Proxy Access

Before proxy access ordering of medication for care home staff can be set up, the care home must have a secure email system (preferably the NHSmail system). Further information about NHS Mail is available here

How proxy access works

Proxy access was developed to allow someone other than the patient to access and manage parts of their GP online services account. The proxy is given their own online access account (rather than using the patient’s login details). It is typically used by the parents of young children and recognised carers of adults.


GP practices can set up proxy access to repeat medications only, meaning that care home staff can’t see anything else in the record. If, however, a resident does not want care home staff to have proxy access to any part of their record, including repeat medication, the care home must continue using a paper-based process.


When staff in the care home are given proxy access by the GP practice, they can:


  • order repeat prescriptions
  • include a note to the GP.


Adding a note to the GP practice may be particularly useful when an item is marked on the GP system as needing to be reviewed with the patient. Overdue medication reviews may cause delays when a care home proxy access process is first put in place but becomes less of an issue over time


Audit Trails

An audit trail is kept in the GP system when a proxy accesses a patient’s record. For repeat prescriptions It records:


  • who accessed the record and when
  • what medication was ordered
  • who authorised or rejected the request and when.



Protecting patient privacy

It is essential that resident/patient privacy is respected and protected. To reduce the risk of a breach of privacy or confidentiality there must it is important that:


  • a data sharing agreement between the care home and the GP practice has been agreed
  • all authorised care home staff are up to date with information governance (IG) training and IG requirements
  • a process is in place to manage any breach of confidentiality or misuse of proxy access.


The Royal College of General Practitioners (RCGP) has developed guidance for GP online services. There is a section on proxy access issues and the safeguards that might be helpful.

Other things you can do with GP online services

As well as ordering medication, GP online services can give access to a resident/patient’s medical record, test results, hospital and other correspondence, and appointment booking/cancelling.



A carer’s access to these other elements can have benefits for patients, such as better communication between different care providers. There are, however, security and confidentiality risks that need to be considered from a patient, GP, and care home point of view before any level of proxy access is set up. These are discussed in the RCGP guidance section on proxy access issues and safeguards.

The Data Security Protection Toolkit (DSPT)

Having Proxy Access will transform the way you provide care but it does mean that your data protection policies and procedures need to be robust


One of the ways you can do this is by completing the Data Security Protection Toolkit (DSPT)


The Data Security and Protection Tool Kit (DSPT) is an Online Assessment which all Care Providers who work with and access NHS patient data and systems (including NHS Mail) must complete annually.


It is a condition of using Proxy Access that you have successfully completed the DSPT to Standards Met level


The tool kit covers such areas as your privacy and data protection policies, how you store and backup data, how you secure mobile devices, business continuity in the event of a cyber incident and how you manage your IT security and support.


Successful completion of the DSPT is also a requirement to access NHS Mail and  Proxy Access,


The West Midlands Care Association is part of a FREE national program - Better Security Better Care - to assist all CQC registered care providers with this.


To find our what you need to do next, just click on the button below.

Better Security Better Care

What do I do next?

Proxy Access is  being rolled out in different stages in different areas.  In the first instance talk to your contacts in the ICB as to whether it is about to be implemented


If your ICB has already begun it's roll out and you need to set up a NHS Mail address then click here to find out more information on how we can help you do that

Share by: