Compliance and governance requirements

Organisations using GP Connect must meet governance, assurance and clinical safety requirements before accessing patient information. These requirements help ensure that GP Connect is used safely, securely and only for permitted purposes.

Consumer systems are tested for compliance with GP Connect specifications and a technical conformance certificate is issued when testing is complete and the product is technically ready. The vehicle for this process is the Supplier Conformance Activities List (SCAL).

More details of the consumer assurance process can be found on our consumer portal.

It is the consuming organisation's responsibility to ensure that the consumer system is fit for its intended use and that any risks in undertaking the implementation are mitigated. NHS England does not impose any specific testing other than that undertaken to meet the elements of the SCAL. Any system-specific questions should be directed to the consumer supplier.

To complete the assurance process and before going live, the connecting party will be required to sign a Connection Agreement. This agreement outlines the responsibilities, obligations and terms of use for the consumers. The Connection Agreement covers other NHS England products, so you may already have signed a copy from another integration. If you have, you will be required to sign again to agree to the GP Connect terms. You can see a draft copy at Operations. A bespoke copy will be provided by your assurance lead during the assurance process.

Systems which are already assured as a GP Connect Consumer are listed. 

As part of accepting a GP Connect integration into their current system or deploying a new system with GP Connect capabilities, the consumer organisation must remain compliant with Clinical risk management standard DCB0160, which ensures the system's clinical safety.  As part of the obligation to comply with DCB0160 the consumer organisation should appoint a Clinical Safety Officer who must:

• review the consumer supplier's clinical safety case report and hazard log, and have accepted and mitigated any relevant clinical risks
• establish their own clinical safety case report and hazard log in readiness for the implementation of GP Connect, making sure any relevant clinical risks and mitigations passed from the supplier have been included

Read more about the clinical risk management standards.

An overview of the process follows. More detailed information can be found on our consumer portal.

GP Connect for providers

Providing access to patient records via GP Connect is mandated for all GP practices in England.

Accordingly, it is also mandated for GP software suppliers as part of the GP IT Futures framework, and will be mandated as part of the upcoming Digital Services for Integrated Care framework that replaces it.

GP Connect for consumers

Using GP Connect to access GP records from other care settings isn't usually mandated, however:

• it might be mandated by specific commercial frameworks
• even if not mandated, it is strongly recommended as it can help improve patient outcomes

Organisations can have access to relevant information in GP patient records to provide direct care to patients only.

No other use of patient information via GP Connect (such as planning or research) is permitted under the conditions of the legal direction for GP Connect: Establishment of systems: digital interoperability platform 2019.

To be granted access to GP patient records organisations must:

• comply with the terms, obligations and requirements of the NHS Digital Connection Agreement and/or End User Acceptable Use Policy 
• agree to the terms of the National Data Sharing Arrangement for GP Connect
• use an IT system which has been assured by NHS England for the use of GP Connect

The use of GP Connect for indirect care or purposes beyond individual care is prohibited except in relation to the sharing of information for the medical examiners use case (see below).  

• Privacy notice
  Information about personal data, processing and privacy responsibilities
• Transparency notice
  Information for patients about how GP Connect is used
• National Data Sharing Arrangement (NDSA)
  Data sharing requirements and application guidance

Organisations using GP Connect may need to complete privacy, information governance and clinical safety assessments as part of their governance activities. Guidance and supporting documentation are available in the GP Connect impact assessment.

• Impact assessment
  Assessment requirements and supporting guidance

Healthcare providers are legally obliged to provide medical examiners with medical records relating to deceased individuals for the purposes of reviewing a death. As these individuals are deceased, they are not covered by UK GDPR - however, there are still obligations under the Common Law Duty of Confidentiality. 

Medical examiners have a legal right to access the records of deceased patients and there is a legal obligation for healthcare providers to provide the records to medical examiners under the Access to Health Records Act 1990. As such, the duty of confidentiality is overridden.

To support medical examiners, we have updated the GP Connect Data Protection Impact Assessment (DPIA) and National Data Sharing Arrangement (NDSA), and adjusted our transparency.

A GP Connect update is available for medical examiners to enable access to review the deceased patient's record within 28 days after the patient's death. Suppliers wishing to update systems to provide support for medical examiners to review the deceased patient's GP-registered clinical record within 28 days after the patient's death, should submit a use case: Direct Care APIs use case submission form - NHS England Digital.

If you are a medical examiner who wants to have access to GP Connect, you should talk to your IT lead or system supplier and get them to submit a use case. You can also view supplier progress to see which suppliers support GP Connect products

Patients can be assured that system suppliers and GP Connect users are required to adhere to a series of compliance processes. 

Patients may also use the GP Connect transparency website to find out which organisations are using GP Connect and the reasons why they have access to the data. This may also help practices or other services supporting a patient with a subject access request. 

Patients may wish to know how, where and why their data is being used through GP Connect. Your local transparency notice should cover this and you can find more information about the wording that should be used. 

• Privacy notice
  Information about personal data, processing and privacy responsibilities
• Transparency notice
  Information for patients about how GP Connect is used

Managing consent

GP Connect respects patient consent choices and will not share data if the patient has asked their GP not to. System providers have different ways of recording this. 

Sharing for direct care can easily be conflated with sharing for secondary uses. GP Connect products are intended to be solely used for direct care purposes. Personal data is not shared for any other purpose. Patients should be aware that opting out of sharing for direct care may delay subsequent treatment in other settings. Users should be able to clearly explain the potential impact opting out of sharing for direct care purposes and should check system supplier guidance on how to accurately record a patient’s sharing preferences. Supplier’s guidance should include all patients, including children.

The use of GP Connect for indirect care or purposes beyond individual care is prohibited except in relation to the sharing of information for the medical examiners use case.  

• Onboarding requirements
• Implementation and integration
• How GP Connect works