Online Patient Services for Children
Practices may get requests from patients for online access to their records from children below the age of 16 who are classed as Fraser competent. The LMC view is that the starting point is where the child is competent, then the child should decide who gets online access to their record. This could be the child only, or the child with one or both parents or individuals with parental responsibility.
Where a child is not deemed to have the capacity to consent to either their own access or that of a person with parental responsibility, then the practice can decide whether access to online records can be granted in the best interests of the child. In such circumstances, the access should only be given to someone with parental responsibility. This access should be removed when the child is judged to be capable of making their own decision.
Data Protection legislation stipulates that where an online service is directed towards and processes the data of children, then below the age of 16 (13 under the GDPR/DPA 2018), processing the data is only lawful if the holder of parental responsibility gives consent. As there is no specific guidance or case law at present giving a clear steer, patient record access is like an online service, so if the practice choose to offer the service to children, then below the age of 13 the parent must consent to the access for the child.
- Child under 13 – If access is to be granted to either parent or child, it must be with the explicit consent of a person with parental responsibility
- Child under 13 requiring access, without parental involvement, if in relation to preventative or counselling services, it can be granted if they are deemed capable of understanding.
- Child over 13 – where capable of Fraser competence it should be for the child to give consent for access to be granted.
If you have any concerns about a parental request to have access to a child’s record, particularly below the age of 13, then you should discuss with the child as they do have a right to object to how their data is processed. All consents should be explicit and documented.
GMC guidance about confidentiality in 0-18yrs
RCGP guidance may help with regard to patient access and good practice : http://www.rcgp.org.uk/clinical-and-research/practice-management-resources/health-informatics-group/~/media/Files/CIRC/Health Informatics Report.ashx
With thanks to Wessex LMCs
