Medical Reports Policy

1. Introduction

Herne Hill Group Practice has stopped producing non-mandatory medical reports for the patients since 01/10/2017. These services fall outside of the NHS GP Contract.

This is due to lack of available GPs who are willing to work outside of their contracted NHS hours in order to provide these reports. The demand of these services was disproportionally greater than we could supply. Patients can still request access to their medical records – please refer to our Access to Medical Records Policy. 

Practice will continue to provide statutory medical reports when approached directly by:

• DWP
• Jobcentre Plus
• Police
• Army
• Adoption & Fostering Agencies
• Court
• Social Services for safeguarding reports 
• Council 
• University for Disabled Students Allowance only

The doctors are normally remunerated for these reports directly by the above agencies.

3. Examples of Non-NHS certificates, forms and reports

6. Frequently asked questions

Please refer to BMA FAQ

1.    Principles for obtaining medical information electronically from General Practitioners

• All requests must be made in accordance with an individual’s rights under relevant legislation Electronic requests must be processed in accordance with the Access to Medical Reports Act 1988 or the Access to Personal Files and Medical Reports (Northern Ireland) Order 1991, with electronic requests allowing medical practitioners to adhere to the key principles of these pieces of legislation. The key aspects include: enabling the individual to see the report, request amendment or withholding of the report, prior to sending it to the insurer, if requested by the individual; retaining copies of reports provided to the insurers for at least 6 months; and, providing a copy of the report to the individual on request within 6 months.
• An electronic process must comply with relevant legislation and be reviewed upon fundamental changes to that legislation These principles should comply with relevant legislation, in particular the key requirements of the Access to Medical Reports Act 1988 - and an individual’s rights under that Act - and the Electronic Communications Act 2000. The Principles should be reviewed if there are ever notable problems with such systems and whenever relevant legislation, regulation or regulatory guidance is updated.
• An electronic process should provide the GP with the ability to redact, amend or add sensitive personal data to an electronic report Any electronic system should provide the GP with the ability to automatically and manually redact, amend or add sensitive personal data to an electronic medical report before it is sent to an insurer, to protect GPs’ and insurers’ responsibilities as Data Controllers under the Data Protection Act 1998. A Data Controller is any person (which can mean an individual or an organisation) which determines when and how personal data is processed, and their responsibilities include ensuring that the data is accurate and that it is adequate, relevant and not excessive.
• An electronic process should be clear about what the patient is being asked to provide to the insurer The process for requesting customer consent for obtaining medical information must make it clear to the individual exactly what consent they are being asked to provide, and do so in a clear, straightforward manner.
• An electronic process must be at least as secure as, or increase the security above, the current system for obtaining medical information. The use of electronic software to obtain medical information should be at least as secure as the current system or should increase the security of obtaining medical information above that of the current system.
• An electronic process must provide an audit trail of the consent process and the data sent, making it available to all parties An electronic process should generate an audit trail that is readily available to both individual and GP. The audit trail should clearly show what consent was granted, by whom, when and why.
• An electronic process should conform to ISO/ BSI Standards or equivalent Insurers’ electronic processes for obtaining medical information should conform to the minimum ISO/BSI certification standard or demonstrate a similar level of data security in their internal processing.
• An electronic process should be compliant with ICO, GMC, and NHS Information Technology guidance and standards and all relevant data transmitted should be encrypted to NHS standards An electronic process will conform to relevant guidance provided by the Information Commissioner’s Office (ICO), General Medical Council (GMC) and will meet NHS Information Governance and Technology standards. All data transmitted through an electronic process should be encrypted to NHS standards and transported in a compliant manner.
• An electronic process should have undertaken a Privacy Impact Assessment or equivalent Any insurance company introducing an electronic process for obtaining medical information will undertake a Privacy Impact Assessment or equivalent. A completed assessment cannot be made public but an insurer should be able to confirm what impact assessment process was used.
• An electronic process must enable the Data Controller to provide information to a third party in accordance with Data Protection requirements and make clear the onward use of data The release of information must enable the Data Controller to provide information to a third party in accordance with DPA requirements and consent must be given by the patient to the onward use of data. The process should meet NHS Information Governance standards when producing the report and only permitted users should be able to generate and deliver a report.