Health Bill (Eleventh sitting)

Gregory Stafford Excerpts

Committee stage
Thursday 2nd July 2026 Public Bill Committees

[Dr Chambers]

The amendment was tabled in the name of my hon. Friend the Member for Epsom and Ewell (Helen Maguire), and would require medical markers for firearms licence holders to be visible to all relevant health workers under the establishment of a single patient record.

I will not read through all my speaking notes but, in a nutshell, a person rightly undergoes mental health checks before they acquire a firearms licence, but that will not be reviewed until they are due to renew their firearms licence a few years later. If their mental health status changed during that time, the amendment would enable them to be flagged to healthcare workers and GPs as a person who has a firearms licence, so that any necessary proactive measures could be taken to ensure that they are still safe to have that licence, or should have it removed, rather than waiting for them to apply for a new licence in a few years’ time.

The British Medical Association supports the amendment and the Royal College of General Practitioners thinks it would be valuable. A survey carried out by the Association of Police and Crime Commissioners found that 87% of existing certificate holders believe that GPs should inform the police if they become aware of health issues that could have an impact on the certificate holder’s ability to own a gun safely. Quite often, however, the GP is not aware that the person is in possession of a firearms licence.

[Gregory Stafford (Farnham and Bordon) (Con)]

In essence, we debated the amendment in a Westminster Hall debate some months ago, when I had the dubious honour of being the shadow spokesman for the Conservative party despite not being a Home Office shadow Minister. It became clear in that debate that mandatory medical markers do not exist. It is still a voluntary system. How does the hon. Gentleman propose to make the system equitable?

The hon. Gentleman and I support mandatory medical markers, and there seemed to be cross-party support for them in the Westminster Hall debate. If they are not mandatory, some people will potentially be put under a different system, because their sufficiency or ability to hold a shotgun licence could be taken away from them, while those who are not on the system, because it is not mandatory, would not lose theirs. How does the hon. Gentleman deal with the equity issue and the potential for some people to be missed?

[Dr Chambers]

The hon. Gentleman makes an interesting point. I suppose this is another chance to use the developing single patient record to ensure that we close the gap. The record could be formed in such a way, and the process put in place, to ensure equity in the system, with mandatory markers.

Amendment 72, also tabled by my hon. Friend the Member for Epsom and Ewell, would require prior membership of the armed forces to be visible to all relevant healthcare workers under the establishment of a single patient record. It would also require the Secretary of State to publish a report on making prior armed forces membership visible on the single patient record.

There are just over 1.85 million armed forces veterans in the UK, 13.6% of them women and 86.4% men. The transition from serving in the armed forces to civilian life can mean that many of those individuals struggle with mental health issues, such as post-traumatic stress disorder. The issues are often specific to the service the individuals have given. Some stats show that more than half of England’s Army veterans have some sort of health problem. I should point out that veterans do not only have mental health problems. Specific back and knee problems are much more common among infantry soldiers because of the type of training they have done over many years.

The amendment seeks to make prior armed forces membership visible to all relevant healthcare workers, and to make the Secretary of State consult on the merits of doing so, so that when a GP is treating a patient, they are aware of that person’s service history without having to ask about it specifically.

[Dr Caroline Johnson (Sleaford and North Hykeham) (Con)]

I have a couple of questions about amendment 71 for the hon. Member for Winchester. First, can he comment on why the amendment refers to firearms, which have stricter licensing conditions than shotguns? Also, the GP should be aware, because all relevant medical information should filter back to them, that the person has a firearms licence, which, as I say, has stricter criteria. It is essentially harder to get a firearms licence than a shotgun licence. I am interested to hear the hon. Gentleman’s thoughts on that.

On amendment 72, I have a large veteran population in my constituency, and I am very grateful to all those who have put their lives on the line to keep us safe, both today and in the past. I can see that there may be benefits to the amendment in respect of the delivery of the armed forces covenant and aspects of veterans’ care, but I am curious about how it is written. Proposed new subsection (3A) of proposed new section 250E of the National Health Service Act 2006 says that

“regulations must make provision for prior membership…to be visible to all relevant healthcare workers under the establishment of a single patient record”,

but proposed new subsection (3B) requires a report on the potential merits of doing that. It seems slightly counterintuitive to do it and then decide whether it is a good idea, rather than decide whether it is a good idea, consider the pros and cons, and then do it afterwards. I am interested to understand why the hon. Gentleman thinks the amendment is drafted in that way.

