| CLM-001 |
Personal health-data sharing needs an Article 6 lawful basis and Article 9 condition, with DPA safeguards as applicable. |
SRC-001, SRC-002 |
Current law / high |
| CLM-002 |
Data-protection compliance does not itself satisfy common-law confidentiality. |
SRC-005, SRC-007 |
Current framework / high |
| CLM-003 |
Section 251B creates a qualified duty to share relevant information for individual care when statutory conditions are met. |
SRC-006 |
Current law / high |
| CLM-004 |
Implied confidentiality consent may support appropriate need-to-know individual-care sharing unless the person objects; this is distinct from GDPR consent. |
SRC-007 |
Official guidance / high |
| CLM-005 |
Beyond-care CPI normally needs explicit confidentiality consent, legal requirement, section 251/COPI support or an exceptional public-interest route. |
SRC-007, SRC-008, SRC-030 |
Current framework / high |
| CLM-006 |
The national data opt-out applies to many uses/disclosures of CPI beyond individual care and is not a lawful basis. |
SRC-009, SRC-021 |
Current policy/standard / high |
| CLM-007 |
The DUAA amends rather than replaces UK GDPR/DPA; all its data-protection provisions were in force by 19 June 2026. |
SRC-003, SRC-004 |
Current law/regulator statement / high |
| CLM-008 |
The ICO Data Sharing Code remains useful but is explicitly under review following DUAA. |
SRC-005 |
Time-sensitive / high |
| CLM-009 |
The Standards Directory includes mandatory and non-mandatory entries; lifecycle status alone does not establish mandate. |
SRC-013, SRC-032 |
Official service description / high |
| CLM-010 |
Applicable ISNs can create scoped mandatory requirements; adoption and conformance must be determined from notice scope and dates. |
SRC-011, SRC-013 |
Current standards framework / high |
| CLM-011 |
Core Information Standard and GP Connect are valuable shared-care/structured-access ceilings but their directory pages do not show universal s250 mandates. |
SRC-014, SRC-015 |
Current directory pages / high |
| CLM-012 |
NHS Number, SNOMED CT, dm+d, DCB0129, DCB0160, DSPT and DCB3058 provide mandatory floors when their stated scope applies. |
SRC-016, SRC-017, SRC-018, SRC-019, SRC-020, SRC-021, SRC-040 |
Current standards / high |
| CLM-013 |
Maximum safe sharing is the widest purpose-relevant, role-authorised and controlled information set, not the largest technically available record. |
SRC-001, SRC-005, SRC-010, SRC-014 |
Synthesis / high |
| CLM-014 |
DSPT completion and a sharing agreement are assurance controls, not proof that a specific flow is lawful. |
SRC-005, SRC-012 |
Official guidance / high |
| CLM-015 |
The 2026 Health Bill single-patient-record proposals are horizon material, not current authority. |
SRC-029 |
Future Bill / high |
| CLM-016 |
Type 1 remains a distinct current opt-out preventing identifiable GP record data leaving the GP IT system for purposes beyond direct care. |
SRC-007, SRC-033 |
Current policy under reform / high |
| CLM-017 |
The current information-standards authority is HSCA 2012 sections 250–251 as amended; DUAA Schedule 15 changes commenced 5 February 2026 and expressly cover relevant IT/IT services. |
SRC-034, SRC-035, SRC-036, SRC-037 |
Current law / high |
| CLM-018 |
UK Core governance, personalised care plans, community-pharmacy transfers, acute discharge, scoped BaRS use cases and pathology reporting are mandatory only for the organisations/use cases and dates in their notices. |
SRC-022, SRC-023, SRC-024, SRC-025, SRC-027, SRC-028 |
Current standards / high |
| CLM-019 |
GP Connect has no universal section 250 ISN, but GP contracts require in-scope practices to enable read-only Access Record for specified direct-care routes; current product rules prohibit most beyond-care use. |
SRC-015, SRC-038, SRC-039 |
Current contract/product position / high |
| CLM-020 |
The 10 Year Health Plan’s three shifts and digital commitments are strategic policy; they do not themselves widen legal authority, impose a GP contractual term, mandate a standard or prove a service is live. |
SRC-041, SRC-042 |
Current policy boundary / high |
| CLM-021 |
Current digital-first primary care is multi-channel: the standard 2026/27 GMS contract preserves online, telephone and in-person core-hours routes and includes paper or assisted registration provisions. |
SRC-047, SRC-048 |
Current contract / high, subject to contract type |
| CLM-022 |
The online-consultation tool must not limit request numbers during core hours, and the contractor must not ask a patient to contact the practice on another day. This does not create unlimited appointments or a universal same-day-appointment entitlement; nonurgent matters require an appropriate response by the end of the next working day. |
