Medical records, run by clinicians
The Medical Records Trust is a new non-profit that will hold medical records on an open standard, under the control of the clinicians who are responsible for them.
We believe that granting for-profit entities de facto control over medical records poses unacceptable operational and ethical risks. We see direct evidence that this practice drives systemic waste, compromises patient safety and significantly exacerbates health inequalities.
The problem
GPs are the data controllers for their patients' records. In law, you're in charge. In practice, the records live inside a supplier's system, and the supplier decides what the data can do, what it costs to move and what gets built on top of it. We think that's the wrong way round.
What the Trust does
The Trust provides an open-standard data layer for medical records. It holds the record in FHIR, the open standard the NHS already uses, and it looks after who can get at it.
It doesn't build clinical systems. Third-party organisations do that, on top of the Trust's data layer, for CQC-registered providers. Because the record sits with the Trust and not inside any one product, a practice can change its systems, or use several, without moving its records.
Who's in charge
The Trust will be fully controlled by its trustees. The trustees are clinicians, and the majority are GPs. That's deliberate: GPs have the most experience of the current situation, so they need to play a key part in building what replaces it.
The trustees set the rules: who can access records and why, which apps are allowed on the platform, and what the Trust charges.
How it works
Everything rests on one idea: there is a single door to the records, and the Trust keeps it.
- Apps run inside the Trust. Third-party apps are audited and deployed within the Trust's own environment. The apps come to the records; the records don't go out to the apps.
- One way to sign in. The Trust provides the sign-in, and it's the only way an app can find out who the practitioner is. Apps can't bring their own logins.
- One way to the records. Apps can't reach the records directly. Every read and every write goes through a single checkpoint, the permissions choke point, and carries the identity of the practitioner making it.
- Checked, every time. The choke point tests each request against the trustees' rules: who this person is, where they work, and whether they're allowed to see or change this record. If the answer is no, nothing comes back.
- Logged, every time. Every request, allowed or refused, is recorded against a named practitioner.
No identity, no access. Permissions and the audit log both depend on knowing who's asking, and the Trust's sign-in is the only way to establish that. An app can't quietly work round the rules, because there's no other way in.
Under the bonnet: records are stored and exchanged as FHIR. Signing in gives the app a short-lived, signed token that names the practitioner. The choke point sits in front of the FHIR interface and is the only thing with a route to the records.
How it pays for itself
The Trust funds itself with small fees on healthcare services traded on the platform. CQC-registered providers will be able to post prices for specific SNOMED-coded procedures: phlebotomy or radiology, for example. When one is ordered through the platform, the Trust takes a small fee on the transaction.
It's a non-profit, so what it earns goes back into running and improving the platform. It won't sell patient data.
The long game
The Trust's long-term mission is to advance the art of medical record keeping, for the benefit of medical practice and of patients. In time, we hope it becomes a centre of excellence for everything to do with how medical records are created and used.