GP mythbuster 12: Accessing medical records during inspections

Page last updated: 12 May 2022
Organisations we regulate

We review medical records when we inspect GP and urgent care services. This is to assess the quality of care provided by the practice. It is not to assess the individual clinician.

Our powers to access medical records

We have powers under the Health and Social Care Act 2008 (the 2008 Act) to access medical records to exercise our functions. We balance these powers with responsibilities under the:

  • Data Protection Act 2018
  • Human Rights Act 1998
  • common law duty of confidentiality.

We respect and protect the privacy and dignity of patients. We maintain confidentiality of their records.

Our Code of practice on accessing confidential and personal information describes our powers to access medical records. We will look at a patient's medical records where:

  • it is necessary, and
  • intruding on that patient’s privacy is justified and proportionate.

This Code outlines the necessity test we must meet. This must be carried out before we access confidential and personal information whilst exercising our powers.

Our inspection teams always follow the Code when they access medical records during inspections of NHS GP practices and GP out-of-hours services.

National data opt-out

National data opt-out gives patients and the public more control over how their confidential patient information is used for research and planning. It follows:

The opt-out does not apply to our access to medical records. However, if a provider tells us that a patient does not want us to look at their records, we will respect their request. This is unless there is an overriding need to look at that particular record.

When we inspect

Why we look at medical records

We assess the quality of care against our key lines of enquiry (KLOEs). We corroborate this through evidence we see in medical records. We look at this evidence alongside:

  • other evidence gathered on the inspection
  • information we have from our ongoing relationship management with the provider
  • information from CQC Intelligence Model
  • information gathered before the inspection

We do not assess an individual clinician's ability. If we identify concerns about an individual clinician, we refer them to the appropriate body. For example, GMC or NMC.

What records will we review?

The types of records we may need to review will aim to answer specific KLOEs. Details below give further information about searches of the clinical system.


S3.1 Are people's individual care records, including clinical data, written and managed in a way that keeps people safe?

S4.2 Are medicines appropriately prescribed, administered and/or supplied to people in line with the relevant legislation, current national guidance or best available evidence?

E1.7 Are people told when they need to seek further help and advised what to do if their condition deteriorates?

Examples of what we may review

The clinician will check that:

  • notes are contemporaneous
  • contain enough information (including clinical findings, decisions made and actions agreed)
  • medicines are appropriately prescribed and monitored.

The sample may include records related to:

  • acute presentations
  • managing patients with long term conditions
  • the safeguarding register
  • care planning
  • referrals
  • a sample of patients on particular registers.


S3.2 Is all the information needed to deliver safe care and treatment available to relevant staff in a timely and accessible way? (This may include test and imaging results, care and risk assessments, care plans and case notes.)

Examples of what we may review

Systems for:

  • processing test results
  • reviewing letters and communications
  • out-of-hours/A&E attendances
  • safeguarding alerts
  • responding to tasks/telephone calls/online consultation requests

Check that:

  • problems lists and summaries are accurate
  • there is a past medical history with allergy status recorded and medications listed.


S4.6 Are people receiving appropriate therapeutic drug and physical health monitoring with appropriate follow-up in accordance with current national guidance or evidence?

Examples of what we may review

Search the clinical system to identify patients with particular conditions and those prescribed high risk medicines. Ensure patients records are appropriately coded in order to support the effective delivery of care.

Review a sample of patients to make sure they are accurately coded and receiving:

  • appropriate monitoring (and medicines are not prescribed when monitoring is overdue)
  • advice about their medicines
  • safety netting is in line with guidance
  • care planning and follow up where necessary.


S6.5 How effective are the arrangements to respond to relevant external safety alerts, recalls, inquiries, investigations or reviews?

Examples of what we may review

Search the clinical system to:

  • identify patients affected by patient safety alerts/alerts from the Medicines and Healthcare Products Regulatory Agency (MHRA)
  • review sample of records to make sure action has been taken


E1.1 Are people's physical, mental health and social needs holistically assessed, and is their care, treatment and support delivered in line with legislation, standards and evidence-based guidance, including NICE and other expert professional bodies, to achieve effective outcomes?

Examples of what we may review

  • a sample of individual care records/care plans/annual reviews for specific groups of patients. For example, patients with a mental health condition, frail older people, children with long term conditions
  • the carers register
  • DNACPR and ReSPECT form in place.

Process for looking at medical records

  • A clinician would usually review of information on the clinical system. This may be a GP, pharmacist or practice nurse specialist advisor. We feel it is appropriate for clinicians to lead this aspect of the inspection where possible. However, the 2008 Act does not require this.
  • How many records we look at depends on evidence we see in the practice and within medical records.
  • Our powers allow inspection teams to access people's records without their consent. There is no requirement for us to seek consent from people.
  • Processes for reviewing records online are set out below.

