GP mythbuster 12: Accessing medical records and carrying out clinical searches

Page last updated: 23 October 2023
Organisations we regulate

When we inspect GP and urgent care services we review medical records. This is to assess the quality of care provided by the practice.

We use searches of the clinical system to help understand the clinical safety and effectiveness of care delivered. They have been developed to support our regulatory function. They are not a substitute for good clinical governance and oversight of safe practice. We expect providers to have their own systems and processes to make sure they are delivering safe and effective care to patients. This should follow national guidance.

Our powers to access medical records

The Health and Social Care Act 2008 (the 2008 Act) gives us powers to access medical records to exercise our functions. We balance these with responsibilities under the:

  • Data Protection Act 2018
  • Human Rights Act 1998
  • common law duty of confidentiality.

We respect and protect the privacy and dignity of patients. We maintain confidentiality of their records.

Our Code of practice on accessing confidential and personal information describes these powers . We will look at a patient's medical records where:

  • it is necessary

and where

  • intruding on that patient’s privacy is justified and proportionate.

This code outlines the necessity test that we must meet. We must carry out this test before we access confidential and personal information while exercising our powers.

Our inspection teams always follow the code when they access medical records during inspections of primary medical services such as:

  • NHS GP practices
  • GP out-of-hours and urgent care services
  • independent health services.

National data opt-out

National data opt-out gives people more control over how their confidential patient information is used for research and planning. It follows:

The opt-out does not apply to our access to medical records. However, if a provider tells us, we will respect a patient’s request to not to look at their records. This is unless there is an overriding need to look at that particular record.

The records we will review and how we use the information

We look at a sample of medical records to provide evidence for our assessments. We look at whether the clinician has checked:

  • notes are contemporaneous and demonstrate that staff are working within their competencies
  • records contain enough information (this includes documentation of clinical findings, investigations requested, management plans, safety netting, referrals and follow-up)
  • medicines are appropriately prescribed and monitored.

The sample may include records related to:

  • acute presentations
  • managing patients with long-term conditions
  • the safeguarding register
  • care planning
  • referrals
  • a sample of patients on particular registers.

We may look at systems for:

  • processing test results
  • reviewing, coding and processing letters and clinical communications
  • out-of-hours or emergency department attendances
  • safeguarding alerts
  • responding to tasks, telephone calls or online consultation requests promptly
  • summarising new patient records
  • reviewing correspondence about referral, advice and guidance. This is to make sure it includes enough information for others to make decisions
  • ensuring effective communication with other members of the multidisciplinary team.

This is to check that:

  • problem lists and summaries are accurate
  • there is a past medical history that records allergy status and lists medications
  • information is shared and acted on effectively to ensure the safe transfer of care
  • there are systems and processes to highlight patients who are in more vulnerable circumstances or who may need more support.

We will search the clinical system to identify:

  • patients with specific conditions
  • those prescribed medicines that need specific monitoring.

This is to check:

  • patients’ records are appropriately coded to ensure their care is delivered effectively


  • patients are being monitored appropriately to make decisions about further management. For example, referral to secondary care, or ceasing or reducing medicines where a review is overdue
  • they receive advice about their medicines and medicines reviews are in line with national guidance
  • safety netting is in line with guidance
  • long-term conditions are monitored and reviewed
  • they receive care planning and follow-up where necessary.

The search of the clinical system also helps to:

  • identify patients affected by patient safety alerts or alerts and updates from the Medicines and Healthcare products Regulatory Agency (MHRA)
  • review a sample of records to make sure the practice has taken action on the alerts.

We may also review:

a sample of individual care records, care plans, or annual reviews. These would before specific groups of patients. For example:

  • patients with a mental health condition
  • frail older people
  • children
  • patients with long-term conditions
  • patients who are in more vulnerable circumstances (this includes those where there are safeguarding concerns)
  • t patients who are on the carers register
  • do not attempt cardiopulmonary resuscitation (DNACPR) and ReSPECT forms.

We corroborate all information we have through the evidence we see in medical records. We look at this evidence alongside:

  • other evidence gathered on the inspection
  • information we have from our ongoing relationship with the provider
  • information from the data we hold and data from other sources
  • information that we hold from patients and stakeholders who tell us about their care.

We do not regulate the performance of an individual clinician. If we identify concerns about an individual, we refer them to the appropriate body.

How we look at medical records

A CQC specialist advisor, a clinician, would usually review information on the clinical system. They may be a GP, pharmacist or practice nurse specialist advisor. We feel clinicians should lead this aspect of the inspection where possible. However, the 2008 Act does not require this.

The number of records we look at depends on the evidence we see in the practice and within medical records.

Our powers allow inspection teams to access people's records without their consent so we are not required to seek consent from people.

Where our inspections include the safe and effective key questions, they will usually include a review of information on a practice’s clinical system.

How we access clinical systems

During the coronavirus (COVID-19) pandemic, we developed processes to access GP clinical systems digitally. We continue to use this approach with support by teleconference or web conference conversations with providers. This means specialist advisors do not always need to be on site and it aims to reduce disruption for the practice patients, practice staff and CQC colleagues.

We usually run searches as part of inspection activity to help us gather evidence for our assessments. This standard set of searches can be uploaded to run on practice systems. For practices using EMIS, SystmOne and Vision clinical systems, the searches are available free of charge. The practice are able to run these searches at any time.

See the Ardens CQC website to find out how to access these searches.

