Health Bill (Eleventh sitting)

Karin Smyth Excerpts

Committee stage
Thursday 2nd July 2026 Public Bill Committees

The Committee should also consider the genuine need to access such information. While I can see the benefits, which I have outlined, there is the potential for every possible determinant of health to end up in the single patient record. I am trying not to be flippant, but whether someone drives a car, where they went to school and their parents’ medical histories could all be relevant to their medical history. Although I completely understand the intention and the way in which the hon. Member for Winchester wishes to expand the single patient record, we are in danger of making it such an enormous beast that it becomes unwieldy and unusable. We need to be really cautious before going down a route where it essentially becomes a repository for the story of people’s lives.

[The Minister for Secondary Care (Karin Smyth)]

Wherever possible, the single patient record will build on source records such as GP records. As such, it will include relevant patient information and, where appropriate, digital markers such as those suggested in the amendments. We have had some useful discussion as a result of the amendments, but such considerations are generally operational, and legislation is neither necessary nor practical.

On amendment 71, Members will know that the Government have been doing significant work in support of a digital medical marker for firearms. Medical information for firearms licensing provided by the applicant has been a mandatory requirement for every firearm and shotgun licence application since November 2021, as we have heard, when the new statutory guidance for chief officers of police on firearms licensing was introduced. When any individual applies for a firearms licence, the applicant’s doctor must provide details of any relevant medical conditions, such as depression, dementia, mental health conditions or drug or alcohol abuse.

A digital maker is placed on the GP patient record when a certificate is granted, and a GP can alert the police if a licence holder has a relevant medical condition. The digital marker automatically flags to the GP if a patient is suffering from a relevant medical condition and is a firearms certificate holder. It is true that the marker is not legally mandated, but it is supported by the British Medical Association and the Royal College of General Practitioners, and the former issues guidance to GPs about the firearms marker.

GPs already have professional duties to consider patient and public safety, and existing firearms licensing arrangements support GPs to share relevant concerns with the police where appropriate, while the responsibility for licensing decisions rests with the police. Data shows that, since its introduction in 2023, the marker is being used and that GPs are notifying police of medical issues that have arisen. There is nothing to suggest that the system is not effective.

[Dr Johnson]

Is it not also the case that anyone who is aware that an employee or relative has a licence and is concerned about their mental health can make such a report?

[Karin Smyth]

I am afraid I do not know the answer to the hon. Lady’s question, but if it is relevant, I will try to get back to her on it.

People applying for a licence must now indicate whether they have seen a medical practitioner other than their GP. The Government also intend to make a statutory instrument to require licence holders to inform the police if they consult a third-party medical practitioner who is not their GP.

The single patient record will build on and connect with information from GP source records where appropriate; no new provision is needed for that to happen. That process should be agreed as part of operational arrangements with the profession, in line with the current approach to markers in the GP record. If it is agreed that it would be beneficial for health and care professionals to have wider access to the firearms marker, the single patient record could facilitate that, but we do not intend to fill the Bill with detailed operational requirements such as that.

We do not believe that the SPR is the appropriate vehicle for having a debate about regulations requiring a report on the merits of a mandatory marker. As the hon. Member for Farnham and Bordon said, we should not expand the clearly defined scope of the single patient record—the scope is limited to direct care—to include a debate about what is stored more generally in NHS records. For those reasons, I ask the hon. Member for Winchester to withdraw amendment 71.

On amendment 72, as I have already outlined, the single patient record will build on and connect with existing source records, such as GP or hospital records, wherever possible. Where a person’s status as a military veteran is recorded, it will be possible to make that information available in the single patient record. Therefore, the provisions already ensure that the information is made available, where veterans opt to have that status recorded—that addresses some of the other issues raised by the hon. Member for Farnham and Bordon. There is no need to make any statutory requirement to ensure that staff have that information and consider any necessary adjustments or potential treatment options that may be relevant to ensure safe and effective care.

In addition, the clause contains powers to make regulations to allow people involved in the provision of an individual’s direct care, including that of any veteran after they have left the military, to access their single patient record. We want the single patient record to improve the accessibility and effectiveness of care for everyone. That includes making sure that military veterans can access necessary support and that staff can provide them with appropriate care. Furthermore, duties in the Armed Forces Act 2006 require the NHS and local authorities to have due regard to the armed forces covenant, which, of course, I fully support. For those reasons, I ask the hon. Member for Winchester not to press amendment 72.

[Dr Chambers]

I thank all hon. Members for their input, and the Minister for her insights. I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

--- Later in debate ---

[Dr Johnson]

I am advised to declare that, although I am not a licence holder of a shotgun or a rifle, my husband has both a shotgun and a firearms licence.

[Karin Smyth]

I am grateful to hon. Members for this debate. Meaningful public engagement will be key to the success of the single patient record—we absolutely understand that—in building awareness and in designing the system. It has to have digital inclusion at its heart, but adding statutory requirements for public awareness campaigns and risk assessments is not the way forward. Amendment 49 seeks to put such a requirement on a statutory footing. I want to reassure the Committee and all Members: as the right hon. Member for Melton and Syston said, public awareness is absolutely key and will be integral to success. Work is already under way to ensure that we do that; we do not need to wait, nor should we be constrained by the proposed amendment.

In 2024, we began extensive public engagement on the use of data across health and social care, which showed strong support for the single patient record. We have heard that most people felt it was

“long overdue and a necessary step towards better care”.

