Source register
Retrieved dates are 27 July 2026 unless stated. “Supports” describes the maintained use of the source; limitations prevent overclaiming.
| ID | Primary source | Authority / scope | Supports | Limitations and review flags |
|---|---|---|---|---|
| SRC-001 | UK GDPR | Retained UK data-protection law | Principles; Articles 6 and 9; transparency, accountability, security and DPIA | Not an NHS disclosure power and does not satisfy confidentiality; read with DPA and DUAA |
| SRC-002 | Data Protection Act 2018, Schedule 1 | UK legislation | Health/social care, public health, research/statistics and substantial-public-interest conditions and safeguards | Supplements Article 9; does not replace Article 6, necessity or confidentiality |
| SRC-003 | Data (Use and Access) Act 2025 | UK amending legislation | Amendments to data protection and health/care information standards | Not a consolidated operational guide; commencement was staged |
| SRC-004 | ICO: what DUAA means for organisations | UK regulator guidance | All DUAA data-protection provisions in force by 19 June 2026; high-level changes | Regulator guidance, not legislation; does not resolve Article 9/confidentiality automatically |
| SRC-005 | ICO Data Sharing Code | Statutory data-sharing code | Purpose, necessity, roles, DPIA, agreements, transparency, security and review | Explicitly under review following DUAA; clause-level interpretations require revalidation |
| SRC-006 | Health and Social Care (Safety and Quality) Act 2015, section 3 | England health/adult-social-care legislation | Inserts the qualified section 251B individual-care sharing duty | Direct care only; objections/exceptions apply; does not override data protection/confidentiality |
| SRC-007 | NHS England: consent to using and sharing patient information | Primary-care good-practice guidance, v1.1 | Implied confidentiality consent for appropriate direct care; routes beyond care; distinction from GDPR consent | Guidance, not independent statutory power; validate unusual facts |
| SRC-008 | NHS Act 2006, section 251 | England/Wales primary legislation with England operational route | Regulation-making power for defined processing of CPI | Not self-executing or blanket permission; approval and conditions required |
| SRC-009 | National data opt-out operational policy | NHS England operational policy | Scope, CPI beyond individual care, main exceptions | Older core version with web updates; check current exemptions and programme facts |
| SRC-010 | National Data Guardian: Caldicott Principles | England ethical/governance framework | Eight principles including confidence to share and no surprises | Not standalone disclosure authority |
| SRC-011 | NHS England information standards | Official standards framework | Role of standards and amended section 250 regime | Only an applicable notice creates a scoped requirement |
| SRC-012 | Data Security and Protection Toolkit | NHS England assurance service | Required security/information-handling assurance and incident reporting | Completion does not prove a flow lawful or secure |
| SRC-013 | Standards Directory: about this service | NHS England discovery service | Directory contains mandated and non-mandated standards; ISNs and source specifications govern | Signposting only; status label is not universal authority |
| SRC-014 | Core Information Standard | Active NHS England standard | Shared-care content model and role/circumstance views | No ISN/s250 authority shown; non-prescriptive potential set |
| SRC-015 | GP Connect Access Record Structured – FHIR API | Active NHS England technical specification | Structured GP data for direct-care consumers | No ISN/s250 authority or known endorsement shown; capabilities vary |
| SRC-016 | NHS Number for General Practice and ISN | ISB 0149-01, ISN and section 250 | Patient identification in General Practice | Confirm notice scope and implementation facts |
| SRC-017 | SNOMED CT and ISN | SCCI0034 Amd 35/2016, ISN and section 250 | Common clinical terminology; GP full conformance 1 April 2018 and most other direct-care settings 1 April 2020 | Check current edition and setting-specific timetable; social-care timetable differs |
| SRC-018 | NHS dictionary of medicines and devices and ISN | SCCI0052 Amd 13/2013, ISN and section 250 | Standard medicines/device identifiers in direct-care electronic exchange | Check current release, notice scope and dates |
| SRC-019 | DCB0129 standard and ISN | DCB0129 Amd 24/2018, ISN and section 250 | Manufacturer/modifier clinical-safety process | Revision consultation closes 11 September 2026; current standard remains active |
| SRC-020 | DCB0160 standard and ISN | DCB0160 Amd 25/2018, ISN and section 250 | Deploying organisation clinical-safety process | Revision consultation closes 11 September 2026; current standard remains active |
| SRC-021 | Compliance with National Data Opt-outs and ISN | DCB3058 Amd 91/2018, ISN and section 250 | Mandatory operational compliance for scoped CPI beyond care; organisations required to honour opt-outs by 31 July 2022 | Not a lawful basis and does not block ordinary direct care |
