| CLM-001 |
Personal health-data sharing needs an Article 6 lawful basis and Article 9 condition, with DPA safeguards as applicable. |
SRC-001, SRC-002 |
Current law / high |
| CLM-002 |
Data-protection compliance does not itself satisfy common-law confidentiality. |
SRC-005, SRC-007 |
Current framework / high |
| CLM-003 |
Section 251B creates a qualified duty to share relevant information for individual care when statutory conditions are met. |
SRC-006 |
Current law / high |
| CLM-004 |
Implied confidentiality consent may support appropriate need-to-know individual-care sharing unless the person objects; this is distinct from GDPR consent. |
SRC-007 |
Official guidance / high |
| CLM-005 |
Beyond-care CPI normally needs explicit confidentiality consent, legal requirement, section 251/COPI support or an exceptional public-interest route. |
SRC-007, SRC-008, SRC-030 |
Current framework / high |
| CLM-006 |
The national data opt-out applies to many uses/disclosures of CPI beyond individual care and is not a lawful basis. |
SRC-009, SRC-021 |
Current policy/standard / high |
| CLM-007 |
The DUAA amends rather than replaces UK GDPR/DPA; all its data-protection provisions were in force by 19 June 2026. |
SRC-003, SRC-004 |
Current law/regulator statement / high |
| CLM-008 |
The ICO Data Sharing Code remains useful but is explicitly under review following DUAA. |
SRC-005 |
Time-sensitive / high |
| CLM-009 |
The Standards Directory includes mandatory and non-mandatory entries; lifecycle status alone does not establish mandate. |
SRC-013, SRC-032 |
Official service description / high |
| CLM-010 |
Applicable ISNs can create scoped mandatory requirements; adoption and conformance must be determined from notice scope and dates. |
SRC-011, SRC-013 |
Current standards framework / high |
| CLM-011 |
Core Information Standard and GP Connect are valuable shared-care/structured-access ceilings but their directory pages do not show universal s250 mandates. |
SRC-014, SRC-015 |
Current directory pages / high |
| CLM-012 |
NHS Number, SNOMED CT, dm+d, DCB0129, DCB0160, DSPT and DCB3058 provide mandatory floors when their stated scope applies. |
SRC-016, SRC-017, SRC-018, SRC-019, SRC-020, SRC-021, SRC-040 |
Current standards / high |
| CLM-013 |
Maximum safe sharing is the widest purpose-relevant, role-authorised and controlled information set, not the largest technically available record. |
SRC-001, SRC-005, SRC-010, SRC-014 |
Synthesis / high |
| CLM-014 |
DSPT completion and a sharing agreement are assurance controls, not proof that a specific flow is lawful. |
SRC-005, SRC-012 |
Official guidance / high |
| CLM-015 |
The 2026 Health Bill single-patient-record proposals are horizon material, not current authority. |
SRC-029 |
Future Bill / high |
| CLM-016 |
Type 1 remains a distinct current opt-out preventing identifiable GP record data leaving the GP IT system for purposes beyond direct care. |
SRC-007, SRC-033 |
Current policy under reform / high |
| CLM-017 |
The current information-standards authority is HSCA 2012 sections 250–251 as amended; DUAA Schedule 15 changes commenced 5 February 2026 and expressly cover relevant IT/IT services. |
SRC-034, SRC-035, SRC-036, SRC-037 |
Current law / high |
| CLM-018 |
UK Core governance, personalised care plans, community-pharmacy transfers, acute discharge, scoped BaRS use cases and pathology reporting are mandatory only for the organisations/use cases and dates in their notices. |
SRC-022, SRC-023, SRC-024, SRC-025, SRC-027, SRC-028 |
Current standards / high |
| CLM-019 |
GP Connect has no universal section 250 ISN, but GP contracts require in-scope practices to enable read-only Access Record for specified direct-care routes; current product rules prohibit most beyond-care use. |
SRC-015, SRC-038, SRC-039 |
Current contract/product position / high |
| CLM-020 |
The 10 Year Health Plan’s three shifts and digital commitments are strategic policy; they do not themselves widen legal authority, impose a GP contractual term, mandate a standard or prove a service is live. |
SRC-041, SRC-042 |
Current policy boundary / high |
| CLM-021 |
Current digital-first primary care is multi-channel: the standard 2026/27 GMS contract preserves online, telephone and in-person core-hours routes and includes paper or assisted registration provisions. |
SRC-047, SRC-048 |
Current contract / high, subject to contract type |
| CLM-022 |
The online-consultation tool must not limit request numbers during core hours, and the contractor must not ask a patient to contact the practice on another day. This does not create unlimited appointments or a universal same-day-appointment entitlement; nonurgent matters require an appropriate response by the end of the next working day. |
SRC-047, SRC-048 |
Current contract / high, subject to contract type |
| CLM-023 |
