The Single Patient Record: complying is the easy half

A statutory duty can compel you to share data. It can’t make the resulting record usable — identity, organisational change, attribution and access basis decide that, and none of them is legislated for you. What commvita does, measured, and what it doesn’t.

The change isn’t technical

For twenty years the answer to fragmented records has been another initiative: summary records, local and shared care records, GP Connect, record locators, and a long series of regional integration programmes. The technical building blocks have largely existed for most of that time.

What has been missing is obligation. Participation has been driven by policy, funding and goodwill, and each of those is negotiable. A statutory duty isn’t. If that’s the direction, the significant change isn’t that a longitudinal record becomes possible — it already is — but that staying outside one stops being a local decision.

Complying is the easy half

A mandate can compel you to expose data, in a stated format, within a stated time. That’s a delivery problem: hard, expensive, but bounded, and a supplier can be held to it.

It can’t compel the record to be usable. Four things decide that, and a statute can require none of them, because each is a property of how the underlying systems were built.

The four, and what each actually costs you

1 · One person, or the record is a pile of documents

A national longitudinal record is an identity problem long before it’s an integration problem. Every contributing system holds its own key, and the same person appears under several. Get this wrong and the failure isn’t an empty screen — it’s the wrong person’s record, which is worse than no record at all.

commvita resolves a person across identifier shapes through one spine (16 endpoints · 120 database queries), and the rule that matters is what it does when it can’t be sure: an identifier claimed by more than one person resolves to nobody, and the ambiguity is reported. Two people sharing a surname and a date of birth resolve to nobody, and the clerk is told to confirm identity — because that’s exactly the case a human must settle. A platform that silently picks the likelier match will be right most of the time, and the times it’s wrong are the ones that reach an inquiry.

Reconciliation is reported rather than hidden: 2 endpoints · 8 database queries exposes the records that could not be keyed to a person, so the gap is countable instead of invisible.

2 · The record must outlive the organisations in it

This is the one most often missed. A national record aggregated from provider systems has to answer questions about care delivered by organisations that have since merged, split or closed — and English commissioning bodies have been abolished and replaced twice in a decade.

If organisational structure is a column on a row, every reorganisation is a data migration and every historic figure silently changes underneath the people relying on it. commvita models structure as an effective-dated graph (13 endpoints · 92 database queries): a merge or a split is a recorded event carrying its authorising instrument, predecessors are closed and never deleted, and any aggregate must declare whether it’s stated as it was or restated. Both are legitimate — one for accountability, the other for trend continuity — and a figure that doesn’t say which is the same as the other by the time somebody quotes it.

3 · Every element must name who contributed it

A clinician reading an aggregated record needs to know whether an allergy came from the GP system, a discharge summary or a social care assessment, because the three carry different weight and different currency. Aggregation without attribution produces a document that looks authoritative and can’t be challenged.

commvita attributes by source across settings (7 endpoints · 49 database queries for the cross-organisation record; 18 endpoints · 97 database queries for the person’s own longitudinal view), and publishes a register stating, per surface, whether the figures shown are drawn from the record or are demonstration data. The register is generated from the page source instead of maintained by hand, so a surface can’t claim to show live data while fetching none.

4 · The access question gets harder, not easier

Widening who can see a record narrows the margin for error on why. An SPR doesn’t remove the legitimate-relationship question; it makes it the central one, and it puts it in front of an information governance reviewer who will ask to see the evidence instead of the policy.

commvita carries a hash-chained access log re-verified on every read, a Caldicott review queue for non-direct-care purposes, and role-based access resolved through the organisation spine instead of a hand-maintained list of codes — so a person’s scope follows the structure instead of going stale when a practice moves.

The sharpest example is the secondary-use opt-out. commvita doesn’t merely record it: the objector set is enforced on the extract path, so a person who has objected is excluded before any row is returned, the number excluded is reported so the denominator isn’t silently misstated, and an objection that can’t be resolved to a person is reported and not matched to a convenient record. A choice that’s stored and ignored is worse than one never offered, and on a national record it would be worse still.

What is actually built, measured

Counted from the application when this page was generated. A database-query count of nought means the surface returns fixed content: that’s a demonstration, and it’s labelled as one.

What is not built, stated first, not found later

Why maternity and frailty are the hard cases, not the easy ones

They’re reported to be the early use cases, and the reason is sound: both span many organisations, both involve frequent transitions, and in both the cost of missing information is measured in harm not inconvenience.

They’re also the two that will expose whichever of the four properties above a platform got wrong. A frail older person may hold a GP record, acute outpatient episodes, community nursing contacts, a social care assessment, a mental health history and a pharmacy intervention record — contributed by organisations under different controllers, some of which will have merged during the period the record covers. That’s the identity problem, the organisational-change problem, the attribution problem and the access-basis problem arriving at once, about one person, in front of a clinician who has about ninety seconds.

Four questions worth asking every supplier, including us

These are all answerable with evidence instead of with a roadmap.

1. When your system can’t tell which person a record belongs to, what does it do? If the answer is that it picks the best match, ask what happens when it’s wrong. The safe answer is that it resolves to nobody and reports it.
2. When two of our organisations merge, what has to be re-keyed? If the answer involves a data migration, every historic figure is about to move.
3. Can you show me an element in the record and tell me which organisation contributed it, and when? Aggregation without attribution is a document that can’t be challenged.
4. Is the opt-out enforced, or recorded? Ask to see the code path, not the configuration screen. This one is easy to appear to do.

commvita answers the first, second and fourth with a code path, and the third for the surfaces listed above. On record-locator participation it answers no today, which is why that’s named above and not left for an implementation to discover.

The position, stated plainly