[Gregory Stafford]

It is a pleasure to serve under your chairmanship again, Ms Lewell. On amendment 71, I ought to declare that I am a supporter of the Countryside Alliance. Although I do not own a shotgun myself, I represent a large shooting community and I have been on a shoot relatively recently, but without a gun, so I did not shoot anything.

As I alluded to in my intervention on the hon. Member for Winchester, I spoke on this issue in Westminster Hall some months ago, when it was clear to me that there was a significant level of cross-party support for the idea of mandatory markers for GPs. As mandatory markers for firearms licensing are technically a Home Office issue rather than a Department of Health and Social Care one, the Under-Secretary of State for the Home Department, the hon. Member for Dover and Deal (Mike Tapp), responded to that debate, but he was unable to reassure us that provision would be made. I did not understand the arguments he made, because I think mandatory markers are probably the way forward. Given that they are supported by organisations such as the British Association for Shooting and Conservation and the Countryside Alliance—organisations that one might not have expected to be in favour of them—the Government should look into the idea.

There would clearly be a benefit to the proposal in amendment 71. If a patient who holds a firearms licence presents a serious medical risk because of a mental health crisis, suicidal ideation or behaviour that raises concerns about risks to themselves or others, an immediately visible marker would help clinicians to make informed decisions and take the appropriate safeguarding action. But a firearms licence is obviously not a medical condition, nor is it health information in any traditional sense. This goes back to the point I made in the debate on a previous amendment, about how broad the information that we keep on the single patient record will be. The inclusion of such a marker across the single patient record could lead to issues relating, as we talked about in previous debates, to who would want to see that information.

For example, there may be people out there who are not in favour of recreational shooting, and someone may hold a firearms license for recreational shooting. Of course, section 2 firearms licences, especially for shotguns, are often held by farmers and people involved in conservation, and for all sorts of other reasons, including the control of pest populations. But if someone has a licence for recreational use, there may be people who, for whatever reason, find that to be against their own beliefs and opinions. That might lead to a patient being subjected to a level of intrusion or bias, or perhaps not receiving the care they deserve, because someone has made an assumption about what they are like based on that information. We need to be careful about that.

[Dr Johnson]

Before my hon. Friend moves on, may I ask him about security? It might also be possible for someone who looked at the records to identify where guns are kept. That information is currently is more protected than that.

[Gregory Stafford]

I thank my hon. Friend for that helpful intervention; I had not appreciated that. If that is true, the security and safety of the individual who holds the firearms licence, and indeed of anybody else in the vicinity, is paramount, and we generally would not want people to know precisely where guns are held, because that could be a security risk. I think the hon. Member for Winchester has the best of intentions, but the consequences have not been fully thought through.

[Dr Chambers]

Will the hon. Gentleman give way?

[Gregory Stafford]

I will, but first I want to be kind to the hon. Gentleman and say that, as with his previous amendment, he has opened up a conversation about the single patient record that we really need to have, to ensure that what is on it needs to be there for the treatment of patients. As legislators, we need to have a wide conversation to decide what it includes and how it is going to be used.

[Dr Chambers]

The hon. Gentleman makes some good points, especially given his experience as the Conservative spokesperson in the Westminster Hall debate on this subject, for which he did a lot of research. I do not think we need to worry about medical professionals seeing that someone has a firearms licence and potentially treating them differently because of assumptions they make about them. Medical professionals are trained to be dispassionate, and they try to show little bias. I would be very surprised if a doctor, seeing it flagged on a single patient record that someone was in possession of a firearms licence, changed their attitude towards or approach to the treatment of that individual. I think that particular point is probably not relevant.

[Gregory Stafford]

I admire the hon. Gentleman’s optimism. I am not belittling his point—I, too, hope that no one would be treated, both in the traditional sense and in the medical sense, based on their background or anything else, including their recreational hobbies. Unfortunately, we have seen cases in the NHS in which someone’s religious background has led to antisemitism and other unfortunate issues. Unfortunately, sometimes the system itself has a problem. The Health and Social Care Committee published a report relatively recently on black maternal health. We could see the difference and the fact that, unfortunately, black women experience a worse level of care, often because of assumptions made about their backgrounds. I agree with the hon. Gentleman that I hope everyone is treated dispassionately, but I am afraid it does not always happen. We need to make sure that we root out that kind of behaviour, but we also need to protect people from it.

Amendment 72 is another that was tabled with the best of intentions. The improved identification of veterans is an interesting idea, because I do not think many veterans actively identify themselves when they access healthcare. A visible marker could help to ensure that healthcare professionals are aware of a patient’s service history without relying on self-disclosure. There may be direct benefits to a veteran, because they may be eligible for dedicated NHS services—including mental health, rehabilitation and other veterans’ healthcare pathways—through the armed forces covenant. A marker could, then, assist clinicians in directing patients to appropriate support more quickly.

