Governing instruments
The exam question is:
What legislation, regulations, standards, confidentiality rules, guidance and other controls govern information sharing into and out of UK primary healthcare?
There is no universal instrument list for every flow. Start with Information sharing out of primary healthcare or Information sharing into primary healthcare, choose the matching workflow, and treat every linked instrument as a candidate until its jurisdiction, purpose, organisations, direction, scope, version and date have been checked.
Jurisdiction
This evidence base principally supports primary healthcare in England. UK GDPR and the Data Protection Act 2018 apply across the UK, but health-service legislation, regulations, contracts, confidentiality governance, national standards and policy differ across England, Scotland, Wales and Northern Ireland. Do not transpose an England-only duty, standard or NHS England service position to another nation. VAL-007
Governing stack
Every real flow needs a cumulative answer. Passing one layer does not cure failure in another.
| Instrument class | What it can determine | Canonical detail |
|---|---|---|
| Legislation | Organisational functions, powers, duties, data-protection requirements and purpose-specific gateways | Legislation, powers and duties and Data protection and transparency |
| Regulations and statutory duties | Conditions, actors, purposes, data, recipients and timing for a scoped legal or contractual route | Legislation, powers and duties and Opt-outs and section 251 |
| Standards | Required or recommended content, meaning, transport, implementation, safety and conformance within a defined scope | Standards and interoperability and the NHS standards applicability register |
| Confidentiality, guidance and other controls | Common-law authority, patient expectations and choices, professional duties, contracts, clinical safety, security, audit, correction and local assurance | Confidentiality and Caldicott and Clinical safety and security controls |
Status labels
- Baseline: applies to every in-scope flow of the stated kind, such as current data-protection and accountability requirements where personal data are processed.
- Conditional: applies only when its stated trigger, purpose, actor or confidentiality route is present.
- Scope-dependent: applies only when the notice, contract, service, organisation, workflow, direction, version and date match.
- Guidance or local control: informs or assures the decision but must not be described as legislation or a general statutory mandate.
- Future proposal: policy, Bill, pilot, roadmap or planned service that does not itself authorise the present flow.
After identifying the candidates, apply the Decision guide and record the result in Record a sharing decision. The decision must state which instruments apply, do not apply or need validation; a citation or Standards Directory listing alone is not the answer.