The public engagement findings indicated support to progress at pace on the concept of a single patient record, to resolve the frustrations that patients and the public have when they have to repeat their story at multiple health and care settings.

As we move towards our ambition to give all patients in England access to a core set of their data through the single patient record from 2028, we will maintain a sustained drumbeat—as they say in the jargon—of public communications to raise awareness of the single patient record. We have heard some examples of where the Government do that well. Of course we want to learn from such examples across the country and from previous Government campaigns that have worked well, to explain the benefits and safeguards in plain English, and to signpost accessible information and feedback routes for patients and the public. I heard the comments made about people who may be excluded or have particular disabilities, including some older people—from conversations with my own constituents, it is often older people or those with multiple disabilities who can have their experience enhanced. We should make no assumptions about who does or does not feel excluded in this space; we need to learn from them all.

Furthermore, we have already published public-facing single patient record information and a dedicated feedback route. We will continue to co-create plain English, easy-read and translated materials, frequently asked questions and “voices heard/action taken” updates with public panels and patient groups ahead of roll-out. We will build on what we learn from that ongoing work as we develop the regulations. For those reasons, I respectfully ask the hon. Member for Sleaford and North Hykeham not to move amendment 49.

On the lead amendment, moved by the hon. Member for North Shropshire, we recognise, as I hope I have assured the Committee, that digital inclusion is an important issue. To quote another Member, we are eager to get it right, and we are taking it very seriously. Digital inclusion is a key driver in addressing health inequalities, supporting individuals and empowering people to better manage their health, which is at the heart of our 10-year plan. It is a system-wide issue, and one that the health and care system is taking action to address. We have considered this as part of the equality impact assessment of the single patient record provisions in the Bill, and will continue to keep those issues and potential mitigations under consideration throughout the development and implementation of the SPR. Therefore, although we agree with the aim of the amendment, we do not consider it necessary. Indeed, it would duplicate work that has already been done.

[Helen Morgan]

We have not seen a full design of the single patient record yet, but it is difficult to envisage what it would looks like for somebody who does not have access to the internet. It is not just older people; it is obviously a significant problem in deprived areas as well. Can the Minister elaborate on what that might look like for somebody who does not have a device or does not have broadband or mobile access? How will they be able to access their medical record? We might need to understand that before we move forward.

[Karin Smyth]

The hon. Lady makes an excellent point. Part the difficulty is that the powers in the Bill that enable the Government to bring forward a single patient record are separate from the secondary routes whereby we describe and work through the detail of regulation. All those considerations have to be very clear. The hon. Lady and I have spoken regularly about the lack of broadband access in her community, which remains a huge problem. All those considerations need to be worked through with the team. They are varied and multiple, and we need to bring parliamentarians and the public with us in doing that, as we bring forward secondary regulations.

NHS England’s digital inclusion framework, as currently, supports the delivery of the 10-year plan by addressing those particular connectivity and skills issues, as well as confidence and accessibility. That work is already partly in train through NHS England. We need to build on that and bring it forward as we come forward with the regulations. I visited the team up in Leeds around some of the digital inclusion they have already been doing from the app. It is very impressive how much they are doing with people to develop the app. I think people would agree that we can take some of that learning forward, because it is about making sure that digital transformation is inclusive and aligned with the ambition in the 10-year plan to personalise care, reduce inequalities and create a health system that works for everyone.

In addition, as set out in the “Managing health services for others” guidance, since February 2026 the NHS has had a process to allow proxy access to the app, which should also support people who, for example, do not have the skills to do it for themselves. Alongside those improvements, it is policy to undertake an inequality and health inequalities assessment prior to hosting anything new on the app. Again, that helps to identify, mitigate and monitor unintended negative impacts on vulnerable and marginalised populations before implementing new policy, services and procedures, as raised by the hon. Member for North Shropshire. That process should identify and consider the mitigations for the groups identified in the amendment.

I hope that Members can see how seriously the Government have taken the development of digital access so far. We absolutely recognise that we have to get it right to enable this record, which the public and population so desperately want to see. That work has already been undertaken and it will continue. For those reasons, I ask that the amendment be withdrawn.

[Helen Morgan]

The importance of the amendment is that it requires this problem to be monitored in an ongoing way. Monitoring something usually makes the situation improve, so I will not withdraw the amendment.

Question put, That the amendment be made.

--- Later in debate ---

[Karin Smyth]

This is another important discussion to have on the record to give patients and the public confidence as we introduce the vital single patient record. I start by stating that the security and privacy of people’s health data is paramount, and we will build the strongest safeguards possible into the record. Members from across the House have asked how those safeguards will be built into how the system is designed and operated, which is what we are doing.

It will operate on a roles-based access control model, similar to other NHS patient record systems where access to patient information is restricted to the authorised user only. The single patient record will go a step further by applying advanced cloud-based audit and oversight capabilities, enabling near real-time monitoring of system access and detection of unusual or inappropriate patterns. That will allow NHS security teams to track and detect access patterns, and to quickly intervene if specific records are accessed by staff who have no clinical relationship with the patient in question.

The single patient record will ensure that just because a clinician has permission to view a specific patient record, that does not mean they are authorised to do so without a clinical need. The security and access arrangements will be set out in the regulations themselves, which will be debated, rightly, in Parliament. Therefore, it is not necessary to set them out in a plan beforehand.