SRC-047, SRC-048 |
Current contract / high, subject to contract type |
| CLM-023 |
Automatic prospective access through approved patient-facing services and written-request access to remaining relevant digital medical information are distinct; system capability, already-accessible/excepted information, safeguarding, serious-harm, third-party, proxy/child and technical controls constrain them. |
SRC-047, SRC-051 |
Current contract/guidance / high |
| CLM-024 |
The NHS App roadmap and technical specification evidence current and planned capabilities, but actual availability remains feature-, supplier-, cohort- and geography-dependent. |
SRC-050 |
Current product position / high |
| CLM-025 |
The SPR is early-stage and the Health Bill has not created current duties; detailed architecture, controller allocation, objection design, regulations, standards, implementation sequencing and delivery remain unresolved, notwithstanding published maternity/frailty-first phases and programme ambitions. |
SRC-029, SRC-043 |
Future programme/Bill / high |
| CLM-026 |
Patient access, professional direct care, transactional access, operational/planning use and research are distinct data routes; a shared platform or strategic programme does not merge their purposes or authority. |
SRC-043, SRC-050, SRC-058, SRC-060 |
Synthesis / high |
| CLM-027 |
Digital approaches must complement non-digital support; inclusion, accessibility, communication needs, equality and health-inequality impacts must be designed and assessed for the service. |
SRC-042, SRC-052, SRC-054, SRC-057, SRC-061, SRC-062, SRC-063 |
Current law/standard/guidance envelope / high |
| CLM-028 |
Accessible Information is a scoped section 250 standard for publicly funded NHS, public-health and adult-social-care providers including GP; its ISN refers implementation and full-conformance dates to the standard rather than stating exact dates. |
SRC-054 |
Current standard / high |
| CLM-029 |
DAPB4031 is a section 259 GP usage-data collection, the named NHS App API is a permissioned communications API, and WCAG has scope-dependent legal/contractual force; directory status must not be used as a universal mandate. |
SRC-055, SRC-056, SRC-057 |
Current standards / high |
| CLM-030 |
Where each is in scope, DTAC, DCB0129/DCB0160, DSPT and App-integration gates can be cumulative assurance controls; none creates a lawful purpose or confidentiality gateway. |
SRC-019, SRC-020, SRC-040, SRC-053, SRC-064 |
Current assurance framework / high |
| CLM-031 |
FDP, SPR and HDRS are distinct: FDP is a live multi-instance platform supporting approved direct-care, operational and planning products; SPR is a developing cross-setting longitudinal-record programme; HDRS is a developing secure research-access service. Each product and use requires its own purpose, authority, controller analysis and access controls. |
SRC-043, SRC-058, SRC-060 |
Current/future programme distinction / high |
| CLM-032 |
The 2019 digital-first policy and consultation are historical lineage; the applicable current contract, regulations and directions determine today’s primary-care duties. |
SRC-046, SRC-047, SRC-048, SRC-049 |
Historical/current boundary / high |
| CLM-033 |
Medium-term planning and digital-by-default programme guidance have addressee- and service-specific scope; they are not automatically individual GP contractual terms or disclosure authority. |
SRC-044, SRC-045 |
Current operational guidance / high |
| CLM-034 |
NHS Online is a separate planned service from the NHS App and SPR and is not yet a current nationwide entitlement. |
SRC-059 |
Current programme position / high |
| CLM-035 |
Equality Act reasonable-adjustment/service duties, the public-sector equality duty and NHS England/ICB health-inequality duties apply according to actor and function; inclusion guidance explains rather than creates them. |
SRC-052, SRC-061, SRC-063 |
Current law/guidance / high |
| CLM-036 |
Public-sector website/app accessibility duties and WCAG expectations are scope-dependent; an NHS directory entry does not establish that every independent GP contractor is a public-sector body. |
SRC-057, SRC-061, SRC-062 |
Current law/standard boundary / high |
| CLM-037 |
NHS App integration is feature- and use-case-specific: the directory’s named NHS App API is a communications API, while the wider integration gateway imposes separate onboarding and assurance conditions. |
SRC-056, SRC-064 |
Current technical/gateway position / high |
| CLM-038 |
