Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what protocol is in place for NHS England and the National Cyber Security Centre to be notified if an AI system obtains NHS data without authorisation; and within what timeframe AI developers are required to report such incidents.

NHS England and the Department recognise the emerging cyber security risks associated with increasingly capable and autonomous artificial intelligence (AI) agents. National teams continue to assess and respond to emerging cyber risks that may affect health and care organisations, and National Health Service organisations are required to meet the requirements set out in the Data Security and Protection Toolkit (DSPT).

In line with the DSPT, NHS organisations are required to have arrangements in place to identify, manage, and report data security incidents to NHS England, the Department, and the Information Commissioner’s Office, including any instance where an AI system gained unauthorised access to NHS data. Where a personal data breach is notifiable, organisations must report it within 72 hours.

The NHS Terms and Conditions require suppliers to inform their NHS customers within 24 hours from discovery of a cyber incident. This enables NHS organisations to start cyber incident response plans and inform relevant authorities within stipulated timelines. In addition, NHS England and the Department may also engage the National Cyber Security Centre, as the United Kingdom’s technical authority on cyber security, in the event of a major cyber incident.

NHS suppliers are subject to separate assurance and contractual arrangements. NHS England's Cyber Security Charter is designed to support suppliers and their customers in reducing the likelihood and impact of a cyber incident. We have a dedicated workstream in the Cyber Improvement Programme that is focused on the supply chain, developing tools and processes to increase cyber assurance and resilience.