliance period.
(8) Subject to paragraph (9), the contractor must not remove the facility of a registered patient to access online their medical record provided under—
(a)this regulation as in force immediately before 15th May 2023; or
(b)paragraph (1).
(9) Nothing in this regulation requires the contractor to provide P with the facility to access—
(a)online information entered onto the medical record where that information is excepted information;
(b)online information entered onto P’s prospective medical record where P has informed the contractor that they do not, or no longer, wish to be provided with that facility; or
(c)information referred to in paragraph (1)(b) which the contractor’s computerised systems cannot separate from any free-text entry in P’s medical record.
(10) For the purposes of this regulation and regulation 71ZB—
(a)“the compliance period” means the period specified in Article 12 of the UK GDPR for compliance with a request made in exercise of a right under Article 15 of the UK GDPR;
(b)information is “excepted information” if the contractor would not be required to disclose it in response to a request made in exercise of a right under Article 15 of the UK GDPR.
(11) For the purposes of paragraph (10), “UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018(1).”.
2018 c. 12. Section 3(10) is amended, with effect from IP completion day, by S.I. 2019/419. “IP completion day” has the meaning given in section 39(1) of the European Union (Withdrawal Agreement) Act 2020 (c. 1).