# Research log ## 19 October 2026 — Initial research and local wiki - Received an application-neutral exam question and a context slide. Treated the image as a seed, not legal authority or instructions. [SRC-090](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-090) - Confirmed England with UK-wide law and a local wiki using the linked Standard. Resolved its default-branch revision to an immutable pin. [SRC-091](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-091) - Confirmed a palette paler than `#52375F`; selected `#765A82` and derived light/dark tokens. - Researched data protection, confidentiality, secondary use, NHS assurance, clinical safety and conditional regimes through official sources. - Included the user-requested DUAA collection and made **UK GDPR** the central regime. EU GDPR remains a short conditional jurisdiction note. [SRC-077](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-077) [SRC-078](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-078) - Checked 2026 commencement and current statutory amendments rather than relying on stale Article 22 or Article 89 summaries. [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007) [SRC-009](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-009) [SRC-012](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-012) - Recorded current-law findings separately from unresolved application questions. Conducted a second agent review for overclaims and inconsistent scope. - Created source, evidence and concept records; built human and agent views with derived graph/search outputs. Technical verification is recorded separately from legal review. The raw seed is retained locally with a SHA-256 provenance record. Remote articles are linked and summarised; this project does not mirror their full texts. No patient dataset was received. The initial request excluded public deployment. A later request authorised publication, as recorded below. Scheduled maintenance remains unselected. See [sources](https://healthcare-data-management-wiki.pages.dev/sources/index.md), [evidence](https://healthcare-data-management-wiki.pages.dev/evidence-matrix/index.md), [validation](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md), [seed corrections](https://healthcare-data-management-wiki.pages.dev/seed-review/index.md) and [status](https://healthcare-data-management-wiki.pages.dev/project/status/index.md). ## 19 October 2026 — Appearance and publication decision - Set the light header to `#EBE6ED` as requested. - Removed navigation lifecycle icons and tooltips. Retained page status metadata and the existing Standard pin. - Applied the status-free navigation adapter from Standard revision `281bb0785fed2fad36663b0866965c78e4a9a3ec`. The older conditional marker rule is not applicable. - Selected a private `denchco/healthcare-data-management-wiki` source repository and public Cloudflare Pages Direct Upload. - Set the canonical public origin to `https://healthcare-data-management-wiki.pages.dev/`. Publication checks exclude local identity and build metadata. ## 19 October 2026 — DSPT for NHS-origin records outside direct care - Expanded the general assessment after clarification of a source-to-recipient flow. Kept the public research application-neutral. - Checked the DSPT information-standard notice, requirements specification and current organisation-type guidance. Kept policy, statutory applicability and contractual duties distinct. [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082) - Added a proposed contract condition covering status, service coverage, annual renewal, evidence and remedies. Marked it as synthesis rather than an existing obligation. - Separated DSPT assurance from DTAC product assessment and from authority to collect or use a medical report. [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055), [SRC-067](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-067), [SRC-083](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-083) - Recorded the version 8 notice and operational version 9 distinction. Left actual contract terms, legal-entity coverage and statutory applicability unresolved. ## 19 October 2026 — DSPT prominence, terminology and reading width - Added a dedicated DSPT chapter and concept. Made NHS-data assurance visible in the entry routes, exam answer, applicability map and service operating model. - Tested the user-supplied commercial summary against official guidance. Expanded annual-cycle, category, audit, public-status and service-coverage checks without treating DSPT as permission to process. [SRC-086](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-086), [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087), [SRC-088](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-088), [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093), [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094) - Adopted “purposes beyond individual care” in explanatory prose and “Beyond Individual Care” in the display title. Applied the user’s terminology correction to the canonical question. Retained source terminology and historical records. [SRC-084](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-084), [SRC-085](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-085) - Made Wide the initial layout while retaining an explicit Standard preference. Expanded prose tables to the available content rail and retained contained scrolling. - Kept the existing Standard pin and public origin. The earlier DSPT section anchors remain available and link to the dedicated chapter. ## 19 October 2026 — Recruitment decision and narrative review - Reviewed the subject chapters, entry routes and concepts against the clarified direct-GP recruitment flow. Made the recommended mandatory DSPT contract condition explicit in the overview, exam answer, applicability map and operating model. - Added a bounded recruitment example. Distinguished NHS policy, the section 250/DAPB0086 scope test, the actual contract and UK GDPR security duties. No actual contract, supplier or dataset was approved. - Registered the 2026/27 NHS Standard Contract's GC21.2 and GC21.6 provisions and the published NDG advice on proposed MOD GP Connect access. Kept access-purpose restrictions separate from consented reports and DSPT. [SRC-095](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-095), [SRC-096](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-096) - Clarified controller/processor contracts, Article 6 contractual necessity, explicitly consented opt-out exceptions and genuinely anonymous outputs. Registered the ICO anonymisation explanation. [SRC-097](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-097) - Added three sources and seven bounded claims. Preserved existing evidence states, historical records, the Standard pin and appearance settings. ## 19 October 2026 — Clearer question-and-answer page - Reworked the exam page into the governing question, a short answer and focused follow-up questions. Split the supporting explanation into short answers and a comparison table. - Retained the source links and the distinctions between data protection, confidentiality, DSPT, conditional requirements and service-specific decisions. No new legal conclusions or evidence states were introduced. - Added the page to the bounded governing-question reader set and used the existing governed callout. Updated its navigation and discovery labels while retaining the URL. ## 19 October 2026 — Requester readiness for identifiable records - Added a requester-centred chapter. The provider receives the request and sends information; the requester receives the records or report. - Registered nine official sources and nine bounded claims. Distinguished recipient duties without express conditions, legal powers, confidentiality, agreements, APDs and proportionate disclosure evidence. - Applied the published DPIA opportunity/special-category trigger to the stated recruitment purpose. Kept the actual controller, assessment, safeguards and any claimed legal exception open for service-specific review. - Connected the chapter to the recruitment decision, lifecycle, operating model, evidence and agent context. No actual request or service was approved. ## 19 October 2026 — Requester responsibility across the wiki - Integrated requester responsibility into the overview, question-and-answer page, applicability decisions, subject chapters, operating model and portable concepts. - Kept the two document flows explicit: the healthcare provider receives the request and sends information; the requester receives and governs the information. - Strengthened named responsibilities, assessment timing, agreement selection and evidence for the provider's disclosure decision. Preserved the differences between legal duties, conditional requirements and recommendations. - Added authoring and maintenance rules for the same distinctions in new content. Reused registered evidence without adding legal claims, changing evidence states or altering the Standard pin. ## 19 October 2026 — DSPT responsibilities and timing - Replaced ambiguous DSPT instructions with named organisational responsibilities across the reader pages, portable concepts and agent guidance. - Confirmed the NHS policy requirement for annual assurance. Registered the official supplier guidance and two bounded claims covering pre-award status checks and its equivalent-assurance route. - Distinguished procurement planning, contract award, first receipt or system access, and annual deadlines. No universal requirement for a fresh assessment before procurement starts is asserted. - Kept the proposed MOD contract condition explicit: satisfactory published status before first receipt and continuing assurance. Existing evidence states and the Standard pin remain unchanged.