Skip to content

Healthcare Data Management: Beyond Individual Care

What overarching rules, laws and regulations apply to digitally storing and processing healthcare data through software services for purposes beyond individual care in England?

There is no single healthcare-data software licence. The answer is a set of cumulative duties: data protection, confidentiality, and any standards or sector rules triggered by the purpose, organisation, information and system. A lawful disclosure does not by itself authorise every later use. SRC-026 SRC-030

This wiki is application-neutral. It covers England and applicable UK-wide law, with sources checked on 19 October 2026. It uses NHS England's term “purposes beyond individual care”. Individual care is also called direct care. Classify each use by its purpose and the applicable definition, not by the supplier's location. SRC-084, SRC-085

NHS data: assess DSPT at the start

If a service receives NHS patient information or accesses NHS systems, assess DSPT before access or procurement. The Data Security and Protection Toolkit is a central organisational assurance process for those flows, including uses beyond individual care. Establish the applicable requirement, then verify the organisation, assessment period, status, service coverage and required audit. Maintain that assurance throughout the service. SRC-056, SRC-081

For a commissioned service receiving identifiable records directly from NHS GPs, make DSPT a mandatory contract condition. This is a procurement recommendation; establish any existing statutory or contractual duty separately. Read the basis for requiring DSPT, then the recruitment example and decision record.

DSPT supports security and information governance. It does not replace UK GDPR, confidentiality authority or product-specific assessment. SRC-087

Start here

Reader task Best route
Answer the exam question Exam answer
Receive NHS records or access NHS systems DSPT: scope, status and continuing assurance
Decide whether DSPT should be mandatory for GP recruitment records Worked decision and its legal/contractual basis
Decide which duties might apply Applicability map
Understand GDPR and the 2025 Act UK GDPR and DPA · DUAA 2025 changes
Assess an actual service later Operating model
Check or challenge a statement Evidence matrix · Source register

Four questions organise the subject

flowchart TD
    accTitle: Four questions for healthcare data governance
    accDescr: Determine purpose and identifiability, establish legal authority, add applicable sector requirements, and demonstrate controls over the lifecycle.
    A[Purpose and data] --> B[Lawful authority]
    B --> C[Applicable requirements]
    C --> D[Lifecycle controls]
  1. What is the purpose and what is the data? Identify personal health data, confidential information, pseudonymised data and genuinely anonymous outputs.
  2. What permits each operation? Keep UK GDPR grounds, confidentiality authority and source-controller permission distinct.
  3. Which additional rules are triggered? Assess DSPT for NHS information or systems, then test research, employment reports, clinical safety, medical-device status and other conditional regimes.
  4. How will compliance be demonstrated? Assign owners and maintain records, contracts, access controls, retention, rights and incident processes.

These questions organise the research map; they are an analytical method, not a statutory approval process.

What changed from the seed image?

The image usefully identifies UK GDPR/DPA, CPI, medical reports, DTAC and clinical-safety standards. The expanded map adds DSPT assurance for NHS data, confidentiality gateways, opt-outs, suppliers, international transfers, research, lifecycle controls and the Data (Use and Access) Act 2025. It tests applicability instead of assuming every item applies. See the seed review. SRC-090

Evidence supports a rule; the facts of a service determine whether that rule applies.

This is a researched reference with a bounded worked example, not a compliance approval. “Draft” marks synthesis awaiting independent domain review; it does not mean the cited Acts are draft law. Specific unresolved matters are in the validation queue.