--- Later in debate ---

Any public awareness campaign should, as the amendment specifies, seek to reach audiences that might not otherwise be reached. I am referring not only to age, but I raise age as an example. The shadow Minister has already highlighted digital exclusion for coastal and rural areas, which is another reason why I support amendment 49.

[Gregory Stafford]

As we move towards a single patient record, we have to ensure that technological progress does not come at the expense of those who are least digitally connected. As others have said, I am particularly concerned about older patients and many disabled people, who often rely most on NHS services but can face the greatest barriers when healthcare systems—and all systems—become increasingly digital. For some elderly patients in my Farnham and Bordon constituency, navigating online platforms is challenging, and others may not have regular access to the internet at all. Unfortunately, my constituency has one of the worst full-fibre broadband roll-outs in the country, and it has extraordinarily poor mobile phone reception in the central rural parts of the constituency, despite my best efforts with BT Openreach and others.

Disabled people may also face accessibility barriers that these systems do not always anticipate in their design. Modernisation should never mean creating a two-tier NHS—one for those who are digitally confident and another for those who are not. The people at risk of being left behind are often those with the most complex healthcare needs and the greatest reliance on the continuity of care. A proper assessment of digital exclusion is therefore not just a bureaucratic exercise, as some may describe it; it is an essential safeguard. We need to understand how the single patient record will affect elderly patients, disabled people, carers, those with learning disabilities and those who may struggle to engage with digital services.

[Sojan Joseph (Ashford) (Lab)]

My understanding is that the single patient record is just a single place where all of a patient’s medical records will be kept. It will not necessarily change the ways in which they access healthcare services, such as A&E, the GP or a dentist. Those ways of accessing healthcare will stay the same, whether we have a single patient record or not.

[Gregory Stafford]

For me, the key thing is that we must have equity of access to the single patient record. If somebody wishes to see their own medical record, they should be able to do so, whether they are digitally savvy or not. As far as I can tell, that is the intention behind the Liberal Democrat amendment.

However, the hon. Gentleman raises an interesting point. We are seeing this already, but the more we go down the digital route—because it is more efficient and straightforward, and takes out the unnecessary bureaucracy of having a human interaction to book an appointment or whatever—the more likely it is that this will become the portal for all interactions. I am not saying that that is the Government’s intention, but he raises a point, perhaps inadvertently, that we need to think about.

To conclude on amendment 70, before we proceed any further, the Government should be able to demonstrate that no patient will receive a worse service, face greater barriers to care or lose access to information simply because they are older, disabled or less digitally connected than others—that goes to the heart of fairness and equity of access in our NHS. I am absolutely certain that the Minister does not wish that to happen, but it would be interesting to hear how she will ensure that it does not happen.

Amendment 49, in the name of my hon. Friend the Member for Sleaford and North Hykeham, would prevent the Secretary of State from making regulations to establish the single patient record unless a public awareness plan had first been published and laid before Parliament, and a minimum three-month public information campaign had been conducted before the system went live. That seems eminently sensible, and I hope it is something that would be not just welcomed by Ministers, but on their agenda already.

Patients clearly have a right to know what information is being held, who will have access to it, how it will be used, what safeguards are in place and what rights they have in relation to their own data before the system goes live. A three-month campaign to give them that opportunity would be appropriate, because the things that I have outlined are not technical details that need to be buried in some Government website or hidden in the small print of a privacy notice; they are fundamental questions that deserve proper public engagement.

I am especially supportive of amendment 49 because of the impact on older people, disabled people and those who are less digitally engaged. I do not think that most of my constituents spend their time reading NHS policy documents online—my notes say “most”, but I think none of them do, unless they are involved in the health world themselves—and they should not wake up one morning to discover that a major change to the management of their health information has already been implemented without their knowledge.

A public information campaign is not a bureaucratic hurdle; it is a democratic necessity. If Ministers are confident that the single patient record will improve care, strengthen efficiency and protect privacy, they should be eager to make that case to the public and should therefore welcome the scrutiny, transparency and informed debate that a three-month public information would bring.

[Edward Argar (Melton and Syston) (Con)]

I want to speak primarily to amendment 49, in the name of my hon. Friend the Member for Sleaford and North Hykeham, the shadow Minister, and to agree with what my hon. Friend the Member for Farnham and Bordon has just said. Sadly, there will be a large number of people who do not follow the debates in this House or this Committee in great detail, however fascinating they may be. That is perfectly understandable.

