Health Bill

Lord Tarassenko Excerpts

Committee stage
Wednesday 11th November 2026 Lords Chamber

Moved by

[Lord Tarassenko]

53: After Clause 11, insert the following new Clause—
“Duty as to UK suppliers and sovereign capabilityIn the National Health Service Act 2006, after section 1CC (inserted by section 6 of this Act) insert—“1CD Duty as to UK suppliers and sovereign capability(1) The Secretary of State must take into account the matters mentioned in subsection (2)—(a) in setting the award criteria for a relevant contract under section 23 of the Procurement Act 2023, so far as those matters relate to the subject matter of the contract, and(b) in having regard, under section 12(1)(a) of that Act, to the importance of delivering value for money in connection with the award of a relevant contract.(2) The matters are—(a) the extent to which the data, control and support of the system concerned will remain within the jurisdiction of the United Kingdom,(b) the risks to the security and resilience of the health service arising from any respect in which they will not, including the risk that access to NHS patient data could be compelled under the law of a country or territory outside the United Kingdom, and(c) so far as consistent with the international obligations of the United Kingdom, the contribution of the contract to developing and maintaining capability within the United Kingdom to design, deliver and support technology and information systems which handle NHS patient data.(3) Subsections (4) and (5) apply to a material relevant contract under which—(a) the data, control or support of the system concerned will not remain wholly within the jurisdiction of the United Kingdom, or(b) the supplier, or any subcontractor with access to NHS patient data, is subject to the law of a country or territory outside the United Kingdom under which access to such data could be compelled,(a “jurisdiction-risk contract”).(4) Before entering into a jurisdiction-risk contract, the Secretary of State must consult—(a) the National Cyber Security Centre,(b) persons representing the interests of patients, and(c) trade unions representing health service staff,on the proposed contract, and must, before, or as soon as reasonably practicable after, entering into the contract, lay before Parliament a report on that consultation.(5) As soon as reasonably practicable after entering into a jurisdiction-risk contract, the Secretary of State must lay before Parliament a statement setting out—(a) the reasons for the award, including how the matters in subsection (2) were taken into account, and(b) whether the Government is taking, or is planning to take, steps to develop or support long-term domestic alternatives to the systems provided under the contract. (6) The Secretary of State must, at least once in every period of 12 months, lay before Parliament a report setting out—(a) the number and total value of relevant contracts entered into during that period, the proportion of each awarded to UK suppliers, and the number and total value of jurisdiction-risk contracts entered into during that period; and (b) how the award of those contracts has contributed to the objectives of any NHS Digital Sovereignty Strategy published under section (NHS Digital Sovereignty Strategy) of the Health Act 2026 (NHS Digital Sovereignty Strategy).(7) A report or statement under this section may omit information the publication of which would be reasonably likely to prejudice national security or the commercial interests of any person, but must state that information has been omitted.(8) This section is without prejudice to the national security exemption under paragraph 25 of Schedule 2 to the Procurement Act 2023.(9) In this section—“material relevant contract” means a relevant contract with an estimated value, determined in accordance with Schedule 3 to the Procurement Act 2023, of more than the threshold amount that applies under Schedule 1 to that Act to a contract of that kind awarded by a central government authority, including a contract awarded under a framework and a renewal or extension of a relevant contract;“NHS patient data” means patient information (within the meaning given in section 250E(7)) relating to persons who have received health care or social care in England;“relevant contract” means a contract entered into by the Secretary of State for the provision of technology or information systems which—(a) form part of the single patient record, or hold or process patient information for its purposes, or(b) are provided for use across the health service in England as national systems and hold, process or provide access to NHS patient data;“the single patient record” means the system for making patient information available referred to in section 250E(1), whether or not established by regulations under that section;“UK supplier” means a company incorporated in the United Kingdom which either has no parent undertaking or each of whose parent undertakings (within the meaning of section 1162 of the Companies Act 2006) is incorporated, and has its head office, in the United Kingdom.””Member's explanatory statement
This new clause would require procurement of the single patient record and national systems handling NHS patient data to weigh UK jurisdiction over data, control and support, and UK capability, with consultation and statements to Parliament for higher-value contracts outside UK jurisdiction, and an annual report on the UK share.

