We know that some patients and GP practices have questions about how information is used within the NHS Federated Data Platform (FDP), including whether GP patient records are being shared and the role of Palantir.
We want to be clear about how NHS Norfolk and Suffolk Integrated Care Board (ICB) currently uses the FDP.
The position in Norfolk and Suffolk
The ICB is not currently putting GP patient records into the FDP.
We are currently piloting one FDP product, called the System Coordination Centre. It helps us understand pressures across local health and care services and support the coordination of services.
The information used in this product is aggregated. This means it provides an overall picture rather than information about individual patients.
No identifiable or pseudonymised patient-level information is used in this product, and ICB staff cannot use it to view individual patient records.
GP practices are not currently being asked by the ICB to provide patient records for use in the FDP. The FDP can be used in different ways by different NHS organisations, so it is important to understand how it works and what that means for patient information.
What is the Federated Data Platform?
The NHS Federated Data Platform is technology provided nationally to help NHS organisations bring together information for specific planning and operational purposes.
It is not one central database containing all NHS patient information.
NHS England, ICBs and NHS provider organisations, such as hospital trusts, have separate areas of the platform. Each organisation is responsible for deciding what information is used within its own area and must follow relevant legal, data protection and information governance requirements.
This means information used by one NHS organisation through the FDP is not automatically available to other NHS organisations.
What does NHS Norfolk and Suffolk ICB use the FDP for?
We currently use one FDP product – the System Coordination Centre.
This uses aggregated information only and does not contain individual patient records.
Other FDP tools are available nationally, but NHS Norfolk and Suffolk ICB has not currently adopted or implemented them.
Before we use any additional FDP product, we would need to understand why it was needed, what information it would use and the relevant privacy, legal and information governance requirements.
Is GP patient information being shared through the FDP?
NHS Norfolk and Suffolk ICB does not currently extract or upload GP patient records into the FDP.
There is also no approved local proposal to introduce GP patient records into the ICB’s FDP.
Existing data-sharing agreements with GP practices are not treated as blanket permission to use GP patient information for a new system or a significantly different purpose.
If we proposed using GP patient data within our FDP in future, we would need to consider this separately. This would include considering the legal basis for using the information, confidentiality, data protection, information governance and patient opt-outs.
We would also engage with GP practices before any implementation where their participation or agreement was required.
What about other NHS organisations?
NHS provider organisations may have their own separate areas of the FDP and may use different FDP products.
Each organisation is responsible for deciding what information it uses, who can access it and why it is being used.
NHS Norfolk and Suffolk ICB cannot provide assurances on behalf of other NHS organisations about their use of the FDP. Questions about a particular organisation’s use of the platform should therefore be directed to that organisation.
Can patients opt out?
There is no separate patient opt-out specifically for the FDP.
There are existing NHS opt-outs which apply to particular uses of patient information, including the National Data Opt-Out and Type 1 opt-outs.
NHS England’s current position is that these opt-outs do not apply to information processed within current FDP products. This is because information used nationally does not include confidential patient information to which the National Data Opt-Out would apply, while confidential patient information used within local FDP products is used for direct patient care.
The position can differ depending on the particular FDP product and information being used.
If NHS Norfolk and Suffolk ICB proposed using GP patient information within the FDP in future, we would assess whether the National Data Opt-Out or Type 1 opt-out applied before any proposal was implemented.
What is Palantir’s role?
Palantir provides the underlying technology for the FDP as part of a consortium contracted nationally by NHS England.
Under these arrangements, the supplier acts as a data processor. This means it operates under the instructions of the relevant NHS organisation and does not decide what information is put into the platform or how that information is used.
The supplier is not permitted to use, share or commercialise NHS information for its own purposes.
Access to information within the FDP is restricted to authorised users for approved purposes. Activity is logged and monitored, and information is encrypted when it is stored and transferred.
We recognise that some patients and clinicians have wider concerns about Palantir’s involvement in the NHS. These are separate from the information currently being used within NHS Norfolk and Suffolk ICB’s FDP.
Who is responsible for the national FDP contract?
The FDP contract was awarded nationally by NHS England.
NHS Norfolk and Suffolk ICB does not hold the contract, so decisions about its future are matters for NHS England and the Government.
We can listen to concerns raised by local patients and GP practices and share these through the appropriate national channels.
What happens if things change?
Our current position is clear: NHS Norfolk and Suffolk ICB is not putting GP patient records into the FDP.
If a proposal to use GP patient-record information within our FDP is developed in future, it would need to go through the appropriate legal, confidentiality, data protection and information governance processes.
We would also consider how patient opt-outs applied and inform and engage with GP practices where their involvement was required.
For the latest information and the uses of data within the ICB, please visit the ICBs Privacy Notice.