After carrying out a DPIA, you may decide that the risks associated with providing records access for all patients who have not opted out can only be adequately mitigated by the adoption of an opt-in model. Depending on your system supplier (EMIS/TPP) and whether you have ‘gone live’ there are different suggested approaches.

EMIS practices

If you have ‘gone live’ or are due to ‘go live’ soon

1. Take steps to prevent further access being granted automatically by the bulk addition of 104 codes to all patients currently without access, including those soon to turn 16. Review those who may already have been given full prospective access (if ‘go live’ has occurred) and who have an online services account, and revoke access manually until opt-in can occur. 
2. Advertise the opt-in model, encourage patients to sign up for the NHS app, and, once counselled, provision access manually for patients who request it. Manual registration letters can be printed for those unable to sign up to the NHS app.
3. Update your practice website
4. Write to your ICB to inform them of your approach

If you do not plan to ‘go live’ at this stage and wish to manually provision access

1. Ensure EMIS global settings allow for full prospective access to be given on a per patient level.
2. Advertise the opt-in model, encourage patients to sign up for the NHS app, and, once counselled, provision access manually for patients who request it. Manual registration letters can be printed for those unable to sign up to the NHS app.
3. Update your practice website
4. Write to your ICB to inform them of your approach

TPP practices

If you have already gone live

1. Ensure that in the organisation preferences (in Online Services/Patient Record Access) the check box ‘By default give prospective access to the full clinical record’ in the ‘Full Clinical Record’ section is not checked. Review those who may already have been given full prospective access and revoke access manually until opt in can occur.
2. Advertise the opt-in model, encourage patients to sign up for the NHS app, and, once counselled, provision access manually for patients who request it. Manual registration letters can be printed for those unable to sign up to the NHS app.
3. Update your practice website.
4. Write to your ICB to inform them of your approach.

If you have yet to go live

1. Ensure that in the organisation preferences (Online Services/Patient Record Access) the check box ‘By default give prospective access to the full clinical record’ in the ‘Full Clinical Record’ section is not checked.
2. Advertise the opt-in model, encourage patients to sign up for the NHS app, and, once counselled, provision access manually for patients who request it. Manual registration letters can be printed for those unable to sign up to the NHS app.
3. Update your practice website.
4. Write to your ICB to inform them of your approach.

Any patients who do not have access and who have not opted out must be provided with access, subject to practices’ ordinary duties under data protection law not to disclose third party confidential information or information which could cause harm.