NHS Connecting for Health, in partnership with the Medical Protection Society (MPS), have developed this set of frequently asked questions to support clinicians as they begin the implementation of Summary Care Records. You can download a printable version (PDF, 52kb) too.

Generating the Summary Care Record

1.  What happens if the information available is not accurate or up to date; whose responsibility should it be to check this?

If a person makes an inaccurate record, there may be responsibility on their part.  It makes no difference whether the record is paper or electronic. NHS healthcare staff are usually entitled to rely on clinical records but would be expected to be alert to potential inconsistencies.

2.  Who is liable if the information in the SCR is factually incorrect? What is my liability if I act on information?

Just as with manual records, NHS healthcare staff are generally entitled to rely on the clinical notes. Liability for an erroneous entry would usually lie with the person who made the entry, unless there was an obvious discrepancy which should have been picked up by anyone reading the record. In some circumstances, where the information is of particular importance, and easy to check (for example, a drug allergy), there might be an expectation that the clinician check the position with the patient.

3.  Who is liable if a practice uploads a SCR for a patient when they had previously expressed a wish to dissent for example, where there is a delay in processing the opt-out form?

GP practices can only act on the information available to them. It would be extremely unlikely that a practice would be criticised for uploading an SCR if they were unaware of the patient's decision to opt out. If however the GP practice had failed to process the information according to the agreed protocols then they may be accountable and subject to a complaint.

The permission to view model provides an additional safeguard to patients in that staff will ask the patient for permission to view their record before anyone has accessed it. This gives patients who wish to dissent a further opportunity to opt out of having a SCR. The opt-out process will be possible at any site where their permission to view is sought.

4.  In the case where a parent wishes to dissent on behalf of a 'Gillick' competent child or an adult dissents on behalf of another vulnerable adult – GPs often feel that having an SCR would be in the best interest of the child or vulnerable adult. GPs feel uncomfortable about overruling this dissent – is there any guidance on this?

A competent adult is entitled to make their own decision, even if this might appear foolish or unwise to others, providing they have given sufficient information to make an informed decision. Such a refusal should be respected. Where the patient is an incompetent adult then the provisions of the Mental Capacity Act 2005 (or adults with incapacity (Scotland) Act 2000 in Scotland) will apply.

A competent child is entitled to agree to an SCR, and an informed decision of this sort should be respected. Where the child lacks competence and a parent wishes to dissent then they should not generally be prevented from using the available controls to safeguard the child's confidentiality, including dissent to the creation of an SCR. However, there may be specific circumstances where a clinician feels that the best interests of the child concerned may justify the creation of an SCR and he/she is not persuaded by the arguments made to support dissent.

The individual making the request must be informed of this decision and it should be made clear that dissent to having an SCR is a choice that is provided at the discretion of the NHS and does not constitute a legal right.

5.  As a GP, what happens to SCR if I fail to use my Smartcard during patient encounters?

Smartcards are an essential part of the SCR. If you fail to use your Smartcard during patient encounters, then updated patient information will not be sent to the Spine. This could mean that NHS healthcare staff using the SCR will not have timely, relevant information about your patient. This could adversely impact on the care your patient receives and they could be put at risk as a result.

Viewing the Summary Care Record

6.  In the 'permission to view' model when can I use the emergency access option?

If the patient is not able to give permission to view their record then the member of NHS healthcare staff should act in the patient's best interest. 

NHS healthcare staff are accountable for their actions to their professional bodies as part of their code of conduct as in other clinical work they undertake. The member of NHS healthcare staff will use the emergency button to access the record, which raises an alert to the privacy officer as well as being recorded in the audit trail. The ability to access the record without permission should be given only to NHS healthcare staff who are accountable to their professional bodies. Good practice would be to seek permission from the patient once they have regained the capacity to do so.

7.  In 'permission to view', with telephone triage what happens if the caller is: consulting on behalf of another adult such as a person is too ill to come to the phone or a parent consulting by telephone on behalf of a child?

The position is the same as with manual records if a third party came on the telephone to discuss the case. The member of NHS healthcare staff should apply exactly the same criteria. Caution always has to used where a third party is involved to ensure that either there is proper permission from the patient to whom the record refers, or that the person speaking has some other form of authority, or that it is a genuine emergency, in which case the member of NHS healthcare staff should act in the patient's best interests.

8.  Is it appropriate to ask permission when the patient is ill and /or vulnerable? Is that valid permission?

The question is whether the patient is in fact competent. It must not be assumed that an ill and/or vulnerable patient is in some way "incompetent". To suggest that, would undermine the whole principle of informed consent for treatment. If the patient is competent then their permission should be sought in the usual way. If they are incompetent then the clinician should act in the patient's best interests.

9.  How do I judge whether a patient lacks capacity to consent to access to the SCR, and what is in their best interests?

NHS healthcare staff must have regard for the criteria set out in the Mental Capacity Act 2005 in England and Wales, and the Adults with Incapacity (Scotland) Act 2000 in Scotland

10.  What is my liability if I access a patient's SCR on behalf of another member of NHS healthcare staff who has a legitimate reason for looking at the SCR? For example, an out of hours (OOH) member of NHS healthcare staff without access to SCR, telephones A&E who do have access, and requests information held in an SCR.