The single patient record has genuine potential. It has the potential to put all the different bits of data in one place, so that when, for example, someone is blue-lighted to hospital, their consultant or the doctors treating them in A&E can access the information they need about their medical history and any medications they are on, which could improve clinical outcomes for patients.

I can entirely see the potential of the single patient record, but I am also conscious of the genuine concern among those of our constituents who are aware of this about what it might mean in practical terms for them and their data—it is important to remember that it is their data. They will have concerns, as my hon. Friend the Member for Farnham and Bordon set out, about who can access it, what safeguards are in place, whether they can opt out, and a range of other legitimate questions about how it will work.

I have to say that amendment 49, tabled by my hon. Friend the Member for Sleaford and North Hykeham, is not unreasonable. It would give the Government an opportunity to reassure our constituents and bring them along on this journey, rather than leaving questions unanswered or just addressing them in a Q&A on a Government webpage. People have genuine questions, and in many cases I am confident that the Minister will be able to allay those concerns or put them to rest, but some campaign of that sort is needed.

Such campaigns happen regularly on a range of subjects. The Department of Health and Social Care spends a significant amount of money on public health and awareness campaigns, and His Majesty’s Revenue and Customs spends a large amount of money on reminding everyone to get their tax returns in on time, in the lead up to that, or to remind them of the penalties if they do not. Government do that day in, day out across a range of services and where major changes are being made.

The Government have a genuine opportunity to accept amendment 49, which will help them to bring the people we serve on this journey, and potentially help to realise the benefits and allay people’s concerns. I genuinely hope that the Minister will be able to accept the amendment or will commit to take it away, look at it, engage with my hon. Friend the shadow Minister and possibly bring back a Government amendment that does exactly this on Report.

--- Later in debate ---

Division 14

Question accordingly negatived.

Ayes: 6

---

Conservative: 4
Liberal Democrat: 2

Noes: 7

---

Labour: 7

[Gregory Stafford]

On a point of order, Ms Lewell. Are we not voting on amendment 49?

[The Chair]

We will vote on amendment 49 later if the hon. Member for Sleaford and North Hykeham wishes to.

--- Later in debate ---

[Edward Argar]

That is the challenge. The Minister knows her brief very well—if I may say, I hope that whatever happens in a few weeks’ time, she retains it. She is that rare thing among Ministers in Government: someone who comes to their position with a hinterland of knowledge, experience and interest, which she has demonstrated through her period in office thus far. I hope that she retains her role, because continuity of Ministers in Government is a good thing.

Can the Minister reassure us on the shadow Minister’s point, which is one that I have been seeking to make? Can she reassure us that the system will include barriers to prevent whoever builds and operates it—whether a third party or someone internal—from having inappropriate access to the records? The data must be ringfenced and protected, so that it does not go out of the country and cannot be accessed by those who are technically running or providing the platform. Even within the social care system, there must be very clear and technical restrictions on who can access the records for legitimate purposes, as the hon. Member for Ashford has highlighted. I think that would just reassure people.

As I said in response to previous amendments, I think the potential of the single patient record to improve clinical outcomes in care is very significant, but we need to bring people with us. I suspect that if anyone can reassure us on those points, it is the Minister.

[Gregory Stafford]

As my right hon. Friend has just said, this is a unique system that will have unique benefits, but it will also have unique risks. Almost in answer to the point made by the hon. Member for Ashford, I do not think there is anything—[Interruption.]

[The Chair]

Order. As Members can hear, there is a fire alarm. Can everyone return to this room as soon as possible, when it is safe to do so?

--- Later in debate ---

On resuming—

[Gregory Stafford]

Before I was rudely interrupted by the fire alarm—I am not taking it as a hint, much to the Minister’s disappointment—I was saying that this is a unique system and that with the unique benefits come unique risks. I was trying to answer the points made by the hon. Member for Ashford.

As my hon. Friend the Member for Sleaford and North Hykeham and my right hon. Friend the Member for Melton and Syston have mentioned, we already know that despite the regulations, whether they are from professional regulators or the ICO, people will get round the system. One of the biggest concerns that patients will raise is not simply whether patient records will be accessed by nefarious people from outside, such as cyber-hackers, hostile states and so on, but whether they are secure from inappropriate access by people who have access to the system. As my hon. Friend the Member for Sleaford and North Hykeham pointed out, those people could be situated anywhere across the country. Patient records should be accessed only where there is a clear clinical, professional need. The public rightly expect robust safeguards, strong audit trails and meaningful consequences where the rules are breached. Amendment 48 raises that important issue. The Minister should explain how inappropriate access will be prevented, how misuse will be detected and what sanctions will apply when the standards are not met.

