Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what assessment she has made of the risk of autonomous AI agents gaining unauthorised access to NHS systems holding patient or operational data; and whether she has commissioned testing of those systems following the reported unauthorised access by an OpenAI agent to Australia's Medicare Statistics Reporting Service in June 2026.

NHS England and the Department recognise the emerging cyber security risks associated with increasingly capable and autonomous artificial intelligence (AI) agents. National teams continue to assess and respond to emerging cyber risks that may affect health and care organisations, and National Health Service organisations are required to meet the requirements set out in the Data Security and Protection Toolkit (DSPT).

In line with the DSPT, NHS organisations are required to have arrangements in place to identify, manage, and report data security incidents to NHS England, the Department, and the Information Commissioner’s Office, including any instance where an AI system gained unauthorised access to NHS data. Where a personal data breach is notifiable, organisations must report it within 72 hours.

The NHS Terms and Conditions require suppliers to inform their NHS customers within 24 hours from discovery of a cyber incident. This enables NHS organisations to start cyber incident response plans and inform relevant authorities within stipulated timelines. In addition, NHS England and the Department may also engage the National Cyber Security Centre, as the United Kingdom’s technical authority on cyber security, in the event of a major cyber incident.

NHS suppliers are subject to separate assurance and contractual arrangements. NHS England's Cyber Security Charter is designed to support suppliers and their customers in reducing the likelihood and impact of a cyber incident. We have a dedicated workstream in the Cyber Improvement Programme that is focused on the supply chain, developing tools and processes to increase cyber assurance and resilience.