The position is the same as with manual records. The member of NHS healthcare staff must confirm the caller's identity and check that the patient has given permission, or if they are unable to do so, that access is necessary in the patient's best interests, using the emergency access button.

11.  What is my liability if I decide not to view a patient's SCR to whom I am delivering care in cases where they don't come to harm; where they do come to harm; and when they subsequently complain?

This position is the same as with manual records. If a member of NHS healthcare staff decides not to view a patient's records (where of course he has permission to do so) then, were the patient to come to harm or subsequently complain because of an issue that arose as a result, in general it might be quite difficult to defend the case. He would have to justify not looking, though it would depend to a certain extent on the facts. For example, not looking at the records then failing to pick up an obvious drug allergy clearly recorded in the SCR, would be very difficult to justify.

12. What is my liability if I fail to view an SCR for other reasons: including reasons beyond my control like an IT failure, and reasons within my control such as a forgotten Smartcard – do I need to record this?

The position is the same as with manual records. If notes have been lost or are inaccessible (for example through IT failure) the member of NHS healthcare staff cannot be held responsible, though they might take more care over details of the past medical history in such circumstances.

Any failure to access the SCR should be documented. Lack of time to read the records would be subject to the same principle as a member of NHS healthcare staff claiming lack of time to read the manual records, and, depending on the circumstances, could be difficult to justify. Smartcards should be used responsibly. Forgetting the card is within the member of NHS healthcare staffs control, just as forgetting to take paper records on a patient visit. Each case is dependant upon the individual facts.

13.  Am I liable in any way if the patient declines to give me permission to view their SCR and they come to harm? 

This question will depend upon the circumstances of the case. The important point is that the patient's refusal must be documented in the local record. The nature and extent of the conversation that has taken place prior to the refusal is important in an individual case.   

14.  If the patient brings in part of their manual paper record when they come to see me do I need to access their SCR?

The SCR will potentially hold further information relating to the patient. It would be sensible to seek permission in each case in any event as the SCR may hold important information in addition to the limited information such as a repeat prescription slip that they have brought in. 

15.  What is my liability if I act on information in the SCR that is later proved to be inaccurate, eg incorrect allergy, incorrect diagnosis?

The position is the same as with manual records. It would depend upon the facts of the case and whether the member of NHS healthcare staffs decision was reasonable in the circumstances. SCRs are date stamped so it is clear when the information was last updated.

16.  What is my liability if I act on information in the SCR that is not timely, eg information that is two months out of date?

The position is the same as with manual records. It would depend upon the facts of the case and whether the member of NHS healthcare staffs decision was reasonable in the circumstances. SCRs are date stamped so it is clear when the information was last updated.

General questions

17.  Permission will be recorded using the IT system; is this sufficient recording of the permission?

Best endeavours are made to ensure patients/public aware of the SCR. NHS healthcare staff will ask the patient for permission to view the record every time. This provides an additional safeguard. There is a full audit trail of the clinician's confirmation that they have permission granted. This is available to privacy officers and, on request, to patients.

18.  Who is liable if a patient's record is accessed inappropriately and what action must be taken?

A member of NHS healthcare staff who has acted inappropriately is responsible for their own actions. If however he or she is an employee, then there may be responsibility on the part of the employer on the basis of vicarious liability.

Similarly if the employer had inadequate procedures or protocols in place then they might find themselves responsible. It is also the case that, if a member of staff had for example left their Smartcard lying around or had left the system logged in so that inappropriate access of the system was made, they could be held responsible. It is important that GP practices have clear and robust procedures in place and that staff are aware of and comply with them. Failure to do so could leave the employee subject to disciplinary action by their employer.

19.  What is the minimum practice need to do to make sure patient is aware that they have a SCR?

Every patient aged 16+ in participating areas is written as part of the Public Information Programme outlining the changes and choices available to them. This is managed by the primary care trust (PCT). In addition to this, the GP practice may wish to display posters, provide information leaflets, or they may also wish to direct patients to PALS or the NHS Care Records Service Information Line 0845 603 8510.

The public information programme campaign is not solely dependent on the letter as detailed above. Best endeavours are made to ensure all patients/public is aware of the SCR. An NHS healthcare staff training programme will be provided at the practice to ensure NHS healthcare staff are able to assist with patient queries. 

20.  What is the minimum that a practice needs to do to make sure patients are aware that they have uploaded records, in particular for children under 16 and children as they reach their 16th birthday?

The PCT is responsible for ensuring that patients and the public have information about the SCR. The GP practice should display relevant posters and leaflets in their waiting areas. Ensuring adults understand their rights and how the health service works applies to all aspects of citizenship and is being incorporated into personal, social and health education (PSHE) within schools. PCTs are exploring how to ensure teenagers understand the SCR programme through the use of video and other materials.

21.  Where a patient wants to have an SCR but the GP practice that they are registered with does not want to take part in the programme, where does the patient stand?

