The tasks and actions which need to be completed by care homes and GP practices are described below.
Step 1. GP practice and care home data sharing agreement
The care home lead and the GP practice lead must create a high-level data sharing agreement that sets out:
- what information is going to be shared between care home, GP practice, and pharmacy where relevant, and why
- the rules around security, accuracy, use, and deletion of data
They then need to complete a local data protection impact assessment (DPIA)
The NHS Digital website gives more information, including a short video, about data sharing agreements. A DPIA and data sharing agreement template for care homes/GP practices can be downloaded and amended for local use here.
The care home must complete the Data Security and Protection Toolkit (DSPT) and reach Standards Met. They can access support with completion from the Better Security, Better Care programme. The care home must share their DSPT Standard with the GP practice lead.
All care home staff will also need to sign an agreement based on these principles (see Step 5 below).
Step 2. Care home informs residents about plans for staff to access information in their GP record online
The care home lead must tell all residents about the proposal to give authorised staff proxy access to their online GP record, and ask for their consent.
A letter must be given to all residents or sent to their representatives, explaining how this will work, and what the benefits and risks are. An information leaflet and an example of a letter to residents are available to download.
All residents should be offered a one-to-one discussion with the care home manager or lead before signing a consent form.
Step 3. Care home gets each resident’s permission
The care home lead must get signed permission from each resident (or their representative) to show that they consent to proxy access by authorised care staff. An example of a consent form can be downloaded and adapted for local use.
Each resident or their representative will need to sign a personalised form and be given a copy of it. A single form listing all residents in a home is not acceptable. Experience shows that this step can take between 2–3 weeks to complete.
The GP makes the final decision. If they have any concerns, they will not grant proxy access and will discuss this with the resident/patient.
Step 4. GP practice sets up proxy access on their system, unless already set up
Most GP practices are users of TPP and EMIS systems and already have proxy access set up for the representatives of some patients. Setting up care home staff with proxy access has one difference as explained in step 6 below.
Before proxy access can be given, each member of care staff who will be responsible and accountable for access to GP records by proxy must be set up on the GP system.
The care home lead and each member of staff must complete a form to request proxy access. An example form can be downloaded here. This form can also be used to remove access from a member of staff.
The care home lead must send completed forms to the GP practice, keeping a copy for their records.
Step 6. GP practice sets up access for care staff
The GP practice lead should:
- create separate folders on a secure shared drive for each care home
- save all forms from the care home (for requesting, and removing, access)
- set up a proxy access login for each member of care home staff
Care home staff must be set up WITHOUT an NHS number. This only needs to be done once. The GP system user guides for EMIS and TPP explain how to do this. Proxy access is not yet available to users of Microtest and Vision systems.
If care staff already have proxy access for ordering medication online, the same accounts should be used for access to other areas of the online record, as agreed locally. The TPP and EMIS user guides mentioned above explain how to change access rights for each proxy in line with what has been agreed.
Step 7. Care home sends residents’ consent forms to the GP practice
The care home lead sends signed copies of the residents’ consent forms to the GP practice lead, or their generic email inbox, as agreed locally.
Step 8. GP practice sets up proxy access for each resident
The GP practice lead should:
- scan/file the consent form into each resident’s patient record
- create a proxy access account, linking the authorised care staff to the record and for the level of access agreed
- send set-up and log-in details for each member of care staff to the secure care home email account.
Step 9. Care home staff verify their own accounts
Once the GP practice has set up proxy access, each care home staff member must complete several steps before starting to access a resident’s online GP record.
Each GP system does this slightly differently and so a set of user guides has been produced to help you get started. You can find links to these in the next section, Step 10.
Step 10. Access GP record online
As each GP system works in a slightly different way, a set of user guides is available to explain what to do to start accessing the GP record online by proxy.
View the next sections in this guide: