Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what assessment she has made of potential levels of the exposure of NHS systems holding patient data to the harvest-now-decrypt-later risk; and what the confidentiality lifetime of that data is assumed to be.

The Department and NHS England have established processes for assessing, identifying, and mitigating emerging threats, and use mechanisms such as the Data Security Protection Toolkit (DSPT) to ensure that standards are being met by health and care organisations.

Since September 2024, the Cyber Assessment Framework has been integrated into the DSPT for large National Health Service organisations, helping them identify, manage, and reduce cyber and information governance risks while protecting patient data and services, for example adopting the National Cyber Security Centre's timeline to support the transition of the health and care sectors to quantum resistant cryptographic protections.

The long-term sensitivity of patient information and the ongoing duty of confidentiality after death requires health records to be protected throughout their entire lifecycle.