Validation queue
Items remain here until a current primary source and a recorded decision resolve them.
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-001 | High | Re-check ICO Data Sharing Code interpretations affected by DUAA when the revised code/guidance is published. | ICO update / wiki maintainer |
| VAL-002 | High | Re-check DCB0129 and DCB0160 after the consultation closing 11 September 2026; do not assume draft replacements. | Standards update / clinical-safety lead |
| VAL-003 | High | For every real flow, confirm controller roles, statutory function, Article 6/9, confidentiality route and national data opt-out result. | Before approval / controller, DPO, Caldicott Guardian |
| VAL-004 | High | Verify current ISN, specification version, scope and conformance date for each standard selected from the register. | Design and release / standards owner |
| VAL-005 | Medium | Confirm GP Connect capability/version status and the supported consumer/provider combinations for the selected supplier estate. | Technical design / integration lead |
| VAL-006 | Medium | Confirm national data opt-out exceptions and operational-policy version for the exact beyond-care use. | Before processing / IG lead |
| VAL-007 | Medium | Add devolved-nation law and policy before relying on this wiki for Scotland, Wales or Northern Ireland. | Cross-border proposal / legal and IG leads |
| VAL-008 | High | Track Health Bill passage, amendments, Royal Assent, commencement and SPR regulations/standards; re-check architecture, contributor/access scope, controllers, objection design, enforcement and phased cohorts. | Monthly while Bill active and at each formal instrument / wiki maintainer |
| VAL-009 | Low | Confirm access to the Cloudflare Pages production project and require canonical HTTP-200 health before and after every publication; treat the local service only as the workstation runtime and recovery aid. | Every publication / service owner |
| VAL-010 | High | Search for the exact use-case statutory gateway or duty, including NHS England requests/directions, safeguarding, public-health/notifiable-disease, court/regulator and specialist rules. | Before approval / legal, DPO and Caldicott leads |
| VAL-011 | Medium | Track current Type 1 and national data opt-out reform; retain both checks until authoritative policy and implementation change. | Quarterly and at reform publication / IG lead |
Digital programme validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-012 | High | For each practice, verify the executed GMS/PMS/APMS contract, current variation/directions and supplier capability before asserting a digital access, GP Connect or record-access requirement. | Design and contract review / commissioner and practice |
| VAL-013 | High | Re-check each Plan, NHS App, SPR, FDP, HDRS, NHS Online, neighbourhood or planning-framework milestone against current official status and live local availability; classify delivered, in delivery, proposed or superseded. | Before dependency and quarterly / programme owner |
| VAL-014 | High | Complete flow-specific digital-inclusion, equality, accessibility and communication-needs assessment, including non-digital/assisted fallback and actual user testing. | Discovery and before go-live / service owner and equality lead |
| VAL-015 | High | Confirm NHS App record date range, proxy/child rules, serious-harm/third-party redaction and the workflow for correspondence that may become patient-visible. | Before record-access change / practice IG and safeguarding leads |
| VAL-016 | High | Validate GP Connect consumer onboarding and assured private-provider route for the exact organisation/use case; reconcile current product and contract wording rather than assuming access. | Before connection / GP Connect assurance and controller leads |
| VAL-017 | Medium | Confirm the current Accessible Information implementation timetable and the statutory, contractual or gateway basis for WCAG 2.2 in the selected organisation/service. | Procurement and annual review / accessibility and legal leads |
| VAL-018 | High | Re-check the current DTAC form, DCB0129/DCB0160 applicability, medical-device/AI status, clinical-safety case and DPIA for every digital product and material change. | Procurement, deployment and change / safety, DPO and procurement leads |
| VAL-019 | High | For FDP, HDRS, risk stratification, wearable or AI use, separate direct-care, operational/planning and research purposes; validate controllers, opt-outs, approvals, transparency and platform product configuration. | Before data onboarding/use / controller, IG and programme leads |
Chapter 3 validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-020 | High | Re-check every named Chapter 3 App tool against the current NHS App roadmap, delivery announcements, live integrations, service specification, supplier, cohort and geography; do not infer the whole named tool from one existing feature or rollout target. | Quarterly and before dependency / App and service owners |
| VAL-021 | High | For each AI function, define intended purpose, level of automation and significant effect; determine medical-device status, meaningful human involvement, clinical-safety work, equality/bias testing, DPIA, escalation and version-change controls. | Discovery, procurement and material change / clinical-safety, DPO and regulatory leads |
| VAL-022 | High | For wearable, sensor and remote-monitoring flows, verify device/measurement provenance, eligible dataset, monitoring service, alert thresholds, response times, liability, retention, correction, patient choice and each downstream reuse. | Before onboarding / clinical, device, IG and service leads |
| VAL-023 | High | When HealthStore delivery material appears, verify the catalogue, meaning of approval, NICE evaluation, device status, DTAC/integration evidence, procurement terms, eligibility, controller/processor chain, support and withdrawal route for each product. | Product selection and every version / commissioner and product owner |
| VAL-024 | High | Track DAPB3051 conformance and National Proxy Service pilot/portability status. For My Carer or other delegated access, verify identity and authority separately; document controller context, scope, capacity or best-interests route, child transition, safeguarding/coercion checks, audit, review and revocation. | Before grant, at conformance date and periodic review / practice, safeguarding and IG leads |
| VAL-025 | High | Before using social-risk data, provider ratings or AI-analysed feedback, validate source, purpose, accuracy, representativeness, role access, fairness, contestability, public display, retention and consequences of missing or incorrect information. | Design and before consequential use / service, equality, DPO and clinical leads |
| VAL-026 | High | Identify the officially procured proactive planned-care platform and separately confirm its relationship to SPR, FDP and EPRs; validate architecture, controllers, service scope, standards, monitoring responsibility, supplier assurance and local availability. | Procurement publication and before adoption / programme and architecture leads |