My hon. Friends have already mentioned a number of cases and I pick another one: the unfortunate case of the three-year-old boy who was hospitalised after being attacked by a crocodile at a zoo. Cambridge University Hospitals trust is currently investigating 40 members of staff who appear to have accessed that boy’s medical records inappropriately.

While we would always hope that that would not happen, unfortunately it clearly does. This single patient record means that someone will potentially be able to look at patients’ records regarding anything and from anywhere in the country. My hon. Friend the Member for Sleaford and North Hykeham slightly generously described some people as “nosey”. Along with those who have an actual ulterior motive, that presents a real challenge. I say to the hon. Member for Ashford that just because the current system is in place to protect patient records as they currently exist, that should not be a bar to making sure that we make the system even more robust given its potential risks.

It goes directly to proposed new section 250F(4B)(b) of the National Health Service Act 2006, which is the system of audit logging to be applied to each record, so that every time someone accesses a patient record or part of that patient record, the identity of the person obtaining that information should be recorded. I believe that the patient should be able to easily see, hopefully in real time, who has been accessing their record and at what time.

We on this side have mentioned a number of big events: that poor boy with the crocodile, terrorist attacks in Southport and so on. I suspect that those data breaches have been identified because they were big events. People have gone out to check that nobody has been inappropriately accessing those records. I worry that every patient record will potentially be available to every single person, and I doubt that there will be an ability to check every single person proactively rather than reactively. That means patients need access themselves to look at their record and see who has been accessing it. If the name of the person who has accessed the record, or the organisation they belong to is available, patients can say, “Well, there is Mr Smith, my child’s paediatrician, and that is fine. However, who is this guy from elsewhere in the country who has looked at the record?” They can then raise that. That is absolutely vital.

[Dr Johnson]

My hon. Friend is making a very important point. Does he also think that it is possible for the system to have some designs built into it that identify that someone from another area of the country, or from another department or different profession is unexpectedly looking at results? Perhaps AI could help with this.

[Gregory Stafford]

My hon. Friend is right. I will not sit here and propose a solution to this problem, but what her amendment does is ensure that the Government look at this and present a plan before both Houses of Parliament, before we get to a single patient record.

I have now touched on the nefarious and the nosey. I think there is also a case of inadvertent access. With this new system, despite what the professional regulators might think, and despite the best training from the Information Commissioner’s Office, there will be occasions in a new system where people do not understand the limits of what they are allowed to look at or the appropriateness of access. There could well be inadvertent access to these systems. Again, the Government need to have a plan and system in place to ensure that there is not inadvertent, non-nefarious access to patient records as well. That is why I am very supportive of amendment 48.

To make sure that this system is trusted by patients, we need to have the highest level of safeguarding possible, both from external attacks and from internal misuse. My hon. Friend’s amendment goes a long way to putting some of that trust in place.

[Joe Robertson]

Plainly, there is already scope for this to happen and sadly patient records are wrongly accessed, either inadvertently through mistake or deliberately in bad faith. However, from a technological and design point of view, the single patient record inevitably makes that easier and more likely, whether through mistakes or deliberate acts. That is just one of the many considerations and downsides of a single patient record that is otherwise beneficial.

It is incumbent on the Government to do what they can to mitigate against those inevitable structural problems that the record will produce, and amendment 48 is an entirely sensible way of achieving that. I am always slightly reluctant to use analogies from other sectors, because plainly there are differences, but in my former life as a family law solicitor, even within a small private law firm, there were structures in place to ensure that only people who needed to access data could do so, and much of it was arguably less sensitive than patient records.

That was the case in a small firm, and because we have a national system of healthcare in this country, which is a good one, the scale of fallout and harm that could arise from such mistakes or deliberate acts is so much greater. I urge the Government not to see the amendment as seeking to undermine their overall plans, but as a means of strengthening them.

--- Later in debate ---

[Sojan Joseph]

I do not know whether there will be the same system in Scotland, but my understanding is that in the north of England doctors will be able to see the same system. Again, we can hear more detail from the Minister.

A single patient report has the potential to transform patient experience and safety by ensuring continuity of care, by reducing unnecessary repetition, by enabling better informed clinical decisions and the smoother discharge of patients, and by creating a more efficient and joined up healthcare system.

