Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what steps his Department is taking to ensure that the NHS Federated Data Platform delivers transparency on (a) what patient data will be made available, (b) which third-party organisations will have access, (c) how the use of data will be limited, (d) patients’ (i) rights and (ii) mechanisms for opting out and (e) what safeguards will be in place to protect confidential patient data.

NHS England has responsibility for procuring the Federated Data Platform (FDP) for use by the National Health Service. The supplier will be a data processor on behalf of NHS organisations. Each integrated care system and trust will need to determine how they will use their platform and each use case will require a Data Protection Impact Assessment to articulate the data security and protection principals and lawful bases for deployment.

The type of data will depend on the uses of the data as defined by the individual NHS organisations. It is anticipated that there will be various types of data used including anonymised, pseudonymised and in some cases identifiable data, but subject to stringent controls on access and use. Trusts will use the FDP locally to deliver direct care to patients. Only NHS organisations, and those working on their behalf, will have access to the data.

The platform will only use data to which the NHS is already able to access and use; patients will have the same rights in relation to the data in the FDP as apply to other data in use in health. The National Data Opt-Out will apply, in line with the national policy, where the platform is handling confidential patient information for planning. Such uses will be clearly identified to the public via Privacy Notices.

NHS England is procuring Privacy Enhancing Technology to ensure data is safe; this cannot be provided by the supplier of the FDP and Associated Services.