<!-- Derived Markdown alternate of index.md; canonical repository sources and registered evidence retain authority. -->


# Healthcare Data Management: Beyond Individual Care

<blockquote class="governing-question">
<p>What overarching rules, laws and regulations apply to digitally storing and processing healthcare data through software services for purposes beyond individual care in England?</p>
</blockquote>

**There is no single healthcare-data software licence.** The answer is a set of cumulative duties: data protection, confidentiality, and any standards or sector rules triggered by the purpose, organisation, information and system. A lawful disclosure does not by itself authorise every later use. [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030)

This wiki is application-neutral. It covers England and applicable UK-wide law, with sources checked on **19 October 2026**. It uses NHS England's term **“purposes beyond individual care”**. Individual care is also called direct care. Classify each use by its purpose and the applicable definition, not by the supplier's location. [SRC-084](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-084), [SRC-085](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-085)

## Requesting records: govern receipt and use

**The requester is responsible for governing its receipt and use of identifiable information.** In this flow, the GP practice or other healthcare provider receives the request and sends the records or report. The requester receives that information. These directions do not determine controller or processor status. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014)

The requester's duties apply even when the provider states no express conditions. Establish lawful grounds, required assessments and agreements, and working safeguards. Prepare proportionate evidence for the provider's separate disclosure decision. Use [requester readiness](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) to distinguish legal requirements from the recommended evidence pack. [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103)

## NHS data: assess DSPT at the start

**If a service receives NHS patient information or accesses NHS systems, assess DSPT before access or procurement.** The Data Security and Protection Toolkit is a central organisational assurance process for those flows, including uses beyond individual care. Establish the applicable requirement, then verify the organisation, assessment period, status, service coverage and required audit. Maintain that assurance throughout the service. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081)

For a commissioned service receiving identifiable records directly from NHS GPs, **make DSPT a mandatory contract condition**. This is a procurement recommendation; establish any existing statutory or contractual duty separately. Read the [basis for requiring DSPT](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#what-makes-dspt-mandatory), then the [recruitment example](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md) and [decision record](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md).

DSPT supports security and information governance. It does not replace UK GDPR, confidentiality authority or product-specific assessment. [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087)

## Start here

| Reader task | Best route |
|---|---|
| Answer the exam question | [Question and answer](https://healthcare-data-management-wiki.pages.dev/exam-answer/index.md) |
| Receive NHS records or access NHS systems | [DSPT: scope, status and continuing assurance](https://healthcare-data-management-wiki.pages.dev/dspt/index.md) |
| Prepare a request for identifiable records or reports | [What the requester must have ready](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) |
| Decide whether DSPT should be mandatory for GP recruitment records | [Worked decision and its legal/contractual basis](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md) |
| Decide which duties might apply | [Applicability map](https://healthcare-data-management-wiki.pages.dev/applicability/index.md) |
| Understand GDPR and the 2025 Act | [UK GDPR and DPA](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) · [DUAA 2025 changes](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md) |
| Assess an actual service later | [Operating model](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md) |
| Check or challenge a statement | [Evidence matrix](https://healthcare-data-management-wiki.pages.dev/evidence-matrix/index.md) · [Source register](https://healthcare-data-management-wiki.pages.dev/sources/index.md) |

## Four questions organise the subject

```mermaid
flowchart TD
    accTitle: Four questions for healthcare data governance
    accDescr: Determine purpose and identifiability, establish legal authority, add applicable sector requirements, and demonstrate controls over the lifecycle.
    A[Purpose and data] --> B[Lawful authority]
    B --> C[Applicable requirements]
    C --> D[Lifecycle controls]
```

1. **What is the purpose and what is the data?** Identify personal health data, confidential information, pseudonymised data and genuinely anonymous outputs.
2. **What permits each operation?** Establish the requester's processing grounds and the provider's disclosure authority. Keep UK GDPR, confidentiality and source permission distinct.
3. **Which additional rules are triggered?** Assess DSPT for NHS information or systems, then test research, employment reports, clinical safety, medical-device status and other conditional regimes.
4. **How will compliance be demonstrated?** Assign accountable owners. Complete required assessments and agreements, provide relevant evidence for disclosure, and maintain lifecycle controls.

These questions organise the [research map](https://healthcare-data-management-wiki.pages.dev/research-map/index.md); they are an analytical method, not a statutory approval process.

## What changed from the seed image?

The image usefully identifies UK GDPR/DPA, CPI, medical reports, DTAC and clinical-safety standards. The expanded map adds **DSPT assurance for NHS data**, confidentiality gateways, opt-outs, suppliers, international transfers, research, lifecycle controls and the **Data (Use and Access) Act 2025**. It tests applicability instead of assuming every item applies. See the [seed review](https://healthcare-data-management-wiki.pages.dev/seed-review/index.md). [SRC-090](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-090)

> Evidence supports a rule; the facts of a service determine whether that rule applies.

This is a researched reference with a bounded worked example, not a compliance approval. “Draft” marks synthesis awaiting independent domain review; it does not mean the cited Acts are draft law. Specific unresolved matters are in the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md).