[Lord Tarassenko (CB)]

My Lords, I shall also speak to Amendments 171 and 289, all in my name and that of the noble Baroness, Lady Kidron, who I thank for her support. I remind the Committee of my interests: I hold an honorary contract with Oxford University Hospitals NHS Foundation Trust, which is in the process of being renewed, and I am a director of LIO Health, a UK company which contracts with mental health NHS trusts.

The NHS holds health data no other country can match, namely longitudinal records for the whole population of England: primary care data, electronic patient records—EPRs—in hospitals and patient outcomes in multiple national registries. The single patient record, SPR, has the potential to bring primary care and secondary care records together for the first time and, in time, to link them to outcome data. That is a national asset of extraordinary value, not only for direct care but for research that will improve patient outcomes. It provides a unique opportunity for the UK companies that could build the systems which hold and process the SPR data.

The Government have told us that the SPR will indeed be delivered through contracts with multiple suppliers, with no single supplier dominating. Those contracts will be awarded over the next two years. These amendments ask a simple question: which companies are likely to win these contracts? Today, the US company Epic supplies the EPR in close to 20 NHS acute trusts. This year alone, four trusts in Somerset and Dorset have signed a £222 million 10-year contract with Epic, and Lewisham and Greenwich a £52 million contract. In general practice, EMIS, a company founded in Leeds, was sold to United Health in 2023 for £1.2 billion, and then on to another American company, a private equity firm, TPG, this year, so a large share of our GP records now sits with a US-owned supplier.

UK capability, although patchy, is still there. TPP, still UK-owned, supplies SystmOne across general practice and community services. Nervecentre, a British company founded in 2010, now has some 15 trusts committed to its cloud-native EPR, including a 10-year, £53-million contract with Liverpool University Hospitals, signed this spring. As I said at Second Reading, Kynos, a FTSE-250 company, won the contract in open competition to build UK Biobank’s output-checking system. UK companies can win and do win when procurement gives them a fair chance.

The contracts awarded for the single patient record in the next two years will typically run for 10 years and will define the health software market until the mid-2030s, the end of the NHS 10-year plan. If UK companies do not win a significant proportion of these contracts, the gap between US and UK suppliers will not stay where it is now. It will widen with every contract award, as revenue, engineering talent and know-how about NHS data build up on one side of the Atlantic. In 10 years’ time, that gap will be insurmountable. We will have lost the ability to build and support the core digital infrastructure of our own health service, and we will not get it back; the window to act is now.

Amendment 53 makes sure that UK jurisdiction and UK capability are taken into account when they matter: at the point of contract award. It requires the Secretary of State to take three matters into account when setting award criteria under Section 23 of the Procurement Act 2023 and when weighing value for money under Section 12(1)(a) for contracts for the single patient record and for national systems handling NHS patient data: first, the extent to which the data control and support of the system will remain within UK jurisdiction; secondly, the risk to the security and resilience of the NHS where they do not, including the risk that access to NHS patient data could be compelled under the law of another country, the US CLOUD Act being the obvious example; and, thirdly, consistent with our international obligations, the contribution the contract makes to building and maintaining UK capability.

Value for money is not simply the lowest price of a contract term. It must include the cost of dependency, the cost of exit and the value of the capability we keep. For larger contracts where data control or support will not remain entirely in the UK, the Secretary of State must consult the National Cyber Security Centre, patient representatives and NHS trade unions, and lay a Statement before Parliament explaining the award and whether domestic alternatives will be developed. Every year, the Secretary of State must report the number and total value of the contracts and the proportion awarded to UK suppliers, defined as UK companies with no foreign parent.