Furthermore, there are already existing enforcement arrangements that provide sanctions for inappropriate access to patient data, which will also include accessing the single patient record. I commend my hon. Friend the Member for Ashford for his extremely helpful intervention, in which he highlighted his own experience in this field. Some of the examples that we heard again today, including Southport, Nottingham, the recent case in Cambridge and others, are truly shocking to people. Clearly, that should never happen, but sadly it has. As my hon. Friend rightly outlined, there are provisions in place for training people on information governance and tracking when that happens.

Additionally, I want to be clear that the Computer Misuse Act 1990 makes it an offence to use a computer to access information in an unauthorised manner, such as a person accessing information without a legitimate reason. Inappropriate or unauthorised access to health records—often referred to as snooping—is a serious offence that can lead to severe penalties, including dismissal, criminal prosecution and financial penalties. Regulated healthcare professionals, such as doctors, nurses and pharmacies, can be reported to their respective professional bodies, which can result in them being struck off in serious cases.

The information commissioner also has powers to investigate and take action against infringements of data protection legislation, which can include monetary penalties, enforcement notices, undertakings, prosecutions and reprimands. Furthermore, patients have a right to access data that is held about them under the data protection legislation, and those rights will continue to apply to the single patient record. For those reasons, I ask the hon. Member for Sleaford and North Hykeham to withdraw her amendment.

[Dr Johnson]

We think this is an important issue, so we would like to divide the Committee.

Question put, That the amendment be made.

--- Later in debate ---

[The Chair]

With this it will be convenient to discuss the following:

New clause 7—Privacy by design in NHS Single Patient Record and Federated Data Platform architecture—

“(1) The Secretary of State must ensure that there is privacy by design as part of the delivery of the NHS Federated Data Platform architecture.

(2) For the purposes of subsection (1), privacy by design includes—

(a) patient data anonymisation outside its usage by clinicians and within the National Data Integration Tenant; and

(b) patient consent for the processing of personal information by NHS.”

New clause 8—NHS ownership of connection software—

“(1) The Secretary of State must ensure that there is NHS ownership of any data connector software architecture used as part of the delivery of the NHS Single Patient Record or Federated Data Platform.

(2) In this section, a data connector means an interface or connection between the NHS Federated Data Platform and any other health system.”

[Karin Smyth]

The single patient record is fundamental to the Government’s mission to create a modern, joined-up NHS that puts patients at the centre of their care. The way we currently manage health records is letting patients down. That must change. Patient information is fragmented, so care is fragmented.

Local shared care records have demonstrated what can be achieved. The OneLondon shared care record is used by more than 100,000 frontline staff, with estimated monthly savings of £4.6 million, and around 45,000 patients are reported to have benefited from the Greater Manchester care record in March 2026, with 15 minutes of treatment time saved per patient.

Successful as some local shared care records are, however, they do not provide a uniform, comprehensive single record across England. The single patient record will allow people to have access to a summary of their full health record and provide relevant health and care providers with access to the health and care information they need to provide effective joined-up care.

This is not a new problem and patients have not been silent about it. For more than a decade, patient groups and organisations across the country have been calling for exactly the kind of change that the single patient record will deliver. As far back as 2013, National Voices captured it simply and powerfully:

“I would like to tell my story once.”

The call has only got stronger. Our independently delivered public deliberations found strong support for the single patient record. It was described as a long-overdue fix to fragmented care, while the survey of 2,000 people found more than three quarters in favour of a single patient record. The Committee has heard directly from a range of stakeholders about the benefits a single patient record could have for patients and their care.

Clause 47 enables the Secretary of State to make regulations for the purpose of creating and operating the single patient record. The purpose of regulations made under this clause is to bring together patient information and make it available to patients and their relevant health and care providers such as GPs, hospital doctors, social care providers or others involved in their direct care. Only information concerned with direct care will form part of the system.

We have also included strong safeguards. The security and privacy of people’s health and social care data are paramount, and we will build the strongest of safeguards into the single patient record. It will be designed to protect personal data by default, with the highest standards of cyber-security and information governance ensuring that only the right people can access the right information, at the right time—and only for the right reasons. Permissions to access patient information will be restricted to authorised users only, with an audit trail of who has accessed a patient’s data. The Secretary of State must also consult appropriate persons before making regulations and must have regard to ensuring that adequate safeguards are in place to prevent misuses of data.

--- Later in debate ---

[Gregory Stafford]

That is an interesting question. I do not know the answer, but perhaps the Minister can pick that up.

The Bill also creates powers for financial penalties. It sets out a process for notices and opportunities to make representations and a right of appeal. Those procedural protections are sensible, but the Bill does not tell us who might be fined or what conduct would trigger a penalty, and it does not set out a maximum penalty level. Those decisions, again, are left to regulations.

It is also important to remember that the Bill does not replace existing data protection law, as I think the Minister outlined in her opening remarks. Organisations will still have to comply with the Data Protection Act and other UK data protection rules. However, the Bill would provide a new statutory basis for processing information through the single patient record. That makes the wording of the Bill especially important. Ultimately, public confidence will determine whether the system succeeds. People are generally willing for information to be shared when it improves their care, but they also expect transparency, security and accountability and expect to know who can see their information and why. Those expectations are entirely reasonable.

