records SHORTCUT Accelerated Access to Records

Accelerated Records Access

Find out about the latest data sharing initiative, otherwise known as Accelerated Access to Records, or Citizen Access to Records


This page was updated on November 3, 2023

What is Accelerated Access to Records?

This is also known, by government, rather disingenuously, as Citizen Access to Records* and also known, rather confusingly, as Online Access to Records**.

*Citizen Access to Records - disingenuous as gives impression it's all for the 'greater good' but it's not really
**Online Access to Records - confusing as patients have already had online access to records by a different but working process for some time

As part of imposed contract changes on GPs, NHS England is forcing GPs to automatically grant access to patients’ medical records through the NHS app and other online portals from October 31, 2023.

Please note, this is separate from the existing processes already in place where patients can apply for online access to their records. In this existing process, individuals apply for access, we then take a look at the record, make sure nothing untoward is taking place with either the application or contents of the record, and access is then switched on for that individual patient. This has been happening for years with no major concerns - we have no problem with patients applying for online access in this way at all, and such applications are dealt with ad hoc as they arise, but in a controlled manner.


We don't have a problem with online access. In fact, over the years, we have actively encouraged online access as a practice, and about half of our patients already have an online account with some form of access, using such access, for instance, to order repeat prescriptions.

What is happening with the imposed changes, is that wholesale access to records must be automatically switched on for all patients. GPs and GP leaders are concerned about this.


Why are GPs concerned?

The concern already expressed has largely been around the 'accelerated' bit of the process. We would argue that barely hidden agendas are also a concern. After previous abortive attempts at obtaining medical records data from GP surgeries (through the ironically named '' initiative and the confusingly named 'GPDPR' initiative), the government has now imposed a contract upon GPs where we have to switch on prospective access to records for all patients, regardless of their wishes.

The intentions are that once prospective access is fully in the bag, retrospective access will then be enforced, meaning the entire GP medical record, past, present and future becomes accessible externally, as was the original intention of the previous attempts at gaining access to medical record data.

One must therefore question the motives of government, when the GP contract is being used, quite inappropriately, to expedite a political process. So, despite well-voiced concerns about how the government has handled such initiatives in the past, it has now circumvented any consultation process with GPs and the public and instead has used the GP contract to push through its political agenda to try and get its greedy hands on your data.

Even ignoring the agenda behind this move, as GPs and the data controllers of your record, we have major problems with it:

  • The switch on is being done wholesale, that is, without any controls in place, unless we as GPs take active steps
  • Some people specifically may not want access switched on for their record (see later)
  • Records may contain extremely sensitive, identifiable or damaging information, such as details of abuse, safeguarding informatiom, terminations, sexually transmitted diseases, mental health information and other confidential data
  • Wholesale switch on risks the data falling into the wrong hands, for example, an abusive partner, a nosey relative, an estranged parent or any other person who may or could obtain access to your app or login information
  • The switch on gives no consideration for those who lack capacity due to age or medical conditions who might need a carer or other proxy to be granted access
  • Security of your data is very important to us and as the guardians of your record, we have been provided with no information on where your data actually goes once the switch on occurs
  • We have thousands of patients, and for our clinicians to check that all records are 'safe' to be switched on and accessed would take huge amounts of time away from direct patient care

You can read more about the risks in the section immediately below or skip to what we're doing about it.


What are the specific risks?

As data controllers of your record, we have a duty to safeguard your data. This duty overrides any contractual duty as a GP.

In accordance with BMA guidance, we have conducted a risk assessment on the following areas (examples):

  • Risks of misfiling and inaccuracies within patient record - mistakes do occur, but wholesale switch on may allow a third party accessing their own patient file to access data belonging to another, resulting in an inadvertent breach of data protection
  • Risks to children - child can have access to their own medical record before the age of 16 and may be vulnerable to being coerced into sharing their medical records amongst their peer group and online by social media
  • Risks to children - a Gillick-competent young person may not wish their parent(s) to continue to have access to their online medical records, for instance if they are accessing family planning advice or where they wish to disclose to the GP details of abuse within the family or elsewhere
  • Risks to children - a looked-after child may move from one legal guardian to another, there is a risk that multiple people may have access to the child’s medical records when they have no legitimate legal or practical interest in accessing those records
  • Risks to those subject to coercive control and domestic abuse - such people could be forced to disclose their medical records to their abuser who may or may not be known to the GP. Such a person may already have access to or control over their victim’s mobile phone or NHS App and would therefore automatically gain access to their prospective medical record when switch on occurs
  • Risks to those with significant mental health issues - where viewing potentially harmful medical record entries could trigger deterioration in mental health
  • Risks to those with reduced capacity - for instance, as well as those already listed above, those with dementia, significant learning disability
  • Risks of premature diagnosis - a patient may learn about a significant diagnosis by seeing their own medical records before their GP or hospital specialist has the opportunity to discuss their diagnosis, prognosis and treatment options with them; or that less serious diagnostic results or diagnoses are misunderstood by patients who use the internet or other independent sources instead of their GP
  • Risks to GP resources being expended to tackle non-clinical matters - such as time spent explaining medical terminology to patients, time spent explaining letters to patients where the GP has not been party to authoring, time spent redacting records of sensitive or harmful information - this all takes the doctor away from time that could be better spent actually seeing patients
  • Risks to data security - GPs have no control over the IT infrastructure that will host the online medical record and have not been involved in the development or testing of it. No warranties have been given by NHS England or the DHSC over the security or robustness of the IT infrastructure and there is a risk that third parties may gain access to patient records and/or make those records available online. As data controller, GPs have assumed the legal risk for the data on the medical record but have no control over the IT infrastructure upon which it is hosted - there has been mention that once switch on occurs, third party companies are used to transfer data, and that they will keep a copy of your information - we have been attempting to obtain information on the actual data flow and any third parties involved, but there is no published information, other than, ironically, 'speak to your GP'!

