Can someone from a different GP's access my medical records?

[Lelala]

just as the title says really

I am registered with a gp surgery

someone known to me works for a completely different gp surgery but seems to have knowledge of my medical information

are they able to access my medical records even though they work at a separate surgery?

I work in urgent care / walk in centre and we use System one. I can see the whole GP record for my patients plus any notes added by community teams who use the same system.
I guess I could search for anyone I wanted too but I don't because it is morally wrong and I value my job and registration.

We can't access patients details who are based at a different surgery only patients who are registered with us. Surgery staff can only access blood, urine and radiology results requested by the hospital and vice versa but the surgery can only see their patient's information.

if that was the case then we wouldn't have requests from other surgeries for information about patients who have newly registered with them and information is only sent if already showing transferred out or if we have the patient's permission if not showing transferred out yet.

Unless of course this person in the other surgery has falsely contacted the patient's current surgery pretending they are transferring out to obtain basic information.

It depends what permissions are on your smart card.

I think we are banging heads against the proverbial brick wall here.

Yes. Apologies for being a bit thick. My understanding is that if you are based in one surgery, you will be given only access to those patients, be it on systm 1 or emis. Clearly , nhs staff who work in more than one will have more access. I took the OP to mean that the person they are worried about was based in one.
As has been said other trists may act in different ways

Of course cleaner’s can’t access medication records!

What a confusing thread!

DH is a GP working at one surgery but he can access the records across all surgeries in the PCN (primary care network - roughly our local council area)

I went to the local walk in clinic that is unrelated to my GP and they had access to all my records. So going by that I’d say in my area yes it’s possible.

someone known to me works for a completely different gp surgery but seems to have knowledge of my medical information

It doesn't matter if they accessed your records or heard about them from someone else; if they work for a GP they should not be repeating anything they have found out.
You can make a complaint and ask the practice to look into how this person knows so much about your medical history. Explain that you have not given them the info, and are unhappy about the fact they have shared the info and its got back to you.

@endofthelinefinally we don't use smartcards. The GPs can only access our patient's records as well.

Considering my OH's oncologist can't see any of his GP records, including blood tests, etc., I doubt it.

Even when OH went to see a different specialist oncologist in a different hospital, the specialist one had no access to the first oncologists records, nor x-rays, scans, etc., and had to order the whole suite of tests to be done again as he said it was "easier" just to re-do them all than get the records sent from the first hospital!

Same with his orthopoedic surgeon - no access to oncology nor GP records, so had to start with a clean sheet, do full medical history, repeat x-rays etc.

Even when he's asked the nurses during his chemo infusions, they've said they had no access to test results.

His GP always denies being able to access anything at all from any of the hospitals/consultants he's been to and always has to wait for "letters" from them before they can re-refer elsewhere or issue a prescription, etc., which can take a couple of weeks and often needs chasing up.

We see no sign at all of any form of "joined up" system between different fragmented areas of the NHS in practice.

When I have attended hospital the doctors there simply tap into my GP records; the same when I have an out-of-hours telephone appointment with whichever practice is providing cover.

NHS systems are stupidly complicated and not well joined up.

The broad answer is maybe.

Most places use one of a couple of main systems (SystmOne being very common). Places that use the same system are linked and can share records but that doesn't mean they always do.

There usually needs to be sharing in / sharing out data agreements between services for them to see each others records and often patient level consent (so you have to agree on an individual level for other services to be able to access your records).

On top of that individual users (doctors, nurses, admins etc.) will have different permissions for what bits of people's records they can see.

To give a real world example. I work for a mental health trust, I can look at notes from other mental health teams in my trust, I can see GP notes only if permission has been given by the patient, I can't see any notes from general hospital but I can see if someone is in hospital and usually see discharge letters.

If I tried to go on to the record of someone who isn't currently referred into my specific team (even if they were a patient of the trust) I would get a pop up box and would have to type in the reason I was trying to access the record.

Accessing records without a clinical reason is a serious breach and would get you in a lot of trouble.