| SRC-022 | UK Core FHIR Release 4 – Governance and ISN | DAPB4020 Amd 33/2021, ISN and section 250 | Governance for cross-boundary FHIR profiling | No fixed full-conformance date; assess impact and plan |
| SRC-023 | Personalised Care and Support Plan and ISN | DAPB4022 Amd 38/2021 v1.0.0, ISN and section 250 | Scoped longitudinal care-plan content; full conformance 31 January 2024 | Applies only to specified organisations/use cases |
| SRC-024 | Community Pharmacy Information Standard and ISN | DAPB4008 5/2023, ISN and section 250 | Pharmacy-to-GP information transfers; implementation 1 July 2023 and full conformance 31 March 2025 | Some interim transport may remain for flows without completed messaging |
| SRC-025 | Transfer of Care – Acute Inpatient Discharge and ISN | DAPB4042 Amd 75/2021 v1.0.0, ISN, section 250 and contract | Structured acute/day-case discharge to GP; effective 1 April 2022 and full conformance 31 October 2022 | Scope-specific; verify latest artefacts and contract |
| SRC-026 | Clinical Referral Information Standard | Active NHS England content standard | Structured primary-to-secondary referral content | No ISN/s250 authority shown; internal mandatory sections concern adopter conformance |
| SRC-027 | NHS Booking and Referral Standard and ISN | DAPB4060 Amd 99-2021, ISN and section 250 | Published BaRS booking/referral use cases; implementation 15 April 2023 | Not a universal GP-referral mandate; no single full-conformance date |
| SRC-028 | Pathology and Laboratory Medicine Reporting Information Standard, ISN, requirements specification and implementation update | DAPB4101 Amd 63/2023 publication v1.0.0, requirements document v1.1, ISN and section 250 | Scoped laboratory-to-GP direct-care reporting using pathology-specific UK Core FHIR R4 and SNOMED CT; LIMS/middleware sends and GP systems receive/ingest; implementation pilot and transition position | The ISN still says full conformance 30 April 2025, while the 10 July 2026 implementation page says that date will be extended but gives no replacement; April 2027 is an intended testing/assurance milestone, not the revised deadline or proof of national rollout |
| SRC-029 | Health Bill collection, single patient record fact sheet and Parliamentary Bill record | UK Government and Parliament Bill materials | Current legislative status and proposed single-patient-record regulation framework introduced in 2026 | Bill, not current law; text may change and enacted provisions may require commencement and regulations |
| SRC-030 | Control of Patient Information Regulations 2002 | UK statutory instrument operating principally for England/Wales functions | Section 251 routes and conditions | Apply exact regulation, approval and current policy |
| SRC-031 | NHS England: data and clinical record sharing | Official primary-care guidance | Operational record-sharing expectations and safeguards | Guidance; check publication/version and local facts |
| SRC-032 | About standards | NHS England explanatory material | Standards lifecycle and interpretation | Summary; authoritative notice/specification controls |
| SRC-033 | Health Data Opt-Out Advisory Group minutes, May 2026 | NHS England/DHSC policy record, edited 18 June 2026 | Current Type 1 opt-out operates at GP IT level and prevents identifiable GP record data leaving for beyond-care purposes | Opt-out reform is under development; no single unified Type 1 policy document |
| SRC-034 | Health and Social Care Act 2012, section 250 | England primary legislation | Power, application and compliance basis for information standards | Read as currently amended and with the published standard |
| SRC-035 | Data (Use and Access) Act 2025, Schedule 15 | UK amending legislation applying to England health/adult social care | Extends section 250 to IT/IT services and strengthens standards compliance | Read with commencement instrument and consolidated section 250 |
| SRC-036 | DUAA Commencement No. 6 Regulations 2026 | UK statutory instrument SI 2026/82 | Commences Schedule 15 information-standards amendments on 5 February 2026 | Commencement instrument only |
| SRC-037 | Health and Social Care Information Standards (Procedure) Regulations 2025 | England statutory instrument SI 2025/950 | Statutory procedure and required contents for published information standards | Procedure does not make a non-applicable standard applicable |
| SRC-038 | NHS England: assessment of GP contractual changes | NHS England GP contract implementation evidence, December 2025 | From 1 October 2025 practices were required to enable GP Connect read-only access for scoped NHS and private direct-care routes | Contractual requirement, not a GP Connect section 250 ISN |
| SRC-039 | NHS England: use GP Connect in your organisation | Current NHS England product guidance, edited 2 July 2026 | Direct-care purpose, transparency, sharing preferences and prohibition on beyond-care use except medical examiners | Product rule; check current capability and contract |