There is no obligation for NHS healthcare staff to take part in the process at present. It could be the case that if GP practices embrace the SCR in sufficient numbers, it will be harder and harder for individual GP practices to "opt out" of the process as it becomes the established "norm". The patient may wish to discuss their preference with the GP practice or consider registering with a participating GP practice. It is important that the GP practice explains to the patient that they are not participating in the SCR programme and that the patient has the option of registering elsewhere if they wish.

22.  Is there a problem if a GP practice enters a 93C3 code (opt out) into a patient's records without their knowledge?

The impact for the patient of having been 'opted out' without their knowledge is that they might suffer harm as they attend for care in due course and there is no information on their SCR. The consequences for the GP practice are potentially very serious since this may be dishonest conduct. It is also not in the patient's interest.

The General Medical Council (GMC) gives advice to NHS healthcare staff in its booklet, Good Medical Practice and supporting documents.

The following comments are based on advice NHS Connecting For Health (NHS CFH) have received from the GMC.

Good Medical Practice places considerable weight the honesty of NHS healthcare staff, including in writing or signing documents such as medical records. Good Medical Practice also explains that serious or persistent failure to follow the guidance will put NHS healthcare staffs registration at risk.

Evidence that a member of NHS healthcare staff has entered data in patients' records which they know not to be true, or that they have deliberately or carelessly misled or deceived patients about their rights or options for care, would raise questions about a member of NHS healthcare staffs registration. If harm to a patient had arisen as a result of misleading or false information in records, this would also be taken into account in considering the member of NHS healthcare staffs conduct.

23.  Where a patient has an SCR created, then some time later the patient decides that they do not want to have an SCR, what responsibility would the GP need to take for the 'backup' or 'ghost' records that would remain on the spine?

The data controller for the information would not be the GP and therefore responsibility would not rest with the individual GP or GP practice. Archive information is kept for medico-legal reasons, as a matter of record in case clinical decisions were based on the content. However there is no clinical information available for routine clinical care.

24.  What are my responsibilities around Smartcards?

When you apply for a Smartcard you complete and sign a RA01 form. By signing this form, you are committed to supporting a number of key obligations relating to your use of the Smartcard and the NHS Care Records Service applications. Specifically you acknowledge that you will keep your Smartcard private and secure and that you will not permit anybody else to use it or any session established with NHS computer systems and services.

You will not share your passcodes with any other user. You will not make any electronic or written copies of your passcodes (this includes function keys). You will take all reasonable steps to ensure that you always leave your workstation secure when you are not using it by removing your Smartcard. If you lose your Smartcard or if you suspect that it has been stolen or used by a third party you must report this to your local Registration Authority as soon as possible.

Furthermore, you agree that you will only use your Smartcard, NHS computer systems and services and all patient data, in accordance with the NHS Confidentiality Code of Practice (as available on the www.dh.gov.uk site) and (where applicable) in accordance with your contract of employment or contract of provision for service (whichever is appropriate) and with any instructions relating to the NHS Care Records Service applications which are notified to you.

25.  Is the SCR used for the Secondary Uses Service (SUS) for research data?

There are no plans to include SCR as a source feed for the SUS. This is because all content that is viewed through SCR is secondary and originates from another primary source which is a more appropriate source to target. The only primary data in SCR is patient entered data through HealthSpace; that data is inappropriate for SUS.

26.  If a patient opts out after the records have been uploaded what happens to their records?

Once the records are on the system they may have been relied on for clinical judgement. If something goes wrong the patient might not be able to show that they were given poor advice, care or treatment and equally the member of NHS healthcare staff might not be able to show that they did provide good advice, for example on the side effects of drugs. The record may also need to be preserved to make sense of subsequent treatment or care decisions. The record is archived and will not be available for routine clinical care.

27.  If a patient opts out after the records have been uploaded and wants to have their record deleted, will this be possible?

Yes, wherever possible. In the event that an SCR has been accessed, or should have been accessed, as part of someone's healthcare, the record needs to be kept, though not accessible for care, in case there was a subsequent investigation of the performance of a member of NHS healthcare staff or a dispute about the facts.

28.  Does the GMC recommend getting explicit consent from patients before uploading records to the SCR?

The following comments are based on advice NHS CFH have received from the GMC.

The GMC shares the broadly-held understanding of the law – that is, that there is no legal requirement to gain a patient's explicit consent before up-loading data to the SCR. It is our view that patients have the right (albeit qualified in some cases) to control how identifiable information about themselves is disclosed or accessed, but have no right to determine the form or place in which that information is stored.

The revised consent model enables patients to consider and agree to data being accessed from the SCR for clinical as well as other purposes and is thus consistent with our guidance. For example, in paragraph 10 of GMC advice Confidentiality: Protecting and Providing Information (2004) we discuss sharing information within the healthcare team or with others providing care, on an 'implied consent' basis, but making clear that objections to disclosures within teams must be respected.

Paragraph 16 of the GMC advice Confidentiality: Protecting and Providing Information (2004) is intended to deal with wider administrative/management issues which are not directly necessary for supporting an individual patient's care.