Automatic prospective access through approved patient-facing services and written-request access to remaining relevant digital medical information are distinct; system capability, already-accessible/excepted information, safeguarding, serious-harm, third-party, proxy/child and technical controls constrain them. |
SRC-047, SRC-051 |
Current contract/guidance / high |
| CLM-024 |
The NHS App roadmap and technical specification evidence current and planned capabilities, but actual availability remains feature-, supplier-, cohort- and geography-dependent. |
SRC-050 |
Current product position / high |
| CLM-025 |
The SPR is early-stage and the Health Bill has not created current duties; detailed architecture, controller allocation, objection design, regulations, standards, implementation sequencing and delivery remain unresolved, notwithstanding published maternity/frailty-first phases and programme ambitions. |
SRC-029, SRC-043 |
Future programme/Bill / high |
| CLM-026 |
Patient access, professional direct care, transactional access, operational/planning use and research are distinct data routes; a shared platform or strategic programme does not merge their purposes or authority. |
SRC-043, SRC-050, SRC-058, SRC-060 |
Synthesis / high |
| CLM-027 |
Digital approaches must complement non-digital support; inclusion, accessibility, communication needs, equality and health-inequality impacts must be designed and assessed for the service. |
SRC-042, SRC-052, SRC-054, SRC-057, SRC-061, SRC-062, SRC-063 |
Current law/standard/guidance envelope / high |
| CLM-028 |
Accessible Information is a scoped section 250 standard for publicly funded NHS, public-health and adult-social-care providers including GP; its ISN refers implementation and full-conformance dates to the standard rather than stating exact dates. |
SRC-054 |
Current standard / high |
| CLM-029 |
DAPB4031 is a section 259 GP usage-data collection, the named NHS App API is a permissioned communications API, and WCAG has scope-dependent legal/contractual force; directory status must not be used as a universal mandate. |
SRC-055, SRC-056, SRC-057 |
Current standards / high |
| CLM-030 |
Where each is in scope, DTAC, DCB0129/DCB0160, DSPT and App-integration gates can be cumulative assurance controls; none creates a lawful purpose or confidentiality gateway. |
SRC-019, SRC-020, SRC-040, SRC-053, SRC-064 |
Current assurance framework / high |
| CLM-031 |
FDP, SPR and HDRS are distinct: FDP is a live multi-instance platform supporting approved direct-care, operational and planning products; SPR is a developing cross-setting longitudinal-record programme; HDRS is a developing secure research-access service. Each product and use requires its own purpose, authority, controller analysis and access controls. |
SRC-043, SRC-058, SRC-060 |
Current/future programme distinction / high |
| CLM-032 |
The 2019 digital-first policy and consultation are historical lineage; the applicable current contract, regulations and directions determine today’s primary-care duties. |
SRC-046, SRC-047, SRC-048, SRC-049 |
Historical/current boundary / high |
| CLM-033 |
Medium-term planning and digital-by-default programme guidance have addressee- and service-specific scope; they are not automatically individual GP contractual terms or disclosure authority. |
SRC-044, SRC-045 |
Current operational guidance / high |
| CLM-034 |
NHS Online is a separate planned service from the NHS App and SPR and is not yet a current nationwide entitlement. |
SRC-059 |
Current programme position / high |
| CLM-035 |
Equality Act reasonable-adjustment/service duties, the public-sector equality duty and NHS England/ICB health-inequality duties apply according to actor and function; inclusion guidance explains rather than creates them. |
SRC-052, SRC-061, SRC-063 |
Current law/guidance / high |
| CLM-036 |
Public-sector website/app accessibility duties and WCAG expectations are scope-dependent; an NHS directory entry does not establish that every independent GP contractor is a public-sector body. |
SRC-057, SRC-061, SRC-062 |
Current law/standard boundary / high |
| CLM-037 |
NHS App integration is feature- and use-case-specific: the directory’s named NHS App API is a communications API, while the wider integration gateway imposes separate onboarding and assurance conditions. |
SRC-056, SRC-064 |
Current technical/gateway position / high |
| CLM-038 |
Chapter 3 is a portfolio of distinct patient-access, direct-care, transactional, operational, workforce and research propositions; neither the chapter nor a shared product combines them into one purpose, authority or mandate. |
SRC-041, SRC-050, SRC-058, SRC-060 |
Policy boundary and synthesis / high |
| CLM-039 |
A 24/7 App or AI-advice function does not create a 24/7 GP clinical-response duty; the current practice contract and exact pathway determine the human response and escalation requirement. |
SRC-041, SRC-047, SRC-048, SRC-050 |
Current contract/policy distinction / high |
| CLM-040 |