| SRC-040 | Data Security and Protection Toolkit standard | DAPB0086 Amd 21/2025 v8.0.0, section 250 and NHS Standard Contract | Scoped mandatory assurance; full conformance 30 June 2026 | Does not prove a particular flow lawful or secure |
| SRC-041 | Fit for the future: 10 Year Health Plan for England and official collection | DHSC/Government policy for England, July 2025 | Three strategic shifts; NHS App, SPR, neighbourhood, prevention and digital-delivery ambitions | Policy direction, not current disclosure authority, a contract term, an ISN or proof a capability is live |
| SRC-042 | 10 Year Health Plan impact statement and equalities impact assessment | DHSC programme impact material, published 2025–2026 | Variation in proposal maturity; integration, cyber, data-quality, vendor, inclusion, accessibility and equality risks | Programme-level assessments; costs/benefits remain incomplete and local DPIA/equality/safety assessment is still required |
| SRC-043 | NHS England: Single Patient Record | Current NHS England programme page | Early-stage design; architecture options; source-system retention; intended role-based access, audit, privacy and expected App access from 2028 | Architecture, controller responsibility, objection arrangements and implementation remain unsettled; programme page is not law |
| SRC-044 | Medium Term Planning Framework 2026/27–2028/29 | NHS England operational planning framework | Digital-by-default, NHS App, EPR and FDP expectations; 2026/27–2028/29 NHS Notify migration for acute, community and mental-health direct-to-patient communications; ICB primary-care messaging transition | Addressees, dates and service scope vary; not automatically an individual GP contractual term, information standard or legal sharing gateway |
| SRC-045 | Preparing the NHS for digital by default and Digitising the frontline | NHS England transformation guidance | Shared-care-record, EPR, workflow and workforce transformation direction | Programme and maturity guidance; does not prove local implementation or create authority |
| SRC-046 | NHS Long Term Plan, launch page, GP contract five-year framework and Digital-First Primary Care Policy consultation | Historical NHS England policy, delivery framework and consultation, 2019 | Origin and intended meaning of digital-first primary care alongside face-to-face care | Historical policy lineage; later contract/regulatory text controls and old milestones do not prove current delivery |
| SRC-047 | Standard GMS contract 2026/27 and current GP contract hub | Current NHS England standard contract for GMS practices | Core-hours multi-channel access; response rules; GP Connect; registration; automatic prospective and written-request remaining-record access; booking, prescriptions, secure communication, video and software duties | Check executed contract, contract type and local variation; PMS/APMS and recipient obligations may differ |
| SRC-048 | 2026/27 GP contract changes, supplementary information, SI 2026/532, 2026/27 GMS variation notice and SI 2025/727 | NHS England current contract material and 2026 GMS regulations, with the 2025 instrument retained for lineage | Uncapped core-hours online requests, response interpretation, non-digital routes and the 2025–2026 regulatory trail | Supplement is not itself a requirement; current contract/regulations/directions and actual variation control |
| SRC-049 | NHS England digital requirements guidance | NHS England primary-care guidance | How digital commitments were embedded in GP contract requirements | Explanatory synthesis, not a substitute for the current contract or regulation |
| SRC-050 | NHS App roadmap, features and technical specification | Current NHS England product and delivery material | Delivered/current App functions, planned work and integration/data-flow architecture | Roadmap does not cover every Plan commitment; supplier, cohort and local feature availability vary |
| SRC-051 | Access to patient records through the NHS App and online access to new GP record information | Current NHS England information-governance and practice guidance | Automatic prospective and requested remaining/historical-record access; safeguarding, serious-harm, third-party, child, proxy, redaction and controller responsibilities | Guidance; apply current contract, UK GDPR/DPA and the person’s facts; not the future SPR model |
| SRC-052 | Inclusive digital healthcare framework and digital accessibility guidance | NHS England inclusion/accessibility guidance | Digital complements non-digital support; five inclusion domains; equality and health-inequality context | Guidance rather than a standalone legal duty; determine applicable equality, contract, standard and accessibility requirements |
