The GPC’s IT Subcommittee has received a number of queries from LMCs about the iGPR tool, which allows practices to respond to requests for patient health information electronically. The tool has been produced by Niche Health and is available to EMIS, INPS Vision and TPP SystmOne practices.
The iGPR provides an electronic process for practices to provide patient information to requesting third parties, such as insurers and solicitors. Requests can include Subject Access Requests (SARs) and GP Reports (GPRs). There are other systems that provide similar functionality.
LMCs have sought advice for practices on the use of this tool. The Joint GPC/RCGP IT is unable to ‘approve’ or ‘endorse’ third party software products, however they are able to provide the following generic advice.
Firstly, with regard to any SAR from an insurer, practices should read the BMA guidance on how to manage SARs for insurance purposes. The guidance was issued following a review by the Information Commissioner’s Office and advises practices to contact the patient where a SAR from an insurance company is received, rather than sending the full medical record direct to the insurer. A template letter is included in the guidance, which asks the patient to choose between receiving the medical record themselves (so they can decide whether to send this onto the insurance company), or to ask their insurer to seek a GP Report from the practice.
It should also be noted that when a SAR is produced, the Data Protection Act (DPA) requires certain types of data to be redacted. Any additional redaction offered by any reporting tool over and above the legally required redaction would, in the JGPITC’s view, mean that the resulting report no longer constitutes a SAR.
Where practices wish to use these tools for purposes other than an insurance company SAR, this is a matter for individual practices to decide.
Separately, practices have asked for advice on electronic patient consent, and the legal position is that electronic patient consent is acceptable. However, where there is any doubt that the patient has consented to the report, practices should check with the patient.
Please note there is no requirement for practices to use these reporting tools, and it is for practices to decide whether they receive requests through them (rejecting these requests should prompt the third party to request the information by alternative means) or whether to deactivate the tool.
If you have any questions please email GPC at firstname.lastname@example.org.
Select from the drop-down list below to view an item from our news archives.