| VAL-027 | Medium | Re-check CIS2 integration scope, CIS1 retirement and NHS single-sign-on roadmap; for the selected application, verify identity assurance, RBAC, local authorisation, care-relationship/need-to-know controls and fallback. | Integration and roadmap change / identity and access lead |
Standards implementation validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-028 | High | Track the amended DAPB4101 ISN or other formal replacement full-conformance date, pilot assurance outcome and supplier/national-rollout roadmap. For each implementation, confirm sender/receiver and specialty scope, current FHIR IG/API and SNOMED edition, PaLM/PBCL mapping, EDIFACT coexistence/cutover, acknowledgements and error handling, and DCB0129/DCB0160 readiness. Until an authoritative replacement is published, present 30 April 2025 as the date still shown in the current ISN and April 2027 only as NHS England’s intended testing/assurance milestone. | Standards-page change and quarterly / pathology standards owner and wiki maintainer |
Messaging implementation validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-029 | High | Before an NHS Notify migration or message campaign, confirm the current planning addressee and timetable, service eligibility and supplier onboarding, API/MESH version, purpose and controller/processor roles, NHS-number/contact source, PDS restrictions, locally held preferences and objections, national data opt-out result where applicable, channel order and timeout, accessibility/language templates, reply route, urgent alternative, delivery-status meaning, callback/report reconciliation, retention, transparency, incident handling and DCB0129/DCB0160 scope. Do not treat a push notification, technical delivery status or roadmap item as proof that the recipient read, understood or acted on the message. | Migration design, every material message-plan change and quarterly policy review / ICB, sender, IG, clinical-safety and integration leads |
Imaging implementation validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-030 | High | Before relying on the National Imaging Registry, reconcile the API catalogue’s production-beta label with the service page’s movement towards private-beta go-live; confirm the accepted PHC producer or consumer use case, participating networks and content, current API version and live endpoint, current XCA/XCA-I transactions, whether any MHD/FHIR capability has become operational, service level, onboarding and agreement status, controller and processor roles, DCB0129/DCB0160, DSPT, DPIA and privacy information, identity/role/purpose assertion, PARS and local audit, patient matching, duplicate handling, incomplete or failed retrieval, correction, downtime and offboarding. | Use-case submission, before go-live, material API/service change and quarterly / service owner, supplier, IG and clinical-safety leads |
Required-disclosure validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-031 | High | Before a safeguarding disclosure, distinguish the child or adult route and immediate risk; identify the organisation, function, exact duty or permission and authenticated recipient; record the UK GDPR Article 6 basis, Article 9 condition and DPA safeguard, separate confidentiality route, necessity, proportionality and minimum data; address wishes, consent, capacity or best interests where relevant, subject notification, secure transfer, disclosure log and current local multi-agency procedure. Re-check commencement and final guidance for Children Act section 16LA, and verify any specialist mandatory-reporting route separately. | Every material safeguarding disclosure and legal/guidance change / safeguarding lead, Caldicott Guardian, DPO and legal lead |
| VAL-032 | High | Before a public-health notification, verify the current disease or organism schedule, registered-medical-practitioner or laboratory duty, suspicion or confirmation trigger, proper officer or UKHSA recipient, urgent or routine deadline, required data and reporting channel, and COPI regulation 3 conditions. Distinguish a statutory notification from reporting another significant infection or other public-health hazard, and record minimisation, security and any follow-up disclosure. | Every uncommon notification, schedule change and annual review / reporting clinician or laboratory, health-protection and IG leads |
| VAL-033 | High | Before responding to a court, coroner, police, solicitor or regulator request, authenticate the requester and identify the exact order, statutory notice, power, jurisdiction and function; decide whether production is compulsory, permitted or merely requested; limit disclosure to relevant information in the required form; address third-party material, privilege or other restrictions, patient notification, secure delivery, receipt and audit. Seek legal advice where the instrument or scope is uncertain. | Every request outside a settled routine and every instrument change / legal, Caldicott Guardian, DPO and records leads |
| VAL-034 | High | Before an NHS England collection, verify the current direction or request and exact Data Provision Notice version; confirm that the organisation is in scope and whether provision is mandatory or requested; record purpose, fields, form, manner, period, active or withdrawn status, controller and processor roles, confidentiality and UK GDPR position, transparency, Type 1 and national data opt-out result where applicable, data-quality and correction controls, retention and receipt. | Before first submission, each notice/version change and annual review / collection owner, practice, commissioner and IG leads |
Registration and record-transfer validation
| ID | Priority | Validation needed | Trigger / owner |
|---|---|---|---|
| VAL-035 | High | Before changing a registration or GP-record-transfer workflow, confirm the executed GMS, PMS or APMS terms and current amendments; exact Register, PCRM, PDS and GP2GP interfaces and supplier capability; permanent or temporary, child or capacity, out-of-area, SAS and restricted-record cases; patient match, NHS number and old-practice ODS code; sender, receiver, NHS England or Board and processor roles; Article 6 and 9 and confidentiality route; paper, outage and non-interoperable paths; the 28-day outgoing response deadline versus eight-day receiving-integration target; positive acknowledgement and unconfirmed or paper fallback; attachments and large records; duplicate, confusion and sensitive-PDS flags; degraded codes, allergies and medicines; provenance, completeness, redactions and patient-access settings; RBAC, audit, CAP onboarding, correction, incidents and offboarding; and current automation, deprecation and roadmap status. | Workflow design, supplier or version change and before go-live / practice, commissioner, supplier, IG and clinical-safety leads |