Hospital records and GP records don't join up, other than where some practices have a link to hospital lab results, or in the context of a walk in centre where a link has been set up.
EMIS and SYSTM1 provide various programmes that each practice pays for, so might vary from one surgery to another. A surgery where a community midwife or mental health nurse does clinics would have the programme that those practitioners would use. Those practitioners would probably have access to all the other surgery systems where they did clinics.
GP surgeries that use systm1 or EMIS do join up at a variety of levels of access depending on the role of the practitioner.
I am absolutely not suggesting anyone is thick, it is just that if you don't have a particular level of permissions attached to your access, you wouldn't necessarily know that your level of access is personalised to you and is probably not the same as everybody else.
The way it worked for my team in GP that use the two systems I have described (which are the biggest and most commonly used), is that:
Each staff member either based in one surgery, or peripatetic between several surgeries in a county, for example, had a smart card and a unique password. (If practices don't use smart cards I would be very surprised if they don't use passwords).
Access to the system in one or more surgeries was determined by the role of the practitioner.
In most GP practices, though possibly not all, the practice manager is the person with responsibility for checking what level of access staff should have and organising that with the IT/data control person at the appropriate senior level.
It is very common for the practice manager to also be the designated Caldicott guardian for their GP practice.
So, it is possible that a practice manager who wanted to exploit their position could do so.
It would be a sacking offence, but they would need to be found out.

As others have said, it depends upon where you live as to how and whether data is shared. You can ask your gp for an audit (FOI is different and not right thing to request) of those who have accessed your records without giving a reason.
whilst it would be illegal to inappropriately access records it could potentially happen. If you’re worried ask for an audit

It depends where you live and how far your NHS Trust has adopted GP Connect. If they have GP Connect then your GP notes are shared across the local hospitals to those involved in providing care. This won’t include cleaners but does include reception, nurses, lab technicians etc (anyone involved in delivering care). In some places it includes care homes.

You can ask for an audit of who has accessed your records but currently GP Connect is very difficult to audit and sometimes not possible.

It's possible, and if she's a Practice Manager, she likely could.

I would speak to the Practice Manager at your own surgery. If someone has been accessing your records, there'll be a record of it.

My MIL is a doctors receptionist and she works at a surgery 400 miles away from me. She told several of her friends I was pregnant before DH and I told anyone. I only found out as one of them texted DH to congratulate him. Her accessing my medical records is the only possible way she could have found out. DH convinced me to keep it quiet so she doesn’t use her job but 6 years on I am still furious about it.

That's awful! 😧

I have worked in social care so I followed this thread out of interest, expecting reassurances about the level of protection the NHS affords personal data, but it seems it is essentially down the morals of the person accessing it. Worrying.

Surely though it isn't worth the risk as any medical professional will tell you ?
This has got me worried because I know a dietitian who seemed to know a lot about my individual case. She works at another hospital but as I said, seemed to know too much. If I reported it and she had been looking, I believe she would be fired on the spot. That's how serious it is. But this thread has got me wondering just how many NHS workers do risk it.....

The GP systems can be pretty sophisticated depending on what features the practice buys from the company.
Various pop ups and security questions can be installed.
I once accidentally clicked on a patient with a similar name as my patient and immediately a pop up appeared with a warning that this wasn't my patient. So there is no excuse.

Someone trying to access your medical records would need: a smart card, system access granted by the organisation listed as owner for your data (e.g. the hospital controls access to hospital information) and consent/medical need to access the data. Medical need enables ambulance crews to check whether the summary record includes any allergies, for example. Consent enables your GP to refer you to secondary care.

(Sidebar: doctors are able to circumnavigate some of these security rules by discussing patients using terminology like "my patient, a 41 year old female with a history of thyroid under function" because it isn't actually identifying the patient.)

All patient data systems leave breadcrumbs that show who accessed what and when. It's usually a Gross Misconduct dismissal offence to access data you don't have the right to access. It may also be in breach of the relevant legislation, Computer Misuse Act or similar?

Source - I deal with NHS smart cards for a living.

If you have a concern, raise it with your practice manager and ask about their process for finding out - Subject Access Request at the minimum. They are entitled to charge you a small fee for this to cover the admin burden - around £10 maybe.

It may not be the person spreading gossip who is accessing the records, they may be receiving that info from someone else.
If thats what is happening, both of them should be sacked.

To my understanding, all Health Providers in a County can access a patients medical records from any other medical providers within the same County.

So for example, a GP based in Warwickshire could see the medical records of anyone who is receiving medical care from a Warwickshire Trust, including people who are registered at other GP practices.

However, if a GP’s patient had to be referred to a Trust in another County for specialised treatment for example, the GP would not be able to access or view the records of the patient’s hospital related care. The GP would only be able to rely on written correspondence from the other Trust.

When I was pregnant I had my baby in the neighbouring county to the one I live in (I’m on the border) and my GP had no access to any of my hospital records or correspondence as the two counties did not share the same information system as each other. It was a nightmare. So if I had blood tests taken at the hospital, my GP could not access the results etc. It definitely made things harder as I had a really complicated pregnancy and the fact
my GP and the hospital couldn’t share my
records didn’t help.

When I was pregnant with my second baby my GP did ask if I could have my baby in the same County I live in to enable both he and the hospital to be able to see and share my medical records.