Validation queue
Items remain here until a current primary source and a recorded decision resolve them.
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-001 | High | Re-check ICO Data Sharing Code interpretations affected by DUAA when the revised code/guidance is published. | ICO update / wiki maintainer |
| VAL-002 | High | Re-check DCB0129 and DCB0160 after the consultation closing 11 September 2026; do not assume draft replacements. | Standards update / clinical-safety lead |
| VAL-003 | High | For every real flow, confirm controller roles, statutory function, Article 6/9, confidentiality route and national data opt-out result. | Before approval / controller, DPO, Caldicott Guardian |
| VAL-004 | High | Verify current ISN, specification version, scope and conformance date for each standard selected from the register. | Design and release / standards owner |
| VAL-005 | Medium | Confirm GP Connect capability/version status and the supported consumer/provider combinations for the selected supplier estate. | Technical design / integration lead |
| VAL-006 | Medium | Confirm national data opt-out exceptions and operational-policy version for the exact beyond-care use. | Before processing / IG lead |
| VAL-007 | Medium | Add devolved-nation law and policy before relying on this wiki for Scotland, Wales or Northern Ireland. | Cross-border proposal / legal and IG leads |
| VAL-008 | High | Track Health Bill passage, amendments, Royal Assent, commencement and SPR regulations/standards; re-check architecture, contributor/access scope, controllers, objection design, enforcement and phased cohorts. | Monthly while Bill active and at each formal instrument / wiki maintainer |
| VAL-009 | Low | Confirm access to the Cloudflare Pages production project and require canonical HTTP-200 health before and after every publication; treat the local service only as the workstation runtime and recovery aid. | Every publication / service owner |
| VAL-010 | High | Search for the exact use-case statutory gateway or duty, including NHS England requests/directions, safeguarding, public-health/notifiable-disease, court/regulator and specialist rules. | Before approval / legal, DPO and Caldicott leads |
| VAL-011 | Medium | Track current Type 1 and national data opt-out reform; retain both checks until authoritative policy and implementation change. | Quarterly and at reform publication / IG lead |
Digital programme validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-012 | High | For each practice, verify the executed GMS/PMS/APMS contract, current variation/directions and supplier capability before asserting a digital access, GP Connect or record-access requirement. | Design and contract review / commissioner and practice |
| VAL-013 | High | Re-check each Plan, NHS App, SPR, FDP, HDRS, NHS Online, neighbourhood or planning-framework milestone against current official status and live local availability; classify delivered, in delivery, proposed or superseded. | Before dependency and quarterly / programme owner |
| VAL-014 | High | Complete flow-specific digital-inclusion, equality, accessibility and communication-needs assessment, including non-digital/assisted fallback and actual user testing. | Discovery and before go-live / service owner and equality lead |
| VAL-015 | High | Confirm NHS App record date range, proxy/child rules, serious-harm/third-party redaction and the workflow for correspondence that may become patient-visible. | Before record-access change / practice IG and safeguarding leads |
| VAL-016 | High | Validate GP Connect consumer onboarding and assured private-provider route for the exact organisation/use case; reconcile current product and contract wording rather than assuming access. | Before connection / GP Connect assurance and controller leads |
| VAL-017 | Medium | Confirm the current Accessible Information implementation timetable and the statutory, contractual or gateway basis for WCAG 2.2 in the selected organisation/service. | Procurement and annual review / accessibility and legal leads |
| VAL-018 | High | Re-check the current DTAC form, DCB0129/DCB0160 applicability, medical-device/AI status, clinical-safety case and DPIA for every digital product and material change. | Procurement, deployment and change / safety, DPO and procurement leads |
| VAL-019 | High | For FDP, HDRS, risk stratification, wearable or AI use, separate direct-care, operational/planning and research purposes; validate controllers, opt-outs, approvals, transparency and platform product configuration. | Before data onboarding/use / controller, IG and programme leads |
Chapter 3 validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-020 | High | Re-check every named Chapter 3 App tool against the current NHS App roadmap, delivery announcements, live integrations, service specification, supplier, cohort and geography; do not infer the whole named tool from one existing feature or rollout target. | Quarterly and before dependency / App and service owners |
| VAL-021 | High | For each AI function, define intended purpose, level of automation and significant effect; determine medical-device status, meaningful human involvement, clinical-safety work, equality/bias testing, DPIA, escalation and version-change controls. | Discovery, procurement and material change / clinical-safety, DPO and regulatory leads |
| VAL-022 | High | For wearable, sensor and remote-monitoring flows, verify device/measurement provenance, eligible dataset, monitoring service, alert thresholds, response times, liability, retention, correction, patient choice and each downstream reuse. | Before onboarding / clinical, device, IG and service leads |
| VAL-023 | High | When HealthStore delivery material appears, verify the catalogue, meaning of approval, NICE evaluation, device status, DTAC/integration evidence, procurement terms, eligibility, controller/processor chain, support and withdrawal route for each product. | Product selection and every version / commissioner and product owner |
| VAL-024 | High | Track DAPB3051 conformance and National Proxy Service pilot/portability status. For My Carer or other delegated access, verify identity and authority separately; document controller context, scope, capacity or best-interests route, child transition, safeguarding/coercion checks, audit, review and revocation. | Before grant, at conformance date and periodic review / practice, safeguarding and IG leads |
| VAL-025 | High | Before using social-risk data, provider ratings or AI-analysed feedback, validate source, purpose, accuracy, representativeness, role access, fairness, contestability, public display, retention and consequences of missing or incorrect information. | Design and before consequential use / service, equality, DPO and clinical leads |
| VAL-026 | High | Identify the officially procured proactive planned-care platform and separately confirm its relationship to SPR, FDP and EPRs; validate architecture, controllers, service scope, standards, monitoring responsibility, supplier assurance and local availability. | Procurement publication and before adoption / programme and architecture leads |
| VAL-027 | Medium | Re-check CIS2 integration scope, CIS1 retirement and NHS single-sign-on roadmap; for the selected application, verify identity assurance, RBAC, local authorisation, care-relationship/need-to-know controls and fallback. | Integration and roadmap change / identity and access lead |
Standards implementation validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-028 | High | Track the amended DAPB4101 ISN or other formal replacement full-conformance date, pilot assurance outcome and supplier/national-rollout roadmap. For each implementation, confirm sender/receiver and specialty scope, current FHIR IG/API and SNOMED edition, PaLM/PBCL mapping, EDIFACT coexistence/cutover, acknowledgements and error handling, and DCB0129/DCB0160 readiness. Until an authoritative replacement is published, present 30 April 2025 as the date still shown in the current ISN and April 2027 only as NHS England’s intended testing/assurance milestone. | Standards-page change and quarterly / pathology standards owner and wiki maintainer |
Messaging implementation validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-029 | High | Before an NHS Notify migration or message campaign, confirm the current planning addressee and timetable, service eligibility and supplier onboarding, API/MESH version, purpose and controller/processor roles, NHS-number/contact source, PDS restrictions, locally held preferences and objections, national data opt-out result where applicable, channel order and timeout, accessibility/language templates, reply route, urgent alternative, delivery-status meaning, callback/report reconciliation, retention, transparency, incident handling and DCB0129/DCB0160 scope. Do not treat a push notification, technical delivery status or roadmap item as proof that the recipient read, understood or acted on the message. | Migration design, every material message-plan change and quarterly policy review / ICB, sender, IG, clinical-safety and integration leads |