NHS apologises and admits Palantir have access to identifiable patient data

The cardinal wellness work assemblage has acknowledged the inaccuracy of claims antecedently made successful a transparency archive which indicated that only NHS unit were capable to spot specified delicate information

NHS England has issued an apology aft admitting that labor from Palantir and different suppliers tin entree identifiable accusation related to individual patients via the Federated Data Platform.

In its antecedently published Data Protection Impact Assessment (DPIA) – a transparency archive that is simply a statutory request for galore nationalist services engaged successful the processing of citizens’ delicate individual information – the NHS had claimed only health-service unit could entree identifiable individual info via the FDP.

Recent reports, however, person claimed that representatives from the platform’s halfway supplier, Palantir, tin besides entree this delicate data. Following the emergence of these stories, independent advisor and scrutiniser Dr Nicola Byrne – who holds the station of National Data Guardian – wrote to the NHS requesting clarity connected whether aliases not outer contractors and supplier unit could spot diligent info.

In a recently published response, NHS England stressed that – extracurricular of the inaccurate DPIA – “we person ever been clear publically and connected our website that authorised users from the supplier will beryllium granted entree to data”.

But the connection from the wellness work went connected to admit “within the DPIA we referred to only NHS England unit having entree to straight identifiable diligent information [but]… successful truth immoderate suppliers moving for NHS England do person controlled access”.

“We recognise that the DPIA contained an correction successful really it described supplier entree to information truthful we are correcting that error, and we apologise for immoderate disorder this has caused,” the NHS said.

Related content

• Palantir’s £250m authorities woody ‘represents a ballot of assurance successful the UK’, curate says
• Government to walk up to £20m connected ‘border flow’ statement pinch CIA-backed large information patient Palantir
• Palantir level ‘will beryllium much unafraid than thing presently utilized successful NHS’, curate says

Access is provided via the FDP’s National Data Integration Tenant system, arsenic portion of supporting which 3 Palantir engineers “currently have administrative-level entree to the NDIT”, while “a further 33 engineers from a assortment of suppliers person much limited project-specific entree to activity connected circumstantial information sets and tasks assigned by NHS England including penning codification and assuring the improvement of caller products”.

“In each cases they do not person support to usage the information for their ain purposes – their domiciled is strictly constricted to supporting the safe moving and attraction of the platform,” the wellness work added. “The entree is granted based connected operational request and is clip constricted truthful the numbers tin up and down complete time. Within NDIT, engineers, operating nether the instruction of NHS England, could entree identifiable and de-identifiable diligent data, nevertheless this would only beryllium to supply circumstantial method support – diligent information is not routinely accessed.”

In consequence to the NHS clarification, information guardian Dr Byrne said that she and her squad will “continue to prosecute pinch the programme successful our independent advisory role, providing proposal connected its documentation, transparency materials… [and] will proceed to supply situation wherever necessary, and advocator for practices that build and support nationalist and master trust”.

She added that “we proceed to powerfully support the programme’s ambition” – but acknowledged the prevalence and vehemence of concerns regarding the FDP, and the beingness of its superior tech supplier.

“The strength of liking and spot of nationalist emotion connected this rumor look to bespeak not only really profoundly galore group attraction astir the usage of their data, and its confidentiality, but besides continuing interest amongst immoderate astir Palantir’s domiciled successful the NHS,” Byrne said. “This taxable has ever been to immoderate grade political. As such, group person a scope of views. And public, master and media scrutiny has only accrued complete time. This intends that accuracy and transparency must stay cardinal priorities for the NHS FDP programme. This incident has shown really quickly assurance erodes if the ‘no surprises’ rule [of NHS information use] is not upheld erstwhile it comes to who tin entree people’s data, and why.”

MPs connected the Science, Innovation and Technology Committee recently issued a report stating that “Palantir shouldn’t play specified a important domiciled successful the UK nationalist sector”, and naming the vendor “as the astir concerning illustration of the nationalist sector’s increasing reliance connected a mini number of awesome exertion providers, [also] including Microsoft and Amazon Web Services”.

The committee issued unequivocal guidance that authorities should workout a break clause enabling the NHS to exit the FDP engagement successful March 2027 – and should past “either create an in-house replacement aliases activity an replacement UK provider”.