Amendment 53 deals with individual contracts and Amendment 171 provides a strategy. It requires the Secretary of State within 12 months of Royal Assent to publish an NHS digital sovereignty strategy. That strategy must cover four topics: first, treating NHS patient data as a sovereign data asset, including where it is stored and from where it may be accessed; secondly, assessing the risks across hardware, software, supply chains, and procurement, including reliance on foreign technology; thirdly, building domestic capability, including options to prioritise UK technologies; and, finally, research access to pseudonymised data in a way that keeps public trust. A sovereign data asset held in the UK under UK control with the benefits flowing back to the NHS is the best guarantee of that trust.

For research access, the NHS digital sovereignty strategy must set out the hierarchy: UK universities, medical research charities and the NHS itself, including the NIHR, will come first; UK suppliers second; and everyone else third. The strategy must also address how the NHS will share in the value created, with returns reinvested in the health service. Data must be accessed only within a trusted research environment in the UK, with outputs checked before release. Amendment 289 would bring both new clauses into force on Royal Assent, when the 12-month clock for the strategy would start, and the procurement duty in Amendment 53 would apply to the SPR contracts now being prepared.

All the amendments in this group share one concern: who controls the digital foundations of the NHS? I look forward to hearing from the noble Lords who have tabled them.

I support Amendment 277, from the noble Baroness, Lady Neville-Rolfe, which would require the Secretary of State to report on how NHS procurement supports patient care, value for money, resilient supply chains and economic activity in the UK. I also support Amendment 160, from the noble Lord, Lord Clement-Jones, which would require the Secretary of State to establish through regulations a governance framework for NHS IT and data contracts.

Several amendments in this group are concerned specifically with the Palantir contract for the NHS federated data platform. After the Secretary of State’s appearance in front of the Commons Health and Social Care Committee last week, when she refused to be drawn on whether the Palantir contract would be extended, I look forward to hearing what the Minister might have to say about the topic. I have two questions that I hope the Minister will answer in full. First, how will the value-for-money assessment of the SPR contracts take account of UK jurisdiction and resilience? Secondly, will the Government commit to publishing an NHS digital sovereignty strategy, whether or not they accept the wording of Amendment 171? After all, last week the Secretary of State said:

“We want … sovereignty. That has to include sovereignty for UK data”.


This country has world-class health data science and a health tech sector that should be given the opportunity to grow. The single patient record contracts are the biggest opportunity that the sector will see in the next 10 years. We must not spend the next decade buying back our own capability at a premium. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, it is a pleasure to follow the noble Lord, Lord Tarassenko. I will speak to Amendments 144, 147, 158 to 160, and 172E in my name, and I give our strong support to Amendment 53 on the digital sovereignty package, spoken to so convincingly by the noble Lord, Lord Tarassenko. We are very much singing from the same hymn sheet on these Benches.

I was unable to take part at Second Reading, but, over the years, as the noble Lord, Lord Kamall, will know from his time as a Minister, I have taken a strong interest in the access to, use and destination of NHS data for all purposes. Digital technology and data analytics hold transformative potential for our NHS, but technology is as effective only as the governance that underpins it, and health data platforms can succeed only if they command absolute public and clinical trust. If the NHS hands over its core data architecture to closed, proprietary vendors without retaining public ownership of software connectors or enforcing open API standards or clear parliamentary oversight, we risk locking our health service into perpetual vendor dependency.

In speaking to these amendments, I am building directly on the outstanding work of my Liberal Democrat colleagues in the Commons. I pay tribute to my honourable friend Martin Wrigley, who led the charge on vendor lock-in; my honourable friend Helen Morgan, who tabled a new clause on a sovereign health data trust; and my honourable friend Dr Danny Chambers, who tabled a new clause establishing the framework for an NHS digital sovereignty strategy.

On these Benches, we believe three principles should apply: NHS patient data is a sovereign public asset, exactly in the way that the noble Lord, Lord Tarassenko, described; data infrastructure must adhere to open, FAIR—findable, accessible, interoperable and reuseable—standards; and commercial suppliers must operate under strict public benefit conditions, with the NHS retaining full legal ownership of software interfaces and data pipelines.