For more general questions, here is the overview of Accurx's Information Governance and Security policies, please see our overview.
Do you have a DPIA?
As the data controller, when using Accurx, it is your responsibility to complete a DPIA. As a data processor, we cannot complete it for you. However, to be as helpful as we can, we have some DPIA templates completed where you can find all the necessary information to help complete your organisation’s DPIA.
Who has access to the patient data and what data do they have access to?
Users are authenticated by requiring: NHSmail to register for an account; TPP SystmOne or EMIS Web profiles; and, an administrator at their GP practice to approve them. This is to prevent people who do not actually and currently work at the provider organisation from accessing the Accurx system. Furthermore, patient demographic data is only pulled from either TPP SystmOne or EMIS Web principal care systems. This ensures that a user can only access data of patients registered at their practice.
What happens when patients send their data in?
When patients submit their request to the practice, they must enter their DOB, surname, forename, gender, postcode and contact details. The number the patient puts in will be sent a secure code via SMS (as part of the two-factor authentication process), and the patient is asked to enter this code into the webpage before proceeding.
If they cannot do this, they can still submit their request. If the submitted information matches a single patient on the Patient Demographic Service (PDS), the contact number submitted is consistent with that recorded on the PDS, and the patient has successfully submitted the secure code sent to their number (thereby completing the two-factor authentication process), an exact match has taken place and the patient’s request will be displayed to the practice and linked to the patient’s information/record.
If the submitted information matches a single patient but the submitted contact number does not match that on PDS, or if the submitted information and contact number do match a unique patient, but they have not successfully entered the secure code sent to the contact number listed on PDS, the request will be displayed to the practice as 'patient not found'. The practice will be prompted to verify the identity of the patient before proceeding with their request.
What happens if a patient sends a request in but their details don’t match a record?
The practice will be notified that the patient’s details have not matched to a record and the practice will be prompted to verify the identity of the patient before proceeding with their request.
If this patient is indeed not registered at that practice, the practice must manage this based on their practice policy, as well as using clinical judgment on how best to proceed. To reduce the risk, we make it mandatory for the patient to provide a valid phone number when submitting a request, so the practice can contact the patient.
How does Patient Triage prevent patients from sending in information that requires urgent medical attention?
Within Patient Triage, patients are reminded at multiple points that this should not be used for requests that warrant more urgent medical attention:
They are informed at multiple points that their message will not be read out of hours
They are informed that their request may not be read for up to 2 working days within normal working hours
They are reminded that they should seek more urgent medical help if they need a more urgent response, whether from their practice, NHS 111 or 999
We screen for “red flag symptoms” and prevent patients from submitting a request if they state that they have any of these
Upon submission, they are again prompted to seek more urgent medical attention if their condition deteriorates
Once received by the practice, messages can be marked as ‘urgent’ by the practice staff who are triaging
Ultimately, we can only minimise this risk, but we cannot remove it entirely. As such, the practice will need a protocol for how to deal with urgent requests. We suggest that the practice also reiterates this message on its website, for example:
‘Please do not use this online form for urgent or emergency requests. The submitted forms will only be read during office hours. The forms will not be read on the weekends (Saturdays and Sundays) or on bank holidays. They will not be read Monday-Friday between the hours of xxx - xxx. Please contact 111 during out-of-hours or 999 if this is an emergency.’
Is it NHS approved?
Yes. We are an approved supplier of the Digital Care Services (DCS) Catalogue and an approved supplier of the DFOCVC framework for online and video consultations. We have Data Security and Protection Toolkit assurance (ODS code: 8JT17) and have the Cyber Essentials Plus certification.