The Single Patient Record: complying is the easy half

A statutory duty can compel you to share data. It cannot make the resulting record usable — identity, organisational change, attribution and access basis decide that, and none of them is legislated for you. What commvita does, measured, and what it does not.

The change is not technical

For twenty years the answer to fragmented records has been another initiative: summary records, local and shared care records, GP Connect, record locators, and a long series of regional integration programmes. The technical building blocks have largely existed for most of that time.

What has been missing is obligation. Participation has been driven by policy, funding and goodwill, and each of those is negotiable. A statutory duty is not. If that is the direction, the significant change is not that a longitudinal record becomes possible — it already is — but that staying outside one stops being a local decision.

Complying is the easy half

A mandate can compel you to expose data, in a stated format, within a stated time. That is a delivery problem: hard, expensive, but bounded, and a supplier can be held to it.

It cannot compel the record to be usable. Four things decide that, and a statute can require none of them, because each is a property of how the underlying systems were built.

The four, and what each actually costs you

1 · One person, or the record is a pile of documents

A national longitudinal record is an identity problem long before it is an integration problem. Every contributing system holds its own key, and the same person appears under several. Get this wrong and the failure is not an empty screen — it is the wrong person’s record, which is worse than no record at all.

commvita resolves a person across identifier shapes through one spine (16 endpoints · 120 database queries), and the rule that matters is what it does when it cannot be sure: an identifier claimed by more than one person resolves to nobody, and the ambiguity is reported. Two people sharing a surname and a date of birth resolve to nobody, and the clerk is told to confirm identity — because that is exactly the case a human must settle. A platform that silently picks the likelier match will be right most of the time, and the times it is wrong are the ones that reach an inquiry.

Reconciliation is reported rather than hidden: 2 endpoints · 8 database queries exposes the records that could not be keyed to a person, so the gap is countable instead of invisible.

2 · The record must outlive the organisations in it

This is the one most often missed. A national record aggregated from provider systems has to answer questions about care delivered by organisations that have since merged, split or closed — and English commissioning bodies have been abolished and replaced twice in a decade.

If organisational structure is a column on a row, every reorganisation is a data migration and every historic figure silently changes underneath the people relying on it. commvita models structure as an effective-dated graph (13 endpoints · 92 database queries): a merge or a split is a recorded event carrying its authorising instrument, predecessors are closed and never deleted, and any aggregate must declare whether it is stated as it was or restated. Both are legitimate — one for accountability, the other for trend continuity — and a figure that does not say which is indistinguishable from the other at the point somebody quotes it.

3 · Every element must name who contributed it

A clinician reading an aggregated record needs to know whether an allergy came from the GP system, a discharge summary or a social care assessment, because the three carry different weight and different currency. Aggregation without attribution produces a document that looks authoritative and cannot be challenged.

commvita attributes by source across settings (7 endpoints · 49 database queries for the cross-organisation record; 18 endpoints · 97 database queries for the person’s own longitudinal view), and publishes a register stating, per surface, whether the figures shown are drawn from the record or are demonstration data. The register is generated from the page source rather than maintained by hand, so a surface cannot claim to show live data while fetching none.

4 · The access question gets harder, not easier

Widening who can see a record narrows the margin for error on why. An SPR does not remove the legitimate-relationship question; it makes it the central one, and it puts it in front of an information governance reviewer who will ask to see the evidence rather than the policy.

commvita carries a hash-chained access log re-verified on every read, a Caldicott review queue for non-direct-care purposes, and role-based access resolved through the organisation spine rather than a hand-maintained list of codes — so a person’s scope follows the structure instead of going stale when a practice moves.

The sharpest example is the secondary-use opt-out. commvita does not merely record it: the objector set is enforced on the extract path, so a person who has objected is excluded before any row is returned, the number excluded is reported so the denominator is not silently misstated, and an objection that cannot be resolved to a person is reported rather than matched to a convenient record. A choice that is stored and ignored is worse than one never offered, and on a national record it would be worse still.

What is actually built, measured

Counted from the application when this page was generated. A database-query count of nought means the surface returns fixed content: that is a demonstration, and it is labelled as one.

What is not built, stated first rather than found later

Why maternity and frailty are the hard cases, not the easy ones

They are reported to be the early use cases, and the reason is sound: both span many organisations, both involve frequent transitions, and in both the cost of missing information is measured in harm rather than inconvenience.

They are also the two that will expose whichever of the four properties above a platform got wrong. A frail older person may hold a GP record, acute outpatient episodes, community nursing contacts, a social care assessment, a mental health history and a pharmacy intervention record — contributed by organisations under different controllers, some of which will have merged during the period the record covers. That is the identity problem, the organisational-change problem, the attribution problem and the access-basis problem arriving at once, about one person, in front of a clinician who has about ninety seconds.

Four questions worth asking every supplier, including us

These are deliberately answerable with evidence rather than with a roadmap.

1. When your system cannot tell which person a record belongs to, what does it do? If the answer is that it picks the best match, ask what happens when it is wrong. The safe answer is that it resolves to nobody and reports it.
2. When two of our organisations merge, what has to be re-keyed? If the answer involves a data migration, every historic figure is about to move.
3. Can you show me an element in the record and tell me which organisation contributed it, and when? Aggregation without attribution is a document that cannot be challenged.
4. Is the opt-out enforced, or recorded? Ask to see the code path, not the configuration screen. This one is easy to appear to do.

commvita answers the first, second and fourth with a code path, and the third for the surfaces listed above. On record-locator participation it answers no today, which is why that is named above rather than left for an implementation to discover.

The position, stated plainly