[Gregory Stafford]

I thank all those who have spoken so far in this debate. I have never seen the hon. Member for Lichfield so animated—Data Dave is clearly alive and well.

As we have discussed, the clause creates the legal power for a single patient record in the UK. It is important to say, as others have, that the Bill does not create the system but gives the Secretary of State the power to create it later through regulation. That does not mean, however, that we should not have a debate about some of the issues that we have raised.

I should state at the start that I support better information sharing when that helps patients receive safer and better care, and I think that the single patient record could well do that. Anyone who has worked in healthcare, as I have, knows the frustration that results from the records not following patients between services. Clinicians can lose valuable time in searching for information, if they can get it at all. As others have said, patients are often asked to repeat the same details over and again—not, as my hon. Friend the Member for Isle of Wight East rightly said, because it gives a richer experience but simply because people do not have the information. Better joined up records have the potential to improve care.

We have, however, been here before. I was a lot younger—we all were—but back in 2002, the national programme for IT, under the last Labour Government, was a £10 billion unmitigated disaster, which the Public Accounts Committee described as

“one of the worst and most expensive contracting fiascos in the history of the public sector.”

I want to make sure that there are safeguards, from both a contracting and a data safety point of view, so that we do not go down that route again. As my hon. Friend the Member for Isle of Wight East clearly outlined, creating such a record is fiendishly complicated from both a technology and patient information point of view and from a data sharing and data protection point of view.

The record could contain some of the most sensitive information about people, so Parliament has the responsibility to make sure that the legal framework is right. We also know that the record will work only if the data in the single patient record is worth the electronic paper that it is electronically printed on. As I am sure the Minister knows from her time in the NHS, the information is getting better but continues to be patchy across the country. Different trusts and organisations record things in different ways. I take my hat off to those who work in clinical coding, as they do one of the most difficult jobs in a trust. Again, we need to make sure that the data is accurate. Someone mentioned AI earlier; I think AI could help with that, but we are still some way off.

I want to canter through my concerns about the breadth of the powers being given under the clause. The Bill allows the Secretary of State to make regulations establishing the system and to decide how it operates. Those regulations may require or authorise the sharing and processing of patient information, decide who can access the information and create enforcement powers and financial penalties. Some of those important questions are not answered in the Bill. Parliament is being asked to approve a broad framework before seeing some of the detail.

My second concern is that the Bill says little about patient choice. There is no clear statement about whether patients will have the right to opt in or out and no explanation of whether patients can restrict access to all or part of their records. There is no mention of whether someone could choose to limit access to particularly sensitive information, such as mental health records, sexual health information or information about substance dependence. There are major questions for public trust but those are left, I would say, entirely to future regulations. We need clarity about them now.

My third concern is the scope of the information that may be included. The definition of “patient information” is extraordinarily broad. It covers information about physical health, mental health, diagnosis, treatment and care, including social care. The definition of “patient” includes people receiving social care or having their care needs assessed. What we do not know from the Bill is exactly how that data will be presented. Will it use language that a patient can understand? Will it talk about having a heart attack, or will it use medical information that a medical professional will need to assess? Or will it include both, so that the patient knows that they have had a heart attack, for example, but the medic can see the precise detail on what sort of transient ischaemic attack it was. We need to understand what the data is recording and at what level of detail.

[Dr Johnson]

If it is to include both, who will translate it into the simplest form and how much will that cost?

[Gregory Stafford]

Precisely. These questions need to be thought about when the Government are creating this system.

As hon. Members have described in their speeches and in their amendments, the system could contain much wider information, including highly sensitive information about disability, safeguarding, care assessments, addiction, pregnancy, military service, caring responsibilities and many other personal matters. This is not simply about a hospital record; it is about bringing together health and social care information. That makes it even more important—indeed, essential—that safeguards be clear and robust.

That leads me on to my fourth issue, which is confidentiality. The Bill says that where information is processed under the regulations, doing so will not breach any duty of confidence. I think that that is a significant legal challenge and change. Confidentiality has been one of the foundations of healthcare. Of course there are already situations in which information can and should be shared, but where Parliament is creating a new legal basis for disclosure, it is reasonable to expect strong safeguards alongside it.

That brings me to my next concern. The Bill says that the Secretary of State must have regard to the need for “adequate safeguards”. That is welcome, of course, but the Bill does not say what those safeguards are. There is nothing in it about role-based access controls, audit logs or whether patients would be able to see who had looked at their records. There is nothing about minimum cyber-security standards, about how inappropriate access will be detected or about independent oversight. Those matters may appear later in regulations or in guidance, but they are not guaranteed in the Bill.

