Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, whether non-NHS providers will be given access to data that could identify patients via the Federated Data Platform.

The primary users of the Federated Data Platform will be National Health Service hospitals, integrated care systems (ICS) and NHS England. At ICS level, the benefits of the Federated Data Platform will also be realised by local authorities, local government, and the third sector providing health and care services, although they will not access the data within the Federated Data Platform. Only private companies contracted to NHS or social care to deliver services will have access to data within the Federated Data Platform.

Only people with a need to see patient identifiable information will be able to, for example a clinician treating a patient or a theatre scheduler scheduling a procedure. Each user of the platform will only see the data required to carry out a specific task and must have the correct legal basis to do so. At a national level, no confidential patient information will be used, the data will be pseudonymised or deidentified.

Access to data in the Federated Data Platform will always be controlled by NHS organisations and will be compliant with General Data Protection Regulation and Information Governance rules. Use of data in the Federated Data Platform will be clearly auditable and assessed to ensure it meets data governance controls including compliance with legislation. Each use case will require a Data Protection Impact Assessment to articulate the data security and protection principals and lawful bases for deployment.