Support organisations to use GP Connect

GP Connect products can only help people share, view, or act on information that they are already legally entitled to access but may not easily view because they are using different IT systems or set-ups.

GP Connect APIs can only be used legally for direct patient care, not for planning or research.

Direct patient care is defined as a clinical, social, or public health activity concerned with the prevention, investigation, and treatment of illness and the alleviation of suffering of individuals. It includes:

• supporting individuals’ ability to function and improve their participation in life and society
• making sure care and treatment is safe and of high quality through local audit, managing when things go wrong, and working to improve satisfaction by measuring patient outcomes

Our Direct Care APIs team manage the GP Connect programme. Their role is to:

• publish specifications for the GP Connect capability application programming interfaces (APIs) - APIs are built into provider and consumer systems and allow data to be shared between different IT systems
• provide clinical and technical assurance of provider systems against the published specifications
• provide technical assurance of consumer systems to the published specifications and publish a list of approved systems
• define processes for onboarding to use GP Connect products
• provide local implementation managers to support GP Connect projects - you can email [email protected] to find out who your local contact is
• publish information about the approved use case for each consumer system, outlining the purpose for which they have GP Connect access

You can email the GP Connect team at [email protected].

Typically GP practices, provider organisations hold the GP patient record and will be providers and data controllers of the data shared via GP Connect: Access Record products. GP Connect: Appointment Management allows appointment books to be shared between GP practices and GP Extended Access Hubs, for example.

Consumer organisations view the GP patient record shared by the provider organisation or make bookings on behalf of a patient. This could be an NHS 111 service or another GP practice offering services to patients registered at a provider practice in a primary care network (PCN) model. To meet different use cases, a single organisation can be both a provider and consumer, such as extended access working. GP system suppliers have developed both consumer and provider functionality to meet this need.

Consumer systems are tested for compliance with GP Connect specifications and a technical conformance certificate is issued when testing is complete and the product is technically ready. The vehicle for this process is the Supplier Conformance Activities List (SCAL).

More details of the consumer assurance process can be found on our consumer portal.

It is the consuming organisation's responsibility to ensure that the consumer system is fit for its intended use and that any risks in undertaking the implementation are mitigated. NHS Digital does not impose any specific testing other than that undertaken to meet the elements of the SCAL. Any system-specific questions should be directed to the consumer supplier.

As part of accepting a GP Connect integration into their current system or deploying a new system with GP Connect capabilities, the consumer organisation must remain compliant with Clinical risk management standard DCB0160, which ensures the system's clinical safety.  As part of the obligation to comply with DCB0160 the consumer organisation should appoint a Clinical Safety Officer who must:

• review the consumer's suppliers clinical safety case report and hazard log, and have accepted and mitigated any relevant clinical risks
• establish their own clinical safety case report and hazard log in readiness for the implementation of GP Connect, making sure any relevant clinical risks and mitigations passed from the supplier have been included

Read more about the clinical risk management standards.