[Liz Twist (Blaydon and Consett) (Lab)]

I thank the hon. Member for his clear summary, at the start of his speech, about what we are discussing, which is the regulations. He and other Members have rightly pointed out many issues that need to be resolved, but does he agree that the proper way to work through this very detailed and very real concern is through the regulations, which will come with expert advice and ensure that we cover all these points properly?

--- Later in debate ---

[Gregory Stafford]

On the hon. Lady’s specific question, I agree: the regulations will answer these questions. But I think it is entirely appropriate to have them asked here and to have a statement of the principles, at least, on a number of these things from Ministers, so that within a broad scope we can ensure that the Bill is appropriate. The amendments tabled by my hon. Friend the Member for Sleaford and North Hykeham, for example, seek to do so. They were clearly within the scope of the Bill; otherwise, they would not have been accepted.

The next issue is geographical scope, which I do not think anyone has touched on yet. The Bill allows information to be made available to people involved in

“health care or social care anywhere in the British Islands”.

That naturally raises questions about governance across different health systems. How will information be shared between England and the devolved nations? I think my hon. Friend mentioned some of the self-governing territories. I assume that she meant the Isle of Man, the Channel Islands and places like that—Crown dependencies. What rules will apply? How will accountability work where different organisations operate under different arrangements? Again, the Bill does not answer those questions.

[Helen Morgan]

The cross-border point is really important. A number of people will come into England from Wales to have their secondary care delivered, because that care is not available in Wales. The single patient record will presumably not be available to the clinicians in the hospitals in England who are dealing with the patients. I wonder whether we should consider how that will work when we get to the regulation stage, because other systems will clearly be needed to deal with the people who are coming from outside England to be treated in English hospitals and other settings.

[Gregory Stafford]

I read the clause differently. I am sure that the Minister can provide an answer, but my reading is that the single patient record could be—but not necessarily that it must be—used in Wales and Scotland as well. I do not know whether it has to be used, but the clause, as I read it, suggests that it would be. If a patient is travelling from Oswestry to somewhere in Shropshire or vice versa—

[Helen Morgan]

Oswestry is in Shropshire.

[Gregory Stafford]

My geography A-level has clearly departed me. If a patient is travelling from somewhere in Wales to Shropshire, the single patient record would be used. That also presents challenges the other way, if Wales and Scotland are using different technological solutions and systems and operating under different legal frameworks. That is especially the case for Scotland: it has quite a different legal system from England and Wales, so there could be issues.

[Dr Johnson]

The clause says that information could be made available

“to people involved in the provision to patients of health care or social care anywhere in the British Islands”.

That implies that the English system will be used to share information with people outside England—in the Isle of Man, the Channel Islands, Scotland, Wales or Northern Ireland—but it does not imply that those areas will necessarily have the same systems to share information with us.

[Gregory Stafford]

That is an interesting question. I do not know the answer, but perhaps the Minister can pick that up.

The Bill also creates powers for financial penalties. It sets out a process for notices and opportunities to make representations and a right of appeal. Those procedural protections are sensible, but the Bill does not tell us who might be fined or what conduct would trigger a penalty, and it does not set out a maximum penalty level. Those decisions, again, are left to regulations.

It is also important to remember that the Bill does not replace existing data protection law, as I think the Minister outlined in her opening remarks. Organisations will still have to comply with the Data Protection Act and other UK data protection rules. However, the Bill would provide a new statutory basis for processing information through the single patient record. That makes the wording of the Bill especially important. Ultimately, public confidence will determine whether the system succeeds. People are generally willing for information to be shared when it improves their care, but they also expect transparency, security and accountability and expect to know who can see their information and why. Those expectations are entirely reasonable.

There are several questions that I believe the Committee should ask before these powers are granted. Will patients have a genuine choice about participation? Will they be able to restrict access to particularly sensitive parts of their records? Who exactly will be able to access the system? Will patients be able to see a record of who has viewed their information? What minimum standards will apply? How will misuse be identified and punished? What independent oversight will exist? Those are not technical details; they are central to public confidence.

In conclusion, the clause will create a legal framework rather than a system itself. It will give broad powers to establish the single patient record while leaving many of the most important questions to future regulations. Clearly most people support the goal of improving patient care, but because the system will involve some of the most personal information that people have, Parliament should ensure that patient rights, safeguards, transparency and accountability are clearly built into the framework from the beginning. It should ensure that questions are asked now rather than decided on later.