There are several questions that I believe the Committee should ask before these powers are granted. Will patients have a genuine choice about participation? Will they be able to restrict access to particularly sensitive parts of their records? Who exactly will be able to access the system? Will patients be able to see a record of who has viewed their information? What minimum standards will apply? How will misuse be identified and punished? What independent oversight will exist? Those are not technical details; they are central to public confidence.

In conclusion, the clause will create a legal framework rather than a system itself. It will give broad powers to establish the single patient record while leaving many of the most important questions to future regulations. Clearly most people support the goal of improving patient care, but because the system will involve some of the most personal information that people have, Parliament should ensure that patient rights, safeguards, transparency and accountability are clearly built into the framework from the beginning. It should ensure that questions are asked now rather than decided on later.

[Karin Smyth]

I turn first to new clause 7. Patient data is at the heart of the NHS, and it is important to help plan and run health and social care services; we have discussed that before, and a lot of these points have already been recorded in our earlier conversations. The security and privacy of people’s health and care data are paramount. To be clear, the Bill does not rewrite our data protection laws; it works alongside them, allowing the NHS to use existing, lawful frameworks to share information safely and legally for the direct care of patients. Article 25 of the UK general data protection regulation already applies to the federated data platform, and will apply to the single patient record. The new clause is therefore not necessary.

In the NHS, there are different ways in which patient information is used, and not all of them involve asking for explicit consent each time. For example, if a GP refers someone to a hospital, that person would not expect the clinician reviewing the case to ask their permission before looking at their medical record; their agreement is understood as part of seeking care. That is called implied consent. Although a national data opt-out exists, it applies only to data used for secondary purposes such as research and planning.

The single patient record is expected to operate roles-based access control, whereby permission to access patient information is restricted to authorised users only, with an audit trail of who has accessed the patient’s data. Inappropriate or unauthorised access to health records, often referred to as snooping, is a serious offence. There are mechanisms to manage that, including prosecution and fines.

In 2025-26, we invested £75 million across health and social care, building on the £375 million invested since 2017. Through our ambitious cyber improvement programme, we are tackling the changing cyber risk head on, expanding protection and services to better protect the health and care system. The single patient record system is expected to be assessed as critical national infrastructure, with the highest standards of cyber-security and information governance to meet our existing duties to keep personal data safe under the data protection legislative framework.

I turn to new clause 8. No decision has been made about who will be the IT suppliers of the single patient record. It is expected and intended that it will be delivered through contracts with multiple suppliers, which will reduce dependency on a single supplier. Furthermore, no decision has been made as to how, if at all, the single patient record will link to existing infrastructure such as the federated data platform. As hon. Members will expect, I would not support using the Bill to try to rewrite the contract for the federated data platform.

Hon. Members have discussed a wide range of issues relating to this area. They probably know that negotiating the intellectual property in relation to software in digital services is complex and often contentious. The new clause would make it a condition of any single patient record IT supplier contract that the NHS owns the intellectual property in data connector software, regardless of the circumstances. In practical terms, that would be likely to disincentivise suppliers from offering their services if they were required to sacrifice the IP of a product. It is unnecessary to impose such a condition, as there are other ways in which the NHS can ensure that software is reusable, such as broad general licences to use the data connector software in whatever manner, requirements to use industry standard code and interfaces, and information standards.

The recent changes to the NHS information standards in the Data (Use and Access) Act 2025 make relevant IT suppliers accountable for meeting information standards and enable the Government to monitor and enforce compliance with information standards by IT suppliers. We wish to see a vibrant UK market in digital and technology, while ensuring that patients get the best technology to improve care outcomes and to keep the NHS financially sustainable. That will give the NHS more choice and help to improve standards while supporting economic growth.

We have had what they call a wide-ranging discussion on some things that are not actually in the clause. I agree with the hon. Member for Farnham and Bordon that it is absolutely right, and we have heard some excellent examples from Members with clinical experience. My hon. Friend the Member for Lichfield will now be forever known as Data Dave—sorry about that. The hon. Member for Sleaford and North Hykeham has clinical experience and my hon. Friend the Member for Ashford has NHS experience, as do I. That experience is really valuable. The Liberal Democrats tabled amendments and had a long list of questions, most of which are addressed in various pieces of information that we have put forward. However, I take the point about the intellectual difficulties of what the clause does. We all agree with it, as does the country, and patients think it already happens.

We are an outlier in this sphere. The Government are going to change that situation. However, these questions and concerns are the reason why we take through secondary legislation, which is something that we all understand but the outside world does not. We need to bring people with us. Our officials have come to talk to Members of Parliament about the Bill. I am open to suggestions from Members about the best way to address the issues, and particularly about the best way to inform Members on behalf of constituents. These discussions are important to building public trust and security.

I will finish on a broader point. I commend clause 47, which gives an enabling power, but let us be very clear that patient information will still be held in the system in which it was originally created. These bodies, whether GPs or hospitals, will continue to be responsible for ensuring that the data is handled securely and lawfully and is accessed for valid reasons only. As I mentioned earlier, we have shared systems operating already. Some parts of the country and some of our constituents are already experiencing some of the benefits of a shared system. We will use that experience and learn the lessons of the past, under whichever Government, to build for the rest of the country the shared systems that some people have already. We will come on later to provisions on devolution arrangements, on working for the future and on operating more efficiently across devolved areas.

