Skip to content

Requirement envelope

The requirement model separates three questions that are often collapsed:

  1. What must be true before any sharing? The mandatory legal and governance floor.
  2. What may or must be shared for this precise flow? The conditional envelope created by purpose, authority, role, data, objection and applicable standards.
  3. What does a mature implementation add? Stronger interoperability, safety, security, audit and operational assurance without widening access beyond purpose.

Read the minimum-to-maximum requirement model, then complete the sharing route decision workflow. Choose the direct-care sharing route or beyond-care sharing route before consulting the NHS standards applicability register.

Non-negotiable distinctions

  • UK GDPR consent and common-law confidentiality consent are different legal concepts.
  • A statutory power or duty does not replace the Article 6/Article 9 analysis, and those data-protection conditions do not replace confidentiality authority.
  • A standard can require format, terminology, safety or assurance; it does not by itself make a disclosure lawful.
  • Pseudonymisation reduces risk but normally does not make data anonymous.
  • “Need to share” for care does not mean unrestricted access or an entire-record default.

Evidence: SRC-001, SRC-002, SRC-005, SRC-006, SRC-007, SRC-011.