Patient-added wearable or sensor data create separate provenance, accuracy, monitoring, alert-response, retention and reuse decisions; an upload or sharing control is not blanket consent to every downstream use. |
SRC-001, SRC-005, SRC-041, SRC-053 |
Policy-to-implementation synthesis / high |
| CLM-041 |
HealthStore listing, national procurement, NICE evidence alignment, DTAC or medical-device status are distinct evidence, regulatory and assurance gates; none creates data-sharing authority or proves local clinical suitability. |
SRC-041, SRC-053, SRC-064, SRC-066, SRC-067 |
Current assurance/policy boundary / high |
| CLM-042 |
NHS England ambient-scribing guidance requires local safety, DPIA, integration, transparency, monitoring and human-review controls; its self-certified supplier registry supports but does not replace local procurement and assurance. |
SRC-019, SRC-020, SRC-065 |
Current guidance and standards / high |
| CLM-043 |
AI and software medical-device status depends on the product’s intended purpose and function; navigation, transcription, summarisation, decision support and autonomous action cannot share one generic classification or assurance decision. |
SRC-053, SRC-065, SRC-067 |
Current regulatory/guidance boundary / high |
| CLM-044 |
Formal carer/proxy access is delegated, scoped and reviewable authority using the proxy’s own identity; carer status or identity alone does not confer record access. |
SRC-051, SRC-068 |
Current guidance / high |
| CLM-045 |
Chapter 3’s proposed proactive planned-care platform is unnamed and future: it must not be equated with FDP, SPR or an EPR without later authoritative evidence. |
SRC-041, SRC-043, SRC-058 |
Future programme distinction / high |
| CLM-046 |
AI-assisted triage is in limited rollout with an April 2028 all-App-users target, not universally live; traditional GP contact remains and rollout does not displace contract, equality, clinical-safety, data-protection or device controls. |
SRC-047, SRC-050, SRC-053, SRC-067, SRC-071 |
Current delivery announcement with assurance boundary / high |
| CLM-047 |
DAPB3051 v3.1 is a scoped section-250 identity/authentication standard, including a proxy use case, with full conformance on 31 December 2026; authentication does not itself confer function- or record-level authority. |
SRC-069 |
Current standard / high |
| CLM-048 |
The National Proxy Service is an optional private beta and cross-setting portability remains roadmap work; it does not yet deliver a universal My Carer model. |
SRC-070 |
Current product position / high |
| CLM-049 |
The NHS App’s current accessibility statement records partial compliance and separate responsibility for integrated services, so Chapter 3’s BSL, translation and inclusion promises require feature- and journey-level verification. |
SRC-052, SRC-054, SRC-057, SRC-073 |
Current accessibility evidence/policy distinction / high |
| CLM-050 |
HealthStore remains a planned marketplace with a summer-2027 local-selection target; NICE evidence, DTAC, device status, commissioning, funding, data authority and App integration remain distinct gates. |
SRC-041, SRC-053, SRC-064, SRC-066, SRC-067, SRC-072 |
Future programme/assurance boundary / high |
| CLM-051 |
CIS2 provides live sign-on and role-control infrastructure for some workforce applications, while NHS-wide single sign-on remains roadmap work; authentication does not establish care relationship, need-to-know or sharing authority. |
SRC-069, SRC-074 |
Current/future product distinction / high |
| CLM-052 |
Current NHS choice rights are service- and circumstance-specific; a future comparison, self-referral or booking feature cannot expand legal entitlement or commissioned availability by itself. |
SRC-041, SRC-075 |
Current guidance/policy boundary / high |
| CLM-053 |
DAPB4101 v1.0.0 is a scoped section-250 laboratory-to-GP direct-care standard. Its current ISN still states 30 April 2025, but NHS England’s 10 July 2026 implementation update says the full-conformance date will be extended without yet giving a replacement; intended pilot testing and assurance by April 2027 is neither that replacement date nor proof of national rollout. |
SRC-028 |
Current official-source conflict / high |
| CLM-054 |
For 2026/27, the Medium Term Planning Framework tells all ICBs to transition primary-care messaging to NHS Notify with NHS App push as the default; acute, community and mental-health providers are separately expected to start migrating direct-to-patient communications in 2026/27 and complete by the end of 2028/29. NHS Notify is live, but these are addressee-specific planning requirements, not a universal GP contractual term, section-250 standard or lawful basis; each sender retains responsibility for purpose, content, channel/fallback, accessibility, safety, transparency, preferences and applicable opt-outs. |
SRC-044, SRC-076 |
Current planning and service position / high |