Are these risks overstated? Put simply, no. Other organisations and agencies, including the Information Commissioner's Office, have expressed concern:

REFUGE: Joint letter on concerns around survivors' medical records BMA and Refuge highlight medical record access concerns ICO: Data breaches put domestic abuse victims’ lives at risk MED CONFIDENTIAL: “Prospective medical records” via the NHS App

What is Ivy Grove doing about it?

After conducting our own risk assessment, we at Ivy Grove Surgery, like many other GP surgeries, have concluded that, in order to mitigate the risks, some of which are outlined above, it would be prudent to switch access on only for those patients who specifically request it (or have requested it in the past).


We have decided to take active steps to safeguard your data, and will only switch on access to records for those who ask us to, or for those who already have records access.

Basically, we're taking the 'accelerated' bit out of the equation; this gives us a chance to check your understanding and be sure that, not only access is what you specifically want, but also that access to your data is safe for you.

So, for those who have not already got online access, and for those who already have online access, but no access to records (for example, you use online access only to order repeat prescriptions), we will take steps to safeguard your data to prevent automatic switch on.

We will notify you by text and inform our Data Protection Officer, the ICB (health board) and the LMC (our local GP committee) of our response.

It might be that such a response would be considered as not being in compliance with the GP contract, notwithstanding that government imposed this contract upon GPs without agreement. Nevertheless, it is absolutely correct that our duties and responsibilities under GDPR and data controllers of your medical record take priority over what is clearly a politically motivated and significantly contentious item in a disputed contract. As an aside, but clearly relevant when considering this action of government in the context of other actions of government, at the time of writing, consultants, junior doctors and nurses remain in formal dispute with the government.

For those who already have online access, specifically including access to records, we are not going to do anything. Access will be granted automatically. But if you don't want this to happen, please see below.


What do I need to do?


As we have already taken steps to safeguard your data, you don't have to do anything. If you ever want access, just apply as you would normally, no problem.

What else you can do depends on your situation:

I don't want to do anything

For example, you're not sure and need more time to think, or you don't want the current situation to change

As indicated in the notice box above, please don't worry if you end up doing nothing. By October 31, 2023, we will have taken steps to safeguard your data, as described in the above section 'What is Ivy Grove doing about it?'. At any point in the future, if you want access, or if your situation changes to any of the other scenarios below, simply let us know, not a problem.

I don't want or need online access to records, please switch it off

For example, you are an abuse survivor and want to reduce the risk of your abuser getting their hands on your information, or you had online access to records and no longer want it

Please let us know and we will add a code to your notes to prevent records access [1290331000000103].

If you are in this group you can also respond to the text questionnaire that we will send out to all patients and decline access and this will add the correct code to your medical record to remove access.

You can also decline access by completing the form below. Please note that for obvious reasons, we will not use the contact details you supply to get in touch with you or to confirm your decision.

Fill out form to decline access to records

And don't worry, if you ever change your mind, or your circumstances change, and you then decide you want access, simply apply for an online account (go to scenario 3 below).

I don't have online access currently but do want online access to records. please switch it on

For example, you don't have an online account at all, but would like to have records access

Apply for online access in the usual manner. Please follow the directions at our online service page to register for an online account.

We will review your application and following satisfactory review, we will add a code to your notes to allow records access [1290311000000106].

Go to our page on online services


Given this issue is now very topical, we anticipate increased interest in online access, and as each application and medical record must be reviewed before access is granted, please be aware that due to demand, there may be a significant delay in the processing of your application. Applications will be reviewed in order, therefore please be patient.

I already have online access, and also want access to records, please switch it on

For example, you already have an online account but only use it for repeat prescriptions, but would like to have access to records as well

Please let us know, we will review your record and following satisfactory review, we will add a code to your notes to allow records access [1290311000000106].

I already have online access, but don't want or need access to records, please switch that bit off

For example, you already have an online account but only use it for repeat prescriptions and are quite happy to stick with this with no additional access

You don't need to do anything as we will have already prevented access to records. If you change your mind and want records access, go to scenario 4 above.

I already have online access to records, please keep it switched on

For example, you already have online access, including to records, and are happy for things to stay as they are.

As indicated above, for this group, we weren't going to do anything anyway. And you don't need to do anything. You will have access. Simply sign up and self-certify via the NHS App.

Whatevs, I'm totally not bothered about data risks, just switch it on

For example, you may or may not already have an online account, but ultimately you're not concerned about where your data goes

Please let us know and we will add a code to your notes to allow records access [1364751000000106].


Is there any more info I can look at?

Not surprisingly, for what is ultimately a political issue and not a clinical/medical issue, there is the usual promotional material, but there is actually little or no specific patient-facing or patient-facting material out there for people that would genuinely help them to gain an understanding of the issues and risks around this situation.

This is why we have made this more detailed information page to let you know some of the background to what is happening with your medical records.

The following resources come from NHS Digital itself, the government body responsible for digital technology, data and health service delivery in the NHS:

NHS Digital: Online access to GP health records NHS Digital: Briefing for charities, patient groups and voluntary organisations