A citizen’s GP health record contains rich information compared with any other health records, due to the central role of general practice in citizens’ life-long interactions with the health system. As such, it contains very sensitive personal information. It is universally agreed that access to it should be carefully controlled.

The General Data Protection Regulation (GDPR) gives individuals the right to access their own health records. They get access through a formal request to the practice, and the information passed over is a snapshot taken at that point in time.

Online access for citizens to a summary of their health record on an ongoing basis has been possible for some time. This gives citizens basic information about their:

  • conditions or diagnoses
  • medications
  • allergies
  • immunisations
  • test results
  • values (for example, blood pressure)
  • basic information about procedures, referrals and consultations
  • demographic

Varied health record access

Citizens can request this online access to their summary records from their practice. Individual practices can also choose to proactively make this access available to registered citizens on an individual or wider basis. Only three of the practices we interviewed had done so. This is an example of citizen access that varies across Wales.

Interviews with practice staff and those with an interest in GP services outlined potential challenges and benefits of providing online records access in some form to all citizens.

Challenges included:

  • the GP is legally responsible for the data and carries the risk of any data breaches
  • screening a full health record to redact any information they should not share places an administrative burden on GPs
  • deciding who should have access to the health record and under what circumstances is challenging
  • individuals contacting their practice to query or dispute record entries may increase demand
  • the contents of a record may lead to citizens making complaints or taking legal action
  • individuals may access information that causes them significant distress
  • those in coercive relationships may come to greater harm if the abusive partner gains access to the health record and finds the abuse has been disclosed to a health professional

Benefits included:

  • the information is about the individual and should be available to them on principle
  • access to health records can support individuals to take a more proactive role in their own health and care, which supports the primary care model for Wales
  • the potential for individuals to choose with whom they share information, giving them more control and improving health outcomes where another professional does not have access and having it would mean safer, more efficient care.
  • reduced demand on GP surgeries, for example due to individuals checking test results, vaccine records or medication histories for themselves
  • allowing individuals to spot errors in their own records, which may have affected the care they receive, insurance cover or job opportunities

Just three practices involved in this study had switched on summary records access for all their registered patients. These practices had not observed any additional demand or other drawbacks by switching on record sharing. However, they acknowledged that citizens’ awareness of the access was minimal, and they were not clear how many patients were making use of it.

Ambivalence about records

We asked citizen participants if they were interested in seeing their medical records, but there was a general sense of ambivalence about it. Though they felt it sensible to know their health history, they had misgivings about seeing anything surprising or that made them question their GP’s openness.

We did not ask directly about awareness of GDPR and patients’ rights to see data held about them, but three participants’ answers indicated an awareness of rights and compliance gained through their work.

Asked about ownership of health records, citizens firmly took the view that practices have the responsibility to maintain, store and safeguard their records. They felt that other health professionals involved in their care – such as dentists, pharmacists, optometrists and physiotherapists – should be able to access strictly relevant information from their records on a case-by-case basis. They expected to be informed about any requests by third parties to access their records.