[Joe Robertson]

I thank the Minister for clarifying that the data will continue to be stored and held in the databases in the electronic record-keeping system where it is currently kept. I am not looking for her to give me a detailed solution on the spot, but does she accept that unless there is seamless interoperability across all those systems the single patient record will not be realised, and that we are still an awfully long way from seamless interoperability across England, let alone the UK?

[Karin Smyth]

The hon. Gentleman tempts me to spend the next hour talking about the shocking state of the capital and infrastructure systems that we inherited from the previous Government, but I will not. Of course they do not work: that is one of the biggest issues around staff morale. We saw through the 10-year health plan, particularly with clinicians having to log on to nearly 10 different systems, how that impedes progress and efficiency at a local level. Where it is rolled out, the federated data platform helps to make systems more efficient, particularly in local hospitals. We heard in our evidence sessions about maternity and frailty, which are the areas in which we will be testing and rolling out this approach to make the best use of it on the ground. Alongside that, the work to make systems more interoperable and efficient at a local level continues. I commend clause 47 to the Committee.

Question put and agreed to.

Clause 47 accordingly ordered to stand part of the Bill.

Clause 48

Information about health service products

Question proposed, That the clause stand part of the Bill.

[Karin Smyth]

Clause 48 will make amendments to the health service products legislative information gateway to allow the Government to continue to disclose certain information concerning the pricing and supply of health service products, which are items that include medicines that are used in the NHS. We recognise the importance of the effective flow of information between central Government about the pricing and supply of health service products to the NHS. Data sharing is governed by a clear legal framework defining who can access it and under what conditions. That supports the controls that the Government are able to exercise in relation to the pricing and supply of health service products.

Clause 48 will maintain the current safeguards for confidential and commercially sensitive data, ensuring continuity as NHS England’s functions are redistributed to the Secretary of State and integrated care boards. It will achieve that by enabling the Secretary of State to share pricing and supply information with people who provide services to them, such as primary care providers. That is essential to preserve the sharing of information and operation of the service that they provide for patients where that process is currently managed by NHS England.

As a consequence of the changes being made, the Secretary of State will be able to share relevant information with third-party service providers, such as providers of the software that primary care service providers use. They will be able to receive relevant data to make lawful disclosures of that information for specific purposes, those being the provision of certain services to the primary care service provider. This will ensure that there is no disruption to how data flows across the system.

This change will simply enable those who receive essential data to continue to do so following the abolition of NHS England. I commend the clause to the Committee.

Question put and agreed to.

Clause 48 accordingly ordered to stand part of the Bill.

Clause 49

Health and social care information: delegation of functions

--- Later in debate ---

[The Chair]

With this it will be convenient to discuss the following:

Clause 50 stand part.

Amendment 6, in schedule 7, page 96, leave out lines 38 and 39 and insert—

“For section 255 (power to request NHS England to establish information systems), substitute—

‘255 Powers to request the Secretary of State to establish information systems

(1) Any person (including a devolved authority) may request the Secretary of State to establish and operate a system for the collection or analysis of information of a description specified in the request.

(2) A request may be made under subsection (1) by a person only if the person considers that the information which could be obtained by complying with the request is information which it is necessary or expedient for the person to have in relation to the person's exercise of functions, or carrying out of activities, in connection with the provision of health care or adult social care.

(3) The Secretary of State must comply with a mandatory request unless the Secretary of State considers that the request relates to information of a description prescribed in regulations.

(4) For the purposes of this Chapter a request under subsection (1) is a mandatory request if—

(a) it is made by a principal body, and

(b) the body considers that the information which could be obtained by complying with the request is information which it is necessary or expedient for the body to have in relation to its discharge of a duty in connection with the provision of health services or of adult social care in England.

(5) Subsection (6) applies where the Secretary of State has discretion under this section as to whether to comply with—

(a) a mandatory request, or

(b) any other request under subsection (1).

(6) In deciding whether to comply with the request, the Secretary of State —

(a) must, in particular, consider whether doing so would interfere to an unreasonable extent with the exercise by the Secretary of State of any of its functions, and

(b) may take into account the extent to which the principal body or other person making the request has had regard to—

(i) the code of practice prepared and published by the Secretary of State under section 263, and

(ii) advice or guidance given by the Secretary of State under section 265.

(7) In this section “principal body” means—

(a) the Care Quality Commission,

(b) the National Institute for Health and Care Excellence, and

(c) such other persons as may be prescribed in regulations.

(8) In this Chapter “health care” includes all forms of health care whether relating to physical or mental health and also includes procedures that are similar to forms of medical or surgical care but are not provided in connection with a medical condition.’”

This amendment would enable the Care Quality Commission and NICE to continue to make mandatory requests to the Secretary of State to establish an information system, following the transfer of NHS England’s functions.

Amendment 7, in schedule 7, page 100, leave out paragraph 14.

This amendment is consequential on Amendment 6.

Schedule 7.

[Karin Smyth]

Clauses 49 and 50 explain our approach to the transfer of NHS England’s existing data and information functions to the Secretary of State. Slightly counterintuitively, I will start with clause 50 before turning to clause 49.