| SRC-053 | Digital Technology Assessment Criteria, DTAC legal-status guidance and remote-consulting governance | Current NHS England assurance/procurement guidance | Clinical safety, data protection, technical security, interoperability, usability/accessibility and local governance | DTAC is not generically legally required, though procurement, commissioning, contract or integration conditions may require it; it does not replace DPIA, DCB safety work or medical-device rules |
| SRC-054 | Accessible Information standard, ISN and requirements | DAPB1605 Amd 30/2025 v1.1.0, ISN and section 250 | Identify, record, flag, share, meet and review communication needs across scoped publicly funded services including GP | The ISN refers both implementation and full-conformance dates to the standard rather than stating exact dates; verify current implementation guidance |
| SRC-055 | Online and Video Consultation in General Practices and data provision notice | DAPB4031 Amd 54/2021, section 259 collection for all GP practices in England | Weekly online/video consultation usage-data collection; first extraction in March 2022 covered data from January 2022 | Collection duty, not patient-facing service requirement, record-exchange mandate or disclosure authority |
| SRC-056 | NHS App API directory entry and OpenAPI specification | Active NHS England production/beta FHIR communications API using UK Core STU1 extensions | Approved services can send in-App messages and notifications and receive supported replies/receipts after onboarding and permission | Communications API, not a generic interface for every NHS App integration; no known section 250 endorsement or universal mandate |
| SRC-057 | WCAG 2.2 directory entry, NHS service guidance and GOV.UK accessibility guidance | W3C standard plus NHS/Government guidance on public-sector accessibility law | WCAG 2.2 AA accessibility baseline and accessibility-statement expectations in applicable scopes | Determine whether the organisation/service is in statutory, contractual or integration scope; directory registration is not universal section 250 authority |
| SRC-058 | FDP frequently asked questions and FDP information-governance framework | NHS England FDP programme and governance material | Approved direct-care, care-coordination, operational and population-health-planning products; national, ICB and trust instances; local/national and defined joint-controller roles; product approval, DPIA, purpose-based access, opt-out and data-minimisation controls | FDP is not the SPR and does not displace source records or create authority for a new purpose |
| SRC-059 | NHS Online | Current NHS England programme page | Separate online-trust/planned-care service expected to begin from 2027 | Programme distinct from NHS App and SPR; planned service is not current nationwide entitlement |
| SRC-060 | Health Data Research Service programme overview and National Data Library progress update | NHS England/Government secondary-use programme material | Intended secure research access to linked health data and delivery milestones | Programme and roadmap material do not themselves establish a lawful basis, confidentiality gateway, approval or opt-out exception; determine those from current law, approvals and operational opt-out policy |
| SRC-061 | Equality Act 2010, section 20, section 29 and section 149 | UK primary legislation with role- and function-specific application | Reasonable-adjustment duties for services and the public-sector equality duty | Determine actor, function, protected characteristic and exact duty; does not itself prescribe a digital product or disclosure |
| SRC-062 | Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 and 2022 amendment | UK statutory instruments for in-scope public-sector websites and mobile applications | Accessibility requirements, statements, monitoring and enforcement in statutory scope | Definitions, exclusions, disproportionate-burden route and current amendments matter; do not assume every independent GP contractor is a public-sector body |
| SRC-063 | NHS Act 2006, section 13G, section 14Z35 and Health and Care Act 2022 explanatory notes | England primary health-service legislation | NHS England and ICB duties to have regard to reducing inequalities in access and outcomes | Organisation/function-specific duties; not a general data-sharing authority or automatic duty on every provider |
| SRC-064 | How to integrate with the NHS App and standards for NHS App integration | Current NHS England conditional integration gateway | NHS login, accessibility, NHS Service Standard, clinical safety, data protection, security, medical-device and assurance expectations for adopters | Conditions depend on feature/use case and do not create a universal integration mandate or sharing authority |
| SRC-065 | NHS England: guidance on AI-enabled ambient scribing products and publication record | Current NHS England England-only adoption guidance, version 2, updated April 2026 | Local responsibility; self-certified supplier registry; DCB0129/DCB0160, DPIA, integration, medical-device, transparency, human-review, monitoring and training expectations | Guidance and registry support procurement/assurance but do not replace local assessment, legal authority, safety case or accountable clinical review |
