Conditional legal and regulatory regimes

Healthcare Data Management: Beyond Individual Care · England with UK-wide law · Sources checked 19 October 2026.

These requirements depend on facts about the service. Apply them alongside the core legal framework, confidentiality rules and NHS standards. This page does not establish that any proposed application complies.

Medical-device software

The Medical Devices Regulations 2002, as amended, can apply when software has a medical intended purpose. Merely holding health information does not establish device status. MHRA guidance distinguishes unchanged storage, simple record replacement and administrative functions from functions such as diagnosis or clinical monitoring. SRC-063

Assess what the product actually claims and does. Consider separate modules and the intended users. A research label does not settle the issue if the objective intended purpose is medical. Software used outside a clinic can still require assessment. SRC-063

If device rules apply, determine the classification and relevant conformity, registration, safety and post-market duties. Great Britain introduced additional post-market surveillance requirements for devices placed on the market or put into service from 16 June 2025. SRC-064

Required decision: document a product-specific qualification assessment. Reassess when functions, claims or intended use change.

Employment and insurance medical reports

The Access to Medical Reports Act 1988 (AMRA) concerns defined reports supplied for employment or insurance purposes. Its definition requires a medical practitioner who is or has been responsible for the person's clinical care. It does not govern every transfer of a health record to every software service. SRC-066

Within that scope, AMRA provides notification and consent requirements, access rights, and procedures for correction or recording disagreement. Access before supply is subject to the Act's procedures and exceptions. The person applying for the report must explain relevant rights. The requester's role therefore includes duties before the provider sends the report. SRC-066

AMRA consent and a data-protection lawful basis are separate questions. The ICO cautions that employment power imbalances can prevent freely given consent. Employers should collect only the health information needed for the stated purpose. A targeted report may meet that need without disclosure of an entire record. SRC-067

Required decision: the requester identifies the report author, recipient, employment or insurance purpose, necessary information and applicable procedure. It must establish the lawful grounds for processing it controls and the confidentiality authority for its use. The provider separately assesses the disclosure; the requester's duties do not depend on conditions stated by the provider. SRC-003, SRC-004, SRC-083, SRC-103

The recruitment example applies these distinctions to direct receipt from an NHS GP. Its DPIA analysis applies the opportunity-decision trigger to the stated medical eligibility assessment. That trigger does not require automation or large scale; any claimed legal exception needs evidence. DSPT adds organisational assurance and remains a recommended mandatory contract condition. Report rights, lawful grounds and sector-specific exceptions retain their own tests. SRC-100, SRC-018, SRC-081

Equality and accessibility

Service providers have reasonable-adjustment obligations under the Equality Act 2010 in England. Public-sector websites and mobile applications face additional requirements under the 2018 accessibility regulations. Relevant intranets and extranets can also be covered. SRC-065

Assess the service, organisation and users before specifying the applicable obligations. Design for accessible information, controls and routes to exercise rights. A DTAC assessment does not replace these duties. SRC-065, SRC-055

Section 60 of the Equality Act restricts pre-offer health enquiries, subject to specified exceptions. The exact employment stage and purpose matter. DPA 2018 section 185 also voids certain contractual requirements to supply health records obtained through subject-access rights. These are additional checks where a service obtains records for recruitment, employment or insurance; they are not permissions to collect data. SRC-074 SRC-075

An unspecified application still needs a separate discrimination, reasonable-adjustments and, where relevant, public-sector equality assessment.

Cookies, device access and electronic marketing

The Privacy and Electronic Communications Regulations 2003 (PECR), as amended, add rules for specified electronic activities. Current regulation 6 and Schedule A1 govern storing or accessing information on user devices. Regulation 22 governs unsolicited electronic marketing to individual subscribers. Both require attention to the applicable exceptions. SRC-069

The device-access provisions changed on 5 February 2026. Do not rely on an older rule summary that ignores the amended framework. A general privacy notice or UK GDPR basis does not itself establish that a PECR condition is met. SRC-048, SRC-069

Required decision: inventory the interface's device storage, tracking and messaging. Classify each purpose and document the relevant condition before enabling it.

Children

The Children's code concerns relevant online services likely to be accessed by people under 18. A service can qualify even when children are not its target audience. Applicability depends on the online-service definition and likely access, rather than simply whether a database contains children's records. SRC-068

Where the code applies, assess age-appropriate design and privacy defaults. Establish whether the service is intended for children, adults acting for children, or professional users. Do not assume that a parent's account establishes every permission needed for a child's information. Use the legal framework and confidentiality assessment for those decisions.

Required decision: record the user population, likely access, representation arrangements and safeguards. Escalate capacity or authority questions where they remain unresolved.

Records concerning deceased people

UK GDPR concerns living people. Confidentiality can continue after death, and records can also contain information about living relatives or other third parties. NHS guidance identifies distinct access routes under the Access to Health Records Act 1990 and other powers. SRC-070

The requester, record and purpose determine the route and restrictions. A family relationship alone does not establish unrestricted access. Research access is a separate question from a personal representative's access request. Apply the confidentiality analysis before disclosure or reuse. SRC-070

Required decision: classify the request, verify authority, review third-party information and apply the correct deadline. Do not classify deceased records as freely reusable data.

Network and information systems security

The Network and Information Systems Regulations 2018 impose security and qualifying-incident duties on designated operators of essential services. In England's health sector, these include NHS trusts, foundation trusts, integrated care boards and certain independent providers. An ordinary supplier is not automatically a health-sector operator. SRC-061

Determine whether the organisation is designated and which systems support the essential service. Separately review any digital-service-provider role and contractual supply-chain duties. Keep NIS incident assessment distinct from the personal-data-breach process in the operating model.

The Cyber Security and Resilience (Network and Information Systems) Bill remained a Bill on 19 October 2026. Parliament listed Lords report stage for 26 October. Its proposed extensions must not be described as current operational duties. SRC-062

AI, profiling and automated decisions

“AI” is not an applicability decision. Separate development, model training, testing, deployment and monitoring as processing purposes. Use the legal framework to assess current automated-decision rules and the protection of health data.

For medical functions, perform the device assessment above. For systems affecting care, perform the clinical-safety assessment. Whether the software uses AI does not remove either analysis. SRC-063, SRC-052

Required decision: document inputs, outputs, intended effects, meaningful human involvement, recipients and proposed reuse. Record unresolved bias, employment or access-to-service questions in the validation queue.

Further triggers to investigate

This page is not a universal catalogue of every sector-specific duty. If the facts introduce regulated care, a clinical investigation, biological samples or a special statutory disclosure, commission a focused assessment. Likewise, overseas activity needs a jurisdiction-specific review.

The absence of a named regime here is not evidence that it is irrelevant. Use the applicability assessment to establish the facts and the source register to distinguish verified rules from unresolved questions.