NHS: Databases

Data in the NHS Federated Data Platform (NHS FDP) remains under National Health Service control at all times. External suppliers and their personnel operate under the instruction of the NHS when processing data on the platform. NHS England does not provide routine access for external suppliers to identifiable patient data prior to pseudonymisation for the purposes of analytics within the NHS FDP.

Any elevated system-level access granted to contracted suppliers is limited to what is strictly necessary for defined platform functions, such as system administration, operational support, maintenance, and resilience, including out-of-hours support.

A small number of authorised supplier personnel may be granted controlled administrative access where required to deliver these functions, acting under the instruction of NHS organisations as data controllers. All access is restricted to the role that is being performed and can only be accessed from the United Kingdom. Access is only granted to personnel that are Government security cleared. This does not provide unrestricted use of identifiable patient data, and suppliers are not permitted to access or use data for their own purposes, in line with UK General Data Protection Regulation.

External suppliers are processors on contracts with relevant security and data protection clauses contained within the agreements. Internal security and data protection processes are in place within NHS England, and contracts of employment and other organisational policies provide further safeguards against data misuse.