Clause 50 inserts schedule 7, which takes existing NHS England information functions and transfers them to the Secretary of State for Health and Social Care, as part of a single centre for data and digital policy in the NHS. The schedule also includes changes to existing information functions. This will support the shift from analogue to digital and allow us to make the most of opportunities from data and AI, as set out in the 10-year health plan. The changes will not weaken the fundamental safeguards in place to protect health and care data, nor fundamentally change rules relating to how confidential patient information can be used.

I will now outline some key changes made by the clause. It will ensure that information systems for the NHS are set up, where appropriate, not just for the collection and analysis of data but for processing more generally. This will make it easier to support machine learning and artificial intelligence activities, among other uses of data.

The clause extends the extent of chapter 2 of part 9 of the Health and Social Care Act 2012 to the whole of the UK, and provides for the Secretary of State to establish information systems in the interests of the health service or adult social care in England, or in connection with the provision of care across the British Isles, as NHS England currently can.

The clause enables the Secretary of State to issue guidance to health and social care bodies on the processing of information. It transfers to the Secretary of State NHS England’s powers to require and request information, and such requests will be able specify the form, manner and time within which the information requested is to be provided.

The clause also allows the Secretary of State to publish information obtained in the operation of an information system, including information about service providers. Where NHS England had a duty to publish such information, it is right that the Secretary of State should retain discretion in that regard. Obviously, there may be circumstances in which the publication of data would not be appropriate, and the clause does not give the Secretary of State complete freedom to publish personal information. The Secretary of State may publish personal information without patient consent only where it is for the protection of life or health, or for the protection of public safety or security. It is possible that there could be circumstances—for example, in relation to infectious disease—in which information is published that could lead to an individual being identified. None the less, the change simplifies the process of publication while maintaining a high bar for the publication of personal information.

The Secretary of State’s power to disclose information—for example, to health bodies—other than by publication will be slightly different from NHS England’s current power. The grounds for disclosing personal information will largely mirror the current grounds, with a few additions, including in respect of facilitating clinical trials or other research. This will help to address barriers to data access for research while preserving existing rules on confidentiality. As with his powers of publication, the Secretary of State will also be able to disclose information for the protection of life or health, or for the protection of public safety or security.

The Secretary of State will be bound by certain existing duties on NHS England, including a duty to have regard to any relevant advice from the Confidentiality Advisory Group when publishing or disclosing information in accordance with his data functions. The Secretary of State will retain the regulation-making power to establish an accreditation scheme for information service providers, which will now include a broader range of providers, including public bodies.

Clause 49 permits the Secretary of State to delegate certain functions relating to health and care information. Currently, some of those functions can be delegated by NHSE via arrangements with third parties or under regulations. The clause will insert new section 251ZF, which allows the Secretary of State, by arrangement, to delegate to persons specified in regulations functions relating to information standards.

Information standards help to reduce fragmentation in digital and data services. They include mandatory requirements for how information is recorded, shared, governed and supported by IT. Increasing interoperability and consistency in digital and data is essential to increasing value for money, reducing the burden on staff and, ultimately, improving the quality of care. The continued use of information standards is key to the 10-year health plan’s aim of improving the interoperability of digital and data services across the health and care system. This will provide the Secretary of State with the flexibility to delegate such functions to persons who have the required technical expertise, where necessary.

Clause 49 will also insert new section 277G, which enables the Secretary of State to direct public bodies to exercise a wider range of his information functions, defined as “relevant information functions”. This includes not only information standards but other information functions, such as the Secretary of State’s duty to establish and operate information systems. The measures will provide the Secretary of State with important flexibility to delegate such functions to persons who have the required technical expertise, where necessary.

In all, the changes are necessary not just to effect the transfer of data functions to the Secretary of State but to enable better data use for the benefit of the NHS now and into the future.

[Dr Johnson]

I have a couple of questions. In lots of ways the provisions derive from clause 1 and the abolition of NHS England. Schedule 7 refers to operating a system in the interests of the health service, which is not the same as operating it in the interests of the patients. Does the Minister have any comments on that? The Nuffield Trust has pointed out that schedule 7 would not pass over to the Secretary of State NHSE’s duty to report to Parliament. Is that because the Minister thinks that duty is duplicated elsewhere and is therefore not necessary?

Under the previous legislation, the Care Quality Commission was slightly stronger and could make a mandatory request that NHS England establish a system, and NHS England had to comply with that unless it related to an existing exception. Now if the CQC makes a request, it goes to the Secretary of State, and whether it is agreed to is then somewhat more optional. Will the Minister say why she needs to change that power?

[Helen Morgan]

I want to speak to amendment 6, which is tabled in my name, and amendment 7, which is consequential upon it. Amendment 6 would ensure that the CQC and NICE can

“continue to make mandatory requests to the Secretary of State to establish an information system”,

as they currently can with NHS England. At the moment, NHS England has a duty to co-operate with the CQC and NICE, and that is often enough for a collaborative approach that allows the CQC to access the data it needs.

But the duty that applies to NHS England is not being passed on to the Department of Health and Social Care. The CQC raised the issue in written evidence to the Committee, saying that the duty

“has been an important mechanism”

that has

“supported receipt of patient safety incident reports…information sharing between regional teams, and the development of central data sharing solutions.”

The CQC went on:

“Without an equivalent duty, we would be reliant on there being sufficient capacity and willingness within DHSC to share information, with no statutory backstop. This could inhibit our ability to receive the information”

needed

“to keep people who use services safe. Challenges in this area are often cultural and rely on the subjective judgment of individual data controllers as to whether particular data sets can be shared, how these should be used and what the timeliness of sharing should be, leading to protracted piecemeal conversations and delays.”