| SRC-066 | NICE Evidence Standards Framework for digital health technologies and framework overview | NICE evidence framework ECD7, updated August 2022 | Classification and evidence expectations for digital-health technology evaluation and purchasing | Meeting the framework does not mean NICE assessed or endorsed a product and is not regulatory approval |
| SRC-067 | MHRA: software and artificial intelligence as a medical device and AI and Digital Regulations Service guidance | UK medical-device regulator and cross-regulator NHS guidance service | Intended-purpose assessment, software/AI medical-device route and cumulative NHS clinical-safety/evidence considerations | Product- and function-specific classification is required; guidance does not approve a product or authorise processing |
| SRC-068 | NHS England: proxy access and how proxy access works | Current NHS England general-practice guidance, version 1.3 with care-home implementation material | Formal proxy identity, authority, scoped functions/record access, capacity, child-transition, coercion, safeguarding, review and audit controls | Guidance and current supplier capabilities; exact authority and access must be decided for the person and cannot be inferred from carer status |
| SRC-069 | Identity Verification and Authentication Standard, ISN and proxy authorisation use case | DAPB3051 Amd 59/2025 v3.1.0, ISN and section 250 | Controlled identity/authentication for scoped health/care digital access; effective 23 December 2025 and full conformance 31 December 2026; proxy use case | Authentication and relationship evidence do not themselves authorise every function, record item or controller context; apply exact standard/use-case scope |
| SRC-070 | NHS England: National Proxy Service | Current NHS England programme/service page, edited July 2026 | Optional private-beta status, current workflow/service level and estimated 2026–2028 portability/integration roadmap | Pilot and roadmap are not universal availability; dates depend on GP IT suppliers and stated future mandatory use requires then-current authoritative implementation evidence |
| SRC-071 | NHS England: AI rollout announcement | NHS England delivery announcement, 4 July 2026 | Limited AI-triage rollout; target of more than 200,000 patients within 12 months and all NHS App users by April 2028; traditional GP contact retained | Announcement and targets do not prove local availability, product assurance, clinical performance or a contractual response entitlement |
| SRC-072 | Quality strategy for NHS-funded care in England | National Quality Board/NHS England strategy, published 14 July 2026 | HealthStore testing and summer-2027 marketplace target; staged App/AI/feedback and digital-quality programme position | Strategy expressly does not introduce new requirements or service-specific targets; delivery, product status and operative authority require separate evidence |
| SRC-073 | NHS App accessibility statement | NHS England statutory accessibility statement, last tested October 2025 and reviewed December 2025 | Partial compliance with the Public Sector Bodies Accessibility Regulations/WCAG 2.2 AA, known defects and responsibility boundary for integrated services/content | Point-in-time test of selected screens; re-test current journeys, platforms, content and integrated services |
| SRC-074 | CIS2 Authentication and Care Identity Service roadmap | Current NHS England workforce identity product and roadmap | Live CIS2 use, application/API onboarding rules, RBAC options and CIS1 retirement; NHS-wide single sign-on remains future roadmap work | Authentication and optional/required integration scope vary; neither sign-on nor RBAC proves care relationship, purpose, need-to-know or disclosure authority |
| SRC-075 | NHS Choice Framework | DHSC guidance for England, updated October 2024 | Distinguishes specified legal choice rights from choices dependent on clinical circumstances and local/service availability | Guidance does not make every provider, self-referral or App option available; check current law, commissioning and the patient’s pathway |
| SRC-076 | NHS Notify digital-first strategy, live service overview, 2025 Directions, acceptable-use policy and transparency notice | NHS England live messaging service, service-operation Directions and mandatory conditions for users; the strategy page restates 2025/26 planning policy | NHS App-first configurable routing with email, SMS and letter fallback; API/MESH and PDS flow; sender and NHS England controller roles; accessibility, status, safety, preference, opt-out and retention controls | The Directions require NHS England to operate the service, not every provider to adopt it; the sender still needs its own authority; onboarding and some capabilities remain staged; reconcile current planning addressee and timetable through SRC-044 |