Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what steps his Department has taken to safeguard patient data under NHS contracts with (a) Palantir and (b) other private sector data collectors.

The National Health Service operates to the highest standards of data security, and all organisations have governance arrangements in place to ensure the safe, legal storage and use of data. The NHS Federated Data Platform (FDP) is built with robust security and privacy controls to ensure that access to NHS data is tightly governed and independently auditable.

All user activity within the FDP environment is logged for auditing purposes. These logs are actively monitored by both Palantir’s United Kingdom security team and the NHS Cyber Security Operations Centre, to detect and respond to any malicious activity. Security logs are encrypted at rest and in transit, and are stored on a secure Security Information and Event Management server which is accessible only to authorised personnel

Access to data within the FDP is governed by strict controls, including the principle of least privilege and mandatory access control systems. Only authorised users are granted access for approved purposes, and all permissions are subject to audit and review. In addition to these technical safeguards, the FDP and associated services contract includes audit provisions that allow NHS England to validate and confirm that contractual requirements are being met. These rights of audit are standard within NHS commercial agreements and provide assurance that the platform operates in accordance with NHS England’s expectations and legal obligations.

Further information on the FDP’s security and governance framework is available in the published contract documentation and supporting materials, a copy of which is attached.