GPC England (GPCE) voted to accept the 2025/26 contract changes related to GP Connect: Update Record on the condition that it was safe and fit for purpose before 1 October 2025.
Given deep seated concerns around the functionality of this system, GPCE continued to engage in regular rounds of meetings with DHSC and NHSE between March and September 2025 to press hard for necessary safeguards and functionality improvements.
These safeguards include implementation of information model to ensure that any parties submitting information to the GP record via this functionality do so in line with existing technical practices in place in general practice including adherence to and use of SNOMED. As well as the development and implementation of a broader policy & technical model to underpin the ongoing operation of the update record functionality in such a way as to ensure it reflects new and emerging concerns and issues as they come about.
GPC England is therefore now in dispute with DHSC and NHSE over these requirements, as well as changes related to online consultations and the lack of progress on GMS renewal and investment. Read more about the dispute.
What you need to do to comply with the 1 October 2025 GP Connect: Update Record contract change
- Practices must enable the ‘Update record’ functionality to comply with their contractual obligations.
- Any incoming GP Connect: Update Record messages will need review by practices as part of their normal workflow reviews.
- Take great care before accepting any of the suggested coded entries into the medical record as there may be implications for ongoing care.
Practices are reminded that pharmacies potentially miscoded around 15,000 pregnancy statuses in the first half of this year, which are still being worked through and checked by pharmacies, and many of these flowed into GP records via GP Connect: Update Record.
What is the 'GP Connect: Update Record' functionality?
GP Connect: Update Record is a functionality built into your clinical platform that allows third parties to send coded and free-text information for direct incorporation into the GP-held patient record. Under the contractual changes in place since 1 October 2025, practices are now required to allow other healthcare providers (beginning with community pharmacists) to make use of this provision.
As with any information submitted, GPs will be required to check and accept this information before it becomes part of the record. They will need to ensure the coded entries are appropriate and do not leave the clinical system flagging concerns about the patient, e.g. a blood pressure out of target, without addressing these.
GPs as data controllers
GP practices are data controllers for the information they hold about their patients, have overall control of the data and decide how and why data is to be processed. These are legal obligations,
which is why we know you take developments over data, in particular coded data, being added to the patient record so seriously.
GP Connect: Access Record ‘Structured view'
Another aspect of GP Connect is the functionality that allows third parties to read the GP record for the purposes of direct care. The ‘HTML view option’ has been in operation for a number of years but the contract now requires practices to enable the ‘Structured view’, which will allow coded data (and hence a more information-rich resource) to flow out from the GP record to be ingested and interpreted by third-party clinical systems to guide treatment pathways.
Many practices already have this turned on but there has been no drive to increase the numbers due to a lack of third-party clinical systems able to use the structured flow. In principle, the outgoing flow of data for direct care, be it in human-readable form (rendered HTML) or coded form, can help with appropriate care, but it leaves the GP as data controller exposed to risk of data breaches, e.g. from accidentally misfiled data being exposed, or from causing patient harm from the inadvertent release of clinical information in an inappropriate setting, e.g. results given out by a third party before the GP has been able to speak to the patient.
As more and more third parties come online with GP Connect clients the risk of a breach, or harm, occurring increases. There is also the very real issue of inappropriate access from rogue operators, which, given the lack of patient-accessible audit trails, will likely go unnoticed and damage patient trust should it occur and be later discovered. GPCE remains concerned about the extent of the flows and how they fit with Caldicott principles, given all records from birth onwards are accessible via GP Connect: Access Record.