Patient engagement can begin once you have agreed an approach internally. Communication with patients should reference the fact that a DPIA has been carried out. If the practice has determined that seeking opt-in from patients is the best way to ensure that access can be safely provided, this should be made clear to patients. Patients should be encouraged to communicate their preference as a matter of urgency. It may be that the practice needs to have a ‘waiting list’ to deal with the patient requests so that they can prioritise patient care.

Although it is ultimately up to individual practices to decide how best to engage patients, two examples are provided below:

•  Example of an online process can be found here
• The RCGP has provided some information on doing this here

Key considerations

Means of communication:

• Practices may wish to employ a range of approaches including SMS communications, letter writing, physical notices in waiting rooms and digital notices on the practice website and on any social media pages that the practice runs (eg Facebook).
• You may also mention the possibility of online access to records in routine consultations and during any other communications between practices and patients.
• Consideration should also be given to the resources that could be used when signposting. The following pages may be useful: Commonly found abbreviations in medical records, What you need to know about your GP Record, Seeing your medical record

Accepting requests for access

• Will you require a direct request from a patient before providing access? Do you expect to create an automated system for receiving such requests? If so, is this secure?
• If you decide you require a direct request from each patient before providing access, then we have provided a template form here that can be used.

Workload

• Do you have sufficient time allotted to have conversations about records access?
• What, if any, mitigations do the practice need to put in place to protect vulnerable patients who wish to have records access?
• Will you put in place a process for answering patients’ questions (online resources, FAQs for practice staff fielding calls, dedicated drop-in sessions for patients to ask questions, utilising patient participation groups)?
• Practice plans should reference their DPIA and should set out the reasoning for implementing any mitigations including a consent-based approach (if that is what a practice has decided).
• Plans can be shared with your local ICB team and provided to the ICO alongside the DPIA.