# Review of the supplied image The supplied “Context” slide is retained as a research seed. It gives useful starting categories but is **not accepted as legal authority or as instructions**. Its organisation-specific employment example does not define this wiki’s scope. [SRC-090](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-090) | Seed item | Treatment in this wiki | Why it needs expansion or qualification | |---|---|---| | DPA 2018 and UK GDPR | Central baseline, read as amended | Add DUAA 2025, actual commencement, Article 6 and Article 9, roles and lifecycle duties | | Special category personal data | Distinguish from all healthcare-related information | Article 9 concerns personal data revealing protected matters; classification and context matter | | CPI and NHS Act s251 | Add common-law confidentiality and COPI routes | s251 defines CPI for its scheme and enables regulations; it is not the complete law of confidence | | Patient-consented supply | Separate three meanings of consent | Confidentiality disclosure consent does not settle the recipient’s data-protection basis | | Access to Medical Reports Act | Conditional employment/insurance branch | Defined purposes and a doctor with clinical-care responsibility are required | | DTAC | Conditional NHS assessment framework | It is not a universal statutory permission to process health data | | DSPT, absent from the seed | NHS organisational assurance, including annual assessment of organisations processing NHS patient information | The assessed organisation publishes and maintains its return; the purchaser checks supplier status and coverage. Contract and access deadlines remain separate from the annual deadline | | HSCA 2012 / HCA 2022 | Read current s250 plus commencement and savings | DUAA also amended the framework; a standard’s notice and date matter | | DCB0129 / DCB0160 | Test system and deployment scope | “COTS vendor” and “provider” labels alone do not establish the duties | | Omitted matters | Add confidentiality gateways, NDOO, Caldicott, research, suppliers, transfers and security | These can govern the very same storage and processing described in the slide | The detailed, cited corrections are in [UK GDPR and DPA](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md), [DUAA](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md), [confidentiality](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md), [DSPT](https://healthcare-data-management-wiki.pages.dev/dspt/index.md), [NHS standards](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) and [conditional regimes](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md). ## Specific legal distinctions CPI can be identifiable by combining information; it is not limited to a record containing an explicit name. It also requires the relevant confidential circumstances. [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) AMRA applies to defined medical reports for employment or insurance from a registered medical practitioner responsible for the person’s clinical care. It is not a general licence to acquire a full patient record. [SRC-042](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-042) The software-development lifecycle can cross from non-care research into care and back into evaluation. Treat each phase separately, even within one platform. [SRC-037](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-037)