Prospective Access – November 2023 Update

The 2023/24 GP contract which has been imposed upon the profession required that practices provide automatic prospective access to GP-held patient records by 31 October 2023.

The BMA provided comprehensive guidance BMA general practitioners committee England that supported the process and encouraged practices to carry our a Data Protection Impact Assessment to explore risks and mitigations.
There has also been an open letter to the profession explaining this more. Click to download and read.

Several practices, having carried out a DPIA, do not feel that there are sufficient mitigating factors for automatic prospective access and are reviewing alternative options.

In order to uphold professional obligations and duties as data controller, some GP practices are proceeding on an ‘opt-in’ basis, actively engaging patients to secure their informed consent to receive access to prospective records.

As discussed in the earlier blog, practices can go through a series of steps to review their processes objectively with a DPIA.

GP practices that have decided on their being not enough mitigating factors (following their DPIA) should carry out the following steps as recommended by the BMA.

Here are some suggested steps practices need to go through if considering to implement an opt-in process.

A. Ensure that the DPIA based on this BMA template is complete: bma-aatr-dpia-template.docx (

B. Inform patients of prospective online access by downloading posters / screen banners / website banners from here: Access to Medical Records Resources – North East London (

C. Inform NHSE of the change in decision by emailing NHSE on

D. If your DPIA suggests an opt in model you should consider informing your Primary Care team by using this email template: sample-draft-email-to-icb-primary-care-it-team-1-2.docx (

E. If your DPIA suggests an opt in model you should consider informing your ICB by using this template letter: template-letter-to-icb.docx (
This letter refers to a roadmap for implementing an opt in process. A suggested template is here.
Furthermore, an action plan may be requested – a suggested template is here.

F. If your DPIA suggests an opt in model you should consider informing the ICO by using this template letter: template-letter-to-ico.docx (

Leave a Reply

Your email address will not be published. Required fields are marked *