This site is intended for health professionals only

At the heart of general practice since 1960

pul jul aug2020 cover 80x101px
Read the latest issue online

Independents' Day

As a data controller, am I responsible for changes made to records via the NHS Care Record?

As data controller under the Data Protection Act for my patients records, am I responsible for changes written to that data base made electronically (without my knowledge) from other NHS entities via the spine?

Do I still bear responsibility for the entire record as data controller or do I only have data controller responsibilities for those parts of the record entered by my practice? An example might be incorrect medical information is written to the spine by the hospital and I am unaware of this action, the information is now on my database. The patient then presents to OOH and an action is taken on the incorrect information. As the information is held on my database and I am data controller, who bears responsibility for the data. It may be that when information is written by other NHS entities, we, as GPs may have to accept or decline that information - I am not sure. Or it might be that with the inception of the spine I no longer become controller of the record and the secretary of state for Health becomes the controller of the record.

Ask the expert: Andrew Lockhart-Mirams, partner at Lockharts Solicitors Ask the expert: Andrew Lockhart-Mirams, partner at Lockharts Solicitors

Rate this article 

Click to rate

  • 1 star out of 5
  • 2 stars out of 5
  • 3 stars out of 5
  • 4 stars out of 5
  • 5 stars out of 5

0 out of 5 stars

Have your say