Content and focus of the searches

Searches are based on national guidance, good practice and safety advice from MHRA. The content and focus of the searches has been agreed by the Royal College of GPs and the British Medical Association. Searches are a reasonable way to assess some important features of safe and effective health care delivery.

The searches will be regularly reviewed and updated. This will reflect changes to guidance, new alerts or areas that are considered important for additional review. Each search will be subject to change, for example in response to new alerts or changes to guidance.

We use searches to identify cohorts of patients from which we examine a sample of clinical records.

Inspection teams may need to run additional searches during an inspection.

The searches themselves do not always give definitive information about safety or quality of care in line with national guidance or best practice.

The standard searches are designed to identify risk and allow a degree of tolerance to monitoring intervals. This means practices should not use them as their main governance process. Practices should continue to manage care on a daily basis to align with national guidance and recommended monitoring intervals.

An enhanced set of clinical searches has been developed. These can show that a practice is monitoring patients prescribed disease modifying antirheumatic drugs (DMARDs) and other specific medicines that need to be monitored:

  • in line with national guidance
  • at recommended monitoring intervals.

The business rules for these searches are on the Ardens CQC manager website . We will run these searches on inspections but will not routinely review or consider them as part of the inspection process.

Clinical searches are currently only available for practices using EMIS, TPP SystmOne and Vision. If you use other clinical systems, we will generally review information on the clinical system while we are on site.

Search categories

These are examples of the search categories we are currently using.
It is not a full list, and we will update it periodically.

You will need to provide assurance in line with the following areas:

1. Monitoring patients prescribed DMARDs See Specialist Pharmacy Service (SPS) guidance on drug monitoring

  • Azathioprine monitoring
  • Leflunomide monitoring
  • Methotrexate monitoring.

Also see NICE Clinical Knowledge Summary (CKS) for DMARD monitoring.

2. Medicines requiring monitoring: NICE CKS and specific data sheet/licensing requirements

  • ACE (angiotensin converting enzyme) inhibitor or ARB (angiotensin receptor blocker) monitoring
  • Aldosterone Antagonist monitoring in patients with heart failure
  • Amiodarone monitoring
  • Direct oral anticoagulants (DOAC) monitoring
  • Lithium monitoring
  • Metformin with eGFR less than 30
  • Warfarin monitoring.

3. MHRA/Central Alerting System (CAS)/drug safety update alerts to check provider has taken appropriate action in response

a) Single drug alerts:

b) Combination drug alerts:

4. Potential missed diagnosis:

5. Medicines usage:

  • Asthmatic patients issued more than 12 Short Acting Beta 2 Agonist (SABA) inhalers in the last 12 months. See Why asthma still kills 2014
  • Prescribing gabapentinoid medicines where review is indicated
  • Prescribing benzodiazepine and ‘Z’ drugs and where frequency of issue warrants investigation
  • Prescribing a non-steroidal anti-inflammatory drug over the age of 65 years and/ or an antiplatelet to a patient aged over 75 years without a proton pump inhibitor for gastrointestinal protection
  • Prescribing a long acting beta agonist (LABA) inhaler to an asthmatic patient (excluding COPD) in the past 6 months with no inhaled corticosteroid prescribed
  • Patients with atrial fibrillation and a recorded CHADSVASC2 score greater than or equal to:
    • 1 if male
    • 2 if female
      with no anticoagulant prescribed
  • Combined oral contraceptive pill prescribed to patients with a history of venous thromboembolism.

6. Medication review

  • Identifying all patients who have had a medicines review in the last 3 months to assess quality of the review process (all ages and over 75 years).
  • Identifying patients receiving 10 or more medicines who have no medication review recorded in the past 18 months.

7. Monitoring of high-risk patients with long-term conditions:

  • Patients with chronic kidney disease (CKD) stage 4 or 5 who have not had a urea and electrolytes (U+E) test in the last 9 months
  • Patients with diabetic retinopathy with latest HbA1c greater than 74mmol/l
  • Asthmatic patients prescribed 2 or more courses of high dose oral steroids in the last 12 months
  • Hypothyroid patients who have not had a thyroid stimulating hormone (TSH) test in the last 18 months.

8. We may also look at:

  • Patients who have had a DNACPR or ReSPECT form completed in the last 2 years
  • How patients have accessed different types of appointments in recent months.

When we inspect

We use these Regulations when we review if the practice is safe, effective, caring, responsive, and well-led. We may not look at every regulation in every assessment. If we have concerns about care and treatment, medical records or medicines management, we will use:

We will assess whether:

  • People's individual care records, including clinical data, are written and managed in a way that keeps people safe.
  • Medicines are appropriately prescribed, administered and supplied to people in line with:
    • the relevant legislation
    • current national guidance, or
    • best available evidence.
  • People are told when they need to seek further help and advised what to do if their condition deteriorates.
  • Information needed to deliver safe care and treatment is available to relevant staff in a timely and accessible way. (This may include test and imaging results, care and risk assessments, care plans and case notes.)
  • People receive appropriate therapeutic drug and physical health monitoring with appropriate follow-up in accordance with current national guidance or evidence. We’ll also check that the prescriber has reviewed this.
  • There are appropriate arrangements to respond to relevant external safety alerts, recalls, inquiries, investigations or reviews.
  • People's physical, mental health and social needs are holistically assessed. We will also check that their care, treatment and support is delivered in line with legislation, standards and evidence-based guidance from NICE and other expert professional bodies and achieves effective outcomes.

GP mythbusters