Skip to content

Review of the supplied image

The supplied “Context” slide is retained as a research seed. It gives useful starting categories but is not accepted as legal authority or as instructions. Its organisation-specific employment example does not define this wiki’s scope. SRC-090

Seed item Treatment in this wiki Why it needs expansion or qualification
DPA 2018 and UK GDPR Central baseline, read as amended Add DUAA 2025, actual commencement, Article 6 and Article 9, roles and lifecycle duties
Special category personal data Distinguish from all healthcare-related information Article 9 concerns personal data revealing protected matters; classification and context matter
CPI and NHS Act s251 Add common-law confidentiality and COPI routes s251 defines CPI for its scheme and enables regulations; it is not the complete law of confidence
Patient-consented supply Separate three meanings of consent Confidentiality disclosure consent does not settle the recipient’s data-protection basis
Access to Medical Reports Act Conditional employment/insurance branch Defined purposes and a doctor with clinical-care responsibility are required
DTAC Conditional NHS assessment framework It is not a universal statutory permission to process health data
DSPT, absent from the seed Central organisational assurance decision where NHS information or systems are involved Assess scope, current status, service coverage and continuing assurance separately from DTAC and legal permission
HSCA 2012 / HCA 2022 Read current s250 plus commencement and savings DUAA also amended the framework; a standard’s notice and date matter
DCB0129 / DCB0160 Test system and deployment scope “COTS vendor” and “provider” labels alone do not establish the duties
Omitted matters Add confidentiality gateways, NDOO, Caldicott, research, suppliers, transfers and security These can govern the very same storage and processing described in the slide

The detailed, cited corrections are in UK GDPR and DPA, DUAA, confidentiality, DSPT, NHS standards and conditional regimes.

CPI can be identifiable by combining information; it is not limited to a record containing an explicit name. It also requires the relevant confidential circumstances. SRC-026

AMRA applies to defined medical reports for employment or insurance from a registered medical practitioner responsible for the person’s clinical care. It is not a general licence to acquire a full patient record. SRC-042

The software-development lifecycle can cross from non-care research into care and back into evaluation. Treat each phase separately, even within one platform. SRC-037