Additional information about searches of the clinical system

Where our inspections include the safe and effective key questions, they will usually include a review of information on a practice’s clinical system.

Access to clinical systems

During the COVID-19 pandemic, we have explored ways of working that reduce risk, and minimise the amount of time spent on site, whilst enabling us to continue regulating. We have developed processes to accommodate digital access to GP clinical systems, supported by teleconferencing/web conferencing to speak with providers. This means a specialist advisor may not always need to be on site. This reduces disruption for the practice and protects patients, practice staff and CQC staff. Searches we will usually run, as part of inspection activity, to support us to answer the KLOEs are detailed below. With consent from providers this standard set of searches can be uploaded to run on the practice system.

The following list contains examples of the search categories we are currently using. Searches are based on national guidance, good practice and MHRA safety advice. This list is not exhaustive and will be updated periodically. Each search will be subject to updating. For example, in response to new alerts or changes to guidance. Inspection teams may need to run additional searches. It should be understood that the searches are used to identify cohorts of patients from which a sample of clinical records are examined. The searches themselves do not always give definitive information about safety or quality of care in line with national guidance or best practice.

How information from the searches is used

Searches of the clinical system are part of understanding the clinical safety and effectiveness of care delivered.

These searches have been developed to support the regulatory function of CQC. They are not a substitute for good clinical governance and oversight of safe practice. We expect providers to have their own systems and processes in place. This is to ensure safe and effective care is being delivered to patients following national guidance.

Search categories

Currently these searches are only uploaded for EMIS and TPP SystmOne practices. For practices who use other clinical systems, we will generally review information on the clinical system whilst on site; providers will need to provide assurance in line with the areas set out below.

1. Monitoring of patients being prescribed Disease Modifying Antirheumatic Drugs (DMARDs). See Specialist Pharmacy Service (SPS) guidance on DMARD monitoring during COVID-19. See NICE Clinical Knowledge Summary (CKS) for DMARD monitoring

  • Methotrexate monitoring
  • Azathioprine monitoring
  • Leflunomide monitoring

2. High risk drug monitoring – NICE CKS and specific data sheet/licensing requirements

  • Lithium monitoring
  • Spironolactone and eplerenone monitoring
  • ACE inhibitor or ARB monitoring
  • Amiodarone monitoring
  • Warfarin monitoring
  • DOAC monitoring
  • Mirabegron monitoring

3. MHRA/CAS/drug safety update alerts – to ensure the provider has taken appropriate action in response to the alerts

a) Single drug alerts:

b) Combination drug alerts:

4. Potential missed diagnosis:

a) Diabetes: Repeated raised HbA1c >47 on at least two occasions and no coded diagnosis of diabetes. See NICE CKS diagnosing diabetes.

b) Chronic kidney disease (CKD) stage 3-5: Repeated reduced eGFR <60 for at least three months and no coded diagnosis of chronic kidney disease. See NICE CKD diagnosis chronic kidney disease.

5. Medicines usage:

6. Identification of all patients who have had a medicines review done in the last three months to assess quality of the review process.

We may also look at:

  • Patients who have had a Do not attempt cardiopulmonary resuscitation (DNACPR) or ReSPECT form completed in the last 2 years 
  • How patients have accessed the different types of appointments in recent months.

7. Monitoring of high risk patients with long term conditions:

  • Patients with CKD stage 4 or 5 who have not had a blood pressure reading in the last 18 months or a urea and electrolytes (U+E) test in the last 18 months
  • Patients with diabetic retinopathy with latest HbA1c >74mmol/l
  • Asthmatic patients who have been prescribed two or more courses of oral steroids in the last 12 months
  • Patients prescribed Levothyroxine in the last 2 months with no thyroid stimulating hormone (TSH) test in the last 18 months

Content and focus of the searches

  • The content and focus of the searches have been agreed by the RCGP and the BMA. They represent a reasonable approach to assessing some important features of safe and effective healthcare delivery.
  • The searches are designed to identify risk. For example in relation to drug monitoring.
  • The searches have been adapted to take account of national best practice updates to drug monitoring during the pandemic. For example, those provided by the Special Pharmacy Services (SPS).
  • During inspection it may be necessary to do additional searches
  • The searches will be regularly reviewed and updated. This will reflect changes to guidance, new alerts or areas considered to be important for additional review.

GP mythbusters:

Clearing up some common myths about our inspections of GP and out-of-hours services and sharing agreed guidance to best practice.

See all issues:

We review our mythbusters regularly. Contact us with your comments and suggestions.