As we have harrowingly heard over the past week, there is often reluctance to share data, particularly when there is a defensive culture in certain NHS institutions. Our amendment seeks to address the gap. I hope that what I have outlined is an oversight from the Government, not a deliberate attempt to reduce transparency or reduce regulator access to key data. The wider changes in schedule 11 will omit section 288 of the Health and Social Care Act 2012. The Government are dropping this key wider duty in a schedule entitled “Minor and consequential amendments”. We do not think it is minor. It holds major implications for patient safety and transparency.

On a wider note, it seems counterintuitive that the CQC, as regulator, does not have easy access to the data collected nationally in the health service.

[Karin Smyth]

Let me respond to the hon. Member for North Shropshire on amendments 6 and 7. As she said, amendment 7 is consequential on amendment 6, so I will take them together.

I think we can all agree that the CQC and NICE should have access to the information they need to undertake their important work. Amendment 6 is not required to ensure that. Clause 50, and the associated changes in schedule 7, maintain the current ability for any person, including NICE and the CQC, to request the establishment and operation of an information system. However, NICE and the CQC will not be able to make the equivalent mandatory request they used to be able to make to NHS England because NHS England is to be abolished.

Amendment 6 seeks to maintain the current position when, in reality, mandatory requests were practically never made under the current arrangements. They were thought necessary when a separate arm’s length body had responsibility for collecting data about healthcare. There is no need for the Secretary of State to be subject to the same mandatory requirement as they are responsible for oversight of the entirety of the NHS and the adult social care system, and for its effective regulation.

Furthermore, the CQC has a statutory power, under section 64 of the Health and Social Care Act 2008, to require the provision of

“documents, records (including personal and medical records) or other items”

the CQC considers “necessary or expedient” for the purposes of its regulatory functions, from a range of health and social care commissioners and providers.

On amendment 7, the Government agree that a code of practice setting out strict standards for how health and care organisations must handle confidential patient information is an important component of a healthcare system that uses data safely and effectively. That is why clause 50 allows for the insertion of new section 252ZA into the National Health Service Act 2006, to transfer to the Secretary of State the duty to publish a code of practice on confidential patient information. For those reasons, I ask the hon. Member for North Shropshire not to press amendments 6 and 7 to a vote.

The hon. Member for Sleaford and North Hykeham asked about duplication. I think the answer to her question is yes, but if that is not correct, I will make sure that I respond to her accordingly.

Question put and agreed to.

Clause 49 accordingly ordered to stand part of the Bill.

Clause 50 ordered to stand part of the Bill.

Schedule 7

Health and social care information systems etc

Amendment proposed: 6, in schedule 7, page 96, leave out lines 38 and 39 and insert—

“For section 255 (power to request NHS England to establish information systems), substitute—

‘255 Powers to request the Secretary of State to establish information systems

(1) Any person (including a devolved authority) may request the Secretary of State to establish and operate a system for the collection or analysis of information of a description specified in the request.

(2) A request may be made under subsection (1) by a person only if the person considers that the information which could be obtained by complying with the request is information which it is necessary or expedient for the person to have in relation to the person's exercise of functions, or carrying out of activities, in connection with the provision of health care or adult social care.

(3) The Secretary of State must comply with a mandatory request unless the Secretary of State considers that the request relates to information of a description prescribed in regulations.

(4) For the purposes of this Chapter a request under subsection (1) is a mandatory request if—

(a) it is made by a principal body, and

(b) the body considers that the information which could be obtained by complying with the request is information which it is necessary or expedient for the body to have in relation to its discharge of a duty in connection with the provision of health services or of adult social care in England.

(5) Subsection (6) applies where the Secretary of State has discretion under this section as to whether to comply with—

(a) a mandatory request, or

(b) any other request under subsection (1).

(6) In deciding whether to comply with the request, the Secretary of State —

(a) must, in particular, consider whether doing so would interfere to an unreasonable extent with the exercise by the Secretary of State of any of its functions, and

(b) may take into account the extent to which the principal body or other person making the request has had regard to—

(i) the code of practice prepared and published by the Secretary of State under section 263, and

(ii) advice or guidance given by the Secretary of State under section 265.

(7) In this section “principal body” means—

(a) the Care Quality Commission,

(b) the National Institute for Health and Care Excellence, and

(c) such other persons as may be prescribed in regulations.

(8) In this Chapter “health care” includes all forms of health care whether relating to physical or mental health and also includes procedures that are similar to forms of medical or surgical care but are not provided in connection with a medical condition.’”—(Helen Morgan.)

This amendment would enable the Care Quality Commission and NICE to continue to make mandatory requests to the Secretary of State to establish an information system, following the transfer of NHS England’s functions.

Question put, That the amendment be made.

--- Later in debate ---

Question proposed, That the clause stand part of the Bill.

[Karin Smyth]

Clause 51 makes changes to section 42 of the Statistics and Registration Service Act 2007, which governs how information collected at the registration of births, deaths and other life events may be shared for specific purposes. That information plays a vital role in supporting public services, including health service planning, population analysis and the delivery of care. The UK Statistics Authority may already share this registration data directly with a range of public bodies, including the Secretary of State and integrated care boards.

