Playbook, medical practice
Somebody wants into a record that is not theirs
Most account questions at a practice are not about the person typing. A parent wants to order a child's prescriptions, an adult wants to manage a parent's appointments, a carer wants to see the letters. Each of those is a proxy arrangement the practice grants deliberately, with consent and with limits. None of them is a login problem.
Why this is not the general answer
The handling pattern for account access problems holds across every trade. What follows is the part that does not.
- What is being asked for is access to another person's medical record, so the deciding factors are consent and capacity rather than whether somebody can prove they control an email address.
- Parental access to a child's record is commonly reviewed and withdrawn as the child grows older, because a young person's own confidentiality starts to apply, and it lands on a family with no warning unless the practice publishes the age.
- Online record access comes in levels, from appointments and repeat prescriptions up to coded entries and full documents, so the answer here is which level rather than yes or no.
- A clinician can restrict what is visible where seeing it could cause harm or where the record carries information about a third party, which means access can be granted and still not show everything.
How it arrives
- can i order my mums prescriptions online
- why has my access to my sons account stopped
- how do i get proxy access for my husband
- can i see my test results online
- how do i see my full record not just appointments
- my dad has dementia can i manage his appointments
What has to be indexed for this to work
| Your proxy access process, with the form and the consent step | Who applies, what the patient has to sign, what happens where somebody cannot consent for themselves, and how long it takes. This is a process document and most practices have one that never reached the website. |
|---|---|
| The age at which a child's record access is reviewed | The age you use here and what happens on the day it changes. Practices differ, families are blindsided, and one published sentence prevents a fortnight of angry calls a year. |
| The levels of online access you offer | What each level shows and how somebody moves up one. Write it as levels, because that is the shape in which access is actually granted, and a yes or no answer will be wrong for most requests. |
| The general grounds on which access may be restricted | Published in the abstract, never per patient, so somebody with a partial view understands it is a decision rather than a fault in the website. |
The reply
Managing somebody else's prescriptions or appointments online is done through proxy access, which the practice grants after a consent step rather than through an ordinary sign up [1]. Access to a child's record is reviewed as they get older, and our page gives the age we do that at and what happens then [2]. Record access comes in levels, and moving from appointments and prescriptions up to coded entries or documents is a request the practice approves. I cannot grant access, see an account or confirm anything about another person's record.
It names the arrangement instead of treating the request as a login fault, because proxy access is a real thing with a form behind it. The age review is volunteered, since a parent whose access has vanished assumes something is broken. And the levels are described so that a patient asks for the one they want rather than asking twice.
Where it stops
The trigger. The visitor asks about a specific person's record, says their access has stopped, or is arranging access for somebody who cannot consent for themselves.
Access to somebody else's record is decided by the practice and I cannot see or arrange any of it. Leave me your name, an email and what you are asking for, and the team will tell you what they need.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never confirm that a named person is registered here, or that an account exists for them.
- Never say proxy access will be granted, because it is a decision for the practice and depends on consent.
- Never explain how to see part of a record a clinician has restricted.
- Never discuss what a record contains, including whether a result has appeared on it.
Questions
- Why does the child age review cause so much trouble?
- Because access disappears without notice and the parent assumes a fault. Publishing the age, and what a young person can do to grant access themselves afterwards, converts the whole thing into something that was explained in advance.
- Can it tell a carer what access they already have?
- No. It cannot look up an account, a patient or a proxy arrangement, and confirming that somebody is a patient here would be a disclosure in itself. It describes the process and takes a message.
- Should we publish the restriction grounds?
- In general terms, yes, and never against an individual. A patient who knows restriction is a recognised decision stops filing it as a technical fault and asks the right person about it.
Keep reading
- Everything for a medical practiceAdministrative questions a practice can safely automate, the symptom questions it must never touch, and how to word the refusal.
- Handling account access problems in generalLocked out, wrong email, a colleague who left, no admin remaining. Identity cannot be checked in a widget, so explain, collect, hand over.
- Data questions at a practice arrive from patients and from organisationsPatients ask who their data is shared with; organisations send the practice assurance forms. Neither is answered by improvising.
- Four passports, one nurse and a course of injectionsTravel courses need an assessment first and doses spaced over weeks. Why four passports is not one appointment at a surgery.
- How an assistant handles appointment requests at a medical practiceSame day releases, telephone slots and who to see. What a practice assistant explains, and what it must not touch.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.