[Karin Smyth]

I turn first to new clause 7. Patient data is at the heart of the NHS, and it is important to help plan and run health and social care services; we have discussed that before, and a lot of these points have already been recorded in our earlier conversations. The security and privacy of people’s health and care data are paramount. To be clear, the Bill does not rewrite our data protection laws; it works alongside them, allowing the NHS to use existing, lawful frameworks to share information safely and legally for the direct care of patients. Article 25 of the UK general data protection regulation already applies to the federated data platform, and will apply to the single patient record. The new clause is therefore not necessary.

In the NHS, there are different ways in which patient information is used, and not all of them involve asking for explicit consent each time. For example, if a GP refers someone to a hospital, that person would not expect the clinician reviewing the case to ask their permission before looking at their medical record; their agreement is understood as part of seeking care. That is called implied consent. Although a national data opt-out exists, it applies only to data used for secondary purposes such as research and planning.

The single patient record is expected to operate roles-based access control, whereby permission to access patient information is restricted to authorised users only, with an audit trail of who has accessed the patient’s data. Inappropriate or unauthorised access to health records, often referred to as snooping, is a serious offence. There are mechanisms to manage that, including prosecution and fines.

In 2025-26, we invested £75 million across health and social care, building on the £375 million invested since 2017. Through our ambitious cyber improvement programme, we are tackling the changing cyber risk head on, expanding protection and services to better protect the health and care system. The single patient record system is expected to be assessed as critical national infrastructure, with the highest standards of cyber-security and information governance to meet our existing duties to keep personal data safe under the data protection legislative framework.

I turn to new clause 8. No decision has been made about who will be the IT suppliers of the single patient record. It is expected and intended that it will be delivered through contracts with multiple suppliers, which will reduce dependency on a single supplier. Furthermore, no decision has been made as to how, if at all, the single patient record will link to existing infrastructure such as the federated data platform. As hon. Members will expect, I would not support using the Bill to try to rewrite the contract for the federated data platform.

Hon. Members have discussed a wide range of issues relating to this area. They probably know that negotiating the intellectual property in relation to software in digital services is complex and often contentious. The new clause would make it a condition of any single patient record IT supplier contract that the NHS owns the intellectual property in data connector software, regardless of the circumstances. In practical terms, that would be likely to disincentivise suppliers from offering their services if they were required to sacrifice the IP of a product. It is unnecessary to impose such a condition, as there are other ways in which the NHS can ensure that software is reusable, such as broad general licences to use the data connector software in whatever manner, requirements to use industry standard code and interfaces, and information standards.

The recent changes to the NHS information standards in the Data (Use and Access) Act 2025 make relevant IT suppliers accountable for meeting information standards and enable the Government to monitor and enforce compliance with information standards by IT suppliers. We wish to see a vibrant UK market in digital and technology, while ensuring that patients get the best technology to improve care outcomes and to keep the NHS financially sustainable. That will give the NHS more choice and help to improve standards while supporting economic growth.

We have had what they call a wide-ranging discussion on some things that are not actually in the clause. I agree with the hon. Member for Farnham and Bordon that it is absolutely right, and we have heard some excellent examples from Members with clinical experience. My hon. Friend the Member for Lichfield will now be forever known as Data Dave—sorry about that. The hon. Member for Sleaford and North Hykeham has clinical experience and my hon. Friend the Member for Ashford has NHS experience, as do I. That experience is really valuable. The Liberal Democrats tabled amendments and had a long list of questions, most of which are addressed in various pieces of information that we have put forward. However, I take the point about the intellectual difficulties of what the clause does. We all agree with it, as does the country, and patients think it already happens.

We are an outlier in this sphere. The Government are going to change that situation. However, these questions and concerns are the reason why we take through secondary legislation, which is something that we all understand but the outside world does not. We need to bring people with us. Our officials have come to talk to Members of Parliament about the Bill. I am open to suggestions from Members about the best way to address the issues, and particularly about the best way to inform Members on behalf of constituents. These discussions are important to building public trust and security.

I will finish on a broader point. I commend clause 47, which gives an enabling power, but let us be very clear that patient information will still be held in the system in which it was originally created. These bodies, whether GPs or hospitals, will continue to be responsible for ensuring that the data is handled securely and lawfully and is accessed for valid reasons only. As I mentioned earlier, we have shared systems operating already. Some parts of the country and some of our constituents are already experiencing some of the benefits of a shared system. We will use that experience and learn the lessons of the past, under whichever Government, to build for the rest of the country the shared systems that some people have already. We will come on later to provisions on devolution arrangements, on working for the future and on operating more efficiently across devolved areas.