Chapter 3 is a portfolio of distinct patient-access, direct-care, transactional, operational, workforce and research propositions; neither the chapter nor a shared product combines them into one purpose, authority or mandate. |
SRC-041, SRC-050, SRC-058, SRC-060 |
Policy boundary and synthesis / high |
| CLM-039 |
A 24/7 App or AI-advice function does not create a 24/7 GP clinical-response duty; the current practice contract and exact pathway determine the human response and escalation requirement. |
SRC-041, SRC-047, SRC-048, SRC-050 |
Current contract/policy distinction / high |
| CLM-040 |
Patient-added wearable or sensor data create separate provenance, accuracy, monitoring, alert-response, retention and reuse decisions; an upload or sharing control is not blanket consent to every downstream use. |
SRC-001, SRC-005, SRC-041, SRC-053 |
Policy-to-implementation synthesis / high |
| CLM-041 |
HealthStore listing, national procurement, NICE evidence alignment, DTAC or medical-device status are distinct evidence, regulatory and assurance gates; none creates data-sharing authority or proves local clinical suitability. |
SRC-041, SRC-053, SRC-064, SRC-066, SRC-067 |
Current assurance/policy boundary / high |
| CLM-042 |
NHS England ambient-scribing guidance requires local safety, DPIA, integration, transparency, monitoring and human-review controls; its self-certified supplier registry supports but does not replace local procurement and assurance. |
SRC-019, SRC-020, SRC-065 |
Current guidance and standards / high |
| CLM-043 |
AI and software medical-device status depends on the product’s intended purpose and function; navigation, transcription, summarisation, decision support and autonomous action cannot share one generic classification or assurance decision. |
SRC-053, SRC-065, SRC-067 |
Current regulatory/guidance boundary / high |
| CLM-044 |
Formal carer/proxy access is delegated, scoped and reviewable authority using the proxy’s own identity; carer status or identity alone does not confer record access. |
SRC-051, SRC-068 |
Current guidance / high |
| CLM-045 |
Chapter 3’s proposed proactive planned-care platform is unnamed and future: it must not be equated with FDP, SPR or an EPR without later authoritative evidence. |
SRC-041, SRC-043, SRC-058 |
Future programme distinction / high |
| CLM-046 |
AI-assisted triage is in limited rollout with an April 2028 all-App-users target, not universally live; traditional GP contact remains and rollout does not displace contract, equality, clinical-safety, data-protection or device controls. |
SRC-047, SRC-050, SRC-053, SRC-067, SRC-071 |
Current delivery announcement with assurance boundary / high |
| CLM-047 |
DAPB3051 v3.1 is a scoped section-250 identity/authentication standard, including a proxy use case, with full conformance on 31 December 2026; authentication does not itself confer function- or record-level authority. |
SRC-069 |
Current standard / high |
| CLM-048 |
The National Proxy Service is an optional private beta and cross-setting portability remains roadmap work; it does not yet deliver a universal My Carer model. |
SRC-070 |
Current product position / high |
| CLM-049 |
The NHS App’s current accessibility statement records partial compliance and separate responsibility for integrated services, so Chapter 3’s BSL, translation and inclusion promises require feature- and journey-level verification. |
SRC-052, SRC-054, SRC-057, SRC-073 |
Current accessibility evidence/policy distinction / high |
| CLM-050 |
HealthStore remains a planned marketplace with a summer-2027 local-selection target; NICE evidence, DTAC, device status, commissioning, funding, data authority and App integration remain distinct gates. |
SRC-041, SRC-053, SRC-064, SRC-066, SRC-067, SRC-072 |
Future programme/assurance boundary / high |
| CLM-051 |
CIS2 provides live sign-on and role-control infrastructure for some workforce applications, while NHS-wide single sign-on remains roadmap work; authentication does not establish care relationship, need-to-know or sharing authority. |
SRC-069, SRC-074 |
Current/future product distinction / high |
| CLM-052 |
Current NHS choice rights are service- and circumstance-specific; a future comparison, self-referral or booking feature cannot expand legal entitlement or commissioned availability by itself. |
SRC-041, SRC-075 |
Current guidance/policy boundary / high |
| CLM-053 |
DAPB4101 v1.0.0 is a scoped section-250 laboratory-to-GP direct-care standard. Its current ISN still states 30 April 2025, but NHS England’s 10 July 2026 implementation update says the full-conformance date will be extended without yet giving a replacement; intended pilot testing and assurance by April 2027 is neither that replacement date nor proof of national rollout. |