Clause 51 adds NHS trusts and NHS foundation trusts in England to that list, providing a clear statutory route for sharing statistically codified registration data with trusts and foundation trusts responsible for delivering services on the ground. The clause is not about expanding the type of information that can be shared or widening the purposes for which it may be used, and does not create new datasets or weaken existing safeguards. All information sharing remains subject to the same statutory controls and protections that already apply. I commend the clause to the Committee.

Question put and agreed to.

Clause 51 accordingly ordered to stand part of the Bill.

Clause 52

Arrangements with devolved authorities etc about information services

Question proposed, That the clause stand part of the Bill.

[The Chair]

With this it will be convenient to discuss clauses 53 to 57 stand part.

[Karin Smyth]

Clauses 52 to 57 are vital. The Committee has discussed our relationship with colleagues in the devolved authorities; these clauses ensure that arrangements with devolved authorities and the Crown dependencies can continue following the abolition of NHS England.

Turning first to clauses 52 to 54, although healthcare is devolved in England, Scotland and Northern Ireland, the devolved Governments currently make arrangements with NHS England to deliver a number of functions on their behalf. Clauses 52 to 54 enable those existing arrangements to continue following the abolition by giving the powers to the Secretary of State. The policy intent is not to impact or reach into devolved competencies, but to secure continuity and legal clarity through existing cross-border and UK-wide arrangements involving Scotland, Wales and Northern Ireland. This is about making sure that the current expertise and resources of NHS England remain available to devolved authorities once these functions merge with the Department of Health and Social Care.

The clauses will not give the Secretary of State any ability or power to do anything in relation to devolved authorities other than as mutually agreed. Arrangements will be fully voluntary and do not create a power for unilateral action; rather, they ensure that, where co-operation is wanted, there is a proper legal basis for it.

Under clause 52, the Secretary of State takes on the data functions of NHS England and, on request from the devolved authorities, to make arrangements for the provision of information services. Clause 52 additionally applies to Crown dependencies. There are a number of such arrangements already in place between NHS England, the devolved authorities and the Crown dependencies.

For example, NHS England provides the NHS login service for the NHS Wales app, as well as the electronic prescription service for Wales, and NHS England collects and analyses data for audits that span multiple devolved authorities, such as the national audit of pulmonary hypertension. These provisions will support continuity of those arrangements. We are making sure that, if it is appropriate, data functions that are transferring to the Secretary of State can be delegated. Proposed new section 294B of the Health and Social Care Act 2012 will allow that power to likewise be delegated to an appropriate public body.

Clause 53 provides a clear statutory basis for the Secretary of State, by agreement with the devolved administrations’ health bodies, to make commissioning arrangements for the Scottish, Welsh or Northern Ireland health services. This clause will help to ensure continuity for patients across the United Kingdom, reducing the risk of disruption, and support the effective commissioning of services where cross-border work remains the right approach.

Clause 54 enables the Secretary of State, by agreement with a devolved authority, to exercise certain education and training functions on that authority’s behalf and to provide services or facilities in connection with those functions. Education and training arrangements often work best when they are co-ordinated efficiently and supported by shared systems. At a time when every part of the health service needs a strong pipeline of skilled staff, it is vital that useful joint arrangements can continue with clarity and confidence as responsibility is transferred from NHS England to the Secretary of State. The clause updates the statutory framework and helps to ensure that shared arrangements supporting recruitment, training cycles and workforce planning can continue following the abolition of NHS England.

Clause 55 relates to clauses 53 and 54. The agreed arrangements are effective only if they can deliver in a practical and efficient way, which is why this clause enables the Secretary of State to direct a public body to exercise some or all of the Secretary of State’s functions under arrangements made with the devolved authorities in relation to commissioning or education and training under section 295 or section 296A of the 2012 Act. In short, it provides a mechanism to ensure that functions under agreed commissioning and education and training arrangements with devolved authorities can be exercised by the most appropriate public body in England. The clause also allows the Secretary of State to direct the public body in how those functions are to be exercised, including in relation to information obtained in the course of exercising them. It also requires directions to be published. Those features support both operational clarity and accountability.

On clause 56, public authorities in the Crown dependencies may seek expert advice or practical assistance from the health system in England. Following the abolition of NHS England, this clause transfers the existing power from NHS England to the Secretary of State, and provides a clear legal basis for the Secretary of State or ICBs to provide that advice and assistance for purposes connected with the provision of healthcare. The clause also makes clear that advice or assistance may be provided on such terms as a provider considers appropriate, allowing support to be given in a practical and transparent way that is tailored to the circumstances of the case, whether that involves technical advice, specialist expertise or other practical assistance in connection with the provision of healthcare.

Finally, on clause 57, clarity and consistency in legislation depends on clear definitions, particularly where a group of provisions are intended to operate together as a coherent scheme. This clause does not create any new powers or duties; rather, it provides the necessary interpretive framework to support the operation of the preceding clauses and ensure legal certainty and clarity. As a group, these clauses play a vital role in ensuring that existing arrangements with our devolved authorities and the Crown dependencies can continue following the abolition of NHS England. I commend them to the Committee.

Question put and agreed to.

Clause 52 accordingly ordered to stand part of the Bill.

Clauses 53 to 57 ordered to stand part of the Bill.

Ordered, That further consideration be now adjourned.—(Emma Foody.)