SRC-028 |
Current official-source conflict / high |
| CLM-054 |
For 2026/27, the Medium Term Planning Framework tells all ICBs to transition primary-care messaging to NHS Notify with NHS App push as the default; acute, community and mental-health providers are separately expected to start migrating direct-to-patient communications in 2026/27 and complete by the end of 2028/29. NHS Notify is live, but these are addressee-specific planning requirements, not a universal GP contractual term, section-250 standard or lawful basis; each sender retains responsibility for purpose, content, channel/fallback, accessibility, safety, transparency, preferences and applicable opt-outs. |
SRC-044, SRC-076 |
Current planning and service position / high |
| CLM-055 |
The National Imaging Registry is a beta-stage, direct-care-only federated imaging service/API, not an information standard, general order-communications route or participant sharing authority. The Digital Interoperability Platform Directions support NHS England’s operation of the service; accepted use case, onboarding, organisational agreements, local authority and confidentiality, DCB0129/DCB0160, DSPT, DPIA, access, audit and fallback responsibilities remain separate. |
SRC-019, SRC-020, SRC-040, SRC-077 |
Current product, governance and standards boundary / high |
| CLM-056 |
Safeguarding, public-health notification, court or regulator production and NHS England collection disclosures do not share a universal authority. Each flow must be matched to the exact current actor, trigger, recipient, statute, order, notice, Data Provision Notice or case-specific confidentiality route, including whether disclosure is required, permitted or only requested; a requester’s label alone does not make disclosure mandatory. |
SRC-001, SRC-002, SRC-005, SRC-078, SRC-080, SRC-081, SRC-082 |
Current law, guidance and request boundary / high |
| CLM-057 |
The England health-protection notification regime creates specific duties for registered medical practitioners to report suspected listed diseases without awaiting laboratory confirmation and separate duties for laboratories to report listed causative agents. Current UKHSA guidance specifies urgent telephone reporting within 24 hours and online reporting within three days; this is not blanket authority for every infection, hazard or public-health disclosure. |
SRC-030, SRC-080 |
Current law and operational guidance / high |
| CLM-058 |
A Health and Social Care Act 2012 section 254 direction or section 255 request addressed to NHS England is not itself an instruction to a GP practice. A provider’s mandatory or requested position must be established from the exact current section 259 Data Provision Notice and its stated organisations, purpose, data, form, manner and period. |
SRC-082 |
Current statutory collection boundary / high |
| CLM-059 |
The Children’s Wellbeing and Schools Act 2026 enacts a new child-safeguarding information-sharing duty and information-standard power, but at 28 July 2026 official material said the duty would apply from 30 September and final statutory guidance was still pending. It must not be treated as current operational authority until commencement, addressees, exceptions and final guidance are confirmed. |
SRC-079 |
Enacted but pre-commencement and guidance-pending / high |
| CLM-060 |
English GP registration is a coordinated multi-leg workflow: registration intake, PDS identity and current-GP handling, PCRM formal registration and GP2GP clinical-record transfer have distinct actors, messages, acknowledgements, exceptions and controls. Completion of one leg does not prove completion of the others. |
SRC-083, SRC-084 |
Current national services and guidance / high |
| CLM-061 |
For permanent moves between in-scope English GMS or PMS practices, the current regulations require GP2GP transfer and a response to the outgoing-record request within 28 days, with unconfirmed and paper-only records routed through the Board; temporary-resident registration is excluded from the GP2GP requirement. The executed contract type and current amendments still control, including any APMS route. |
SRC-047, SRC-048, SRC-083 |
Current regulations and contract/service scope / high |
| CLM-062 |
Receipt of a GP2GP message does not finish the transfer. Correct PDS matching, review and filing, positive acknowledgement, paper or unconfirmed fallback, provenance and completeness checks, degraded-data resolution and allergy and medicines review remain operational and clinical-safety controls. |
SRC-083, SRC-084 |
Current operational guidance and safety boundary / high |