Executive summary
Core primary healthcare (PHC) summary
Board-level orientation
This page gives the short answer for England, as at 27 July 2026. Use the linked decision, legal, standards and evidence pages before approving a real data flow.
Primary healthcare is both a sender and a receiver of information. Direction identifies different operational risks; it does not determine legal authority. Every flow still needs one defined purpose, identified senders and recipients, necessary information, organisational authority, a data-protection and confidentiality route, patient-choice and transparency controls, applicable standards, clinical safety, security and accountable ownership.
| Direction | Workflow activities | Detailed summary |
|---|---|---|
| Information leaving PHC | Shared-care and summary-record access, diagnostic test ordering, referrals, transfers of care, medicines, patient communications and reporting or analytics. | 1. Information sharing out of primary healthcare |
| Information entering PHC | Shared-care record views, diagnostic results, referral outcomes, discharge information, community-pharmacy events, care plans and patient-generated information. | 2. Information sharing into primary healthcare |
For information leaving PHC, require a justified disclosure, an identified recipient and controlled onward use. For information entering PHC, require correct patient matching, provenance, preserved meaning, a named clinical owner, acknowledgement, correction and downtime handling. There is no universal minimum or maximum dataset in either direction: the minimum is the necessary information with the full governance floor; the maximum is the widest justified, role-authorised and safely controlled availability—not the whole record.
The question
For each use of primary-care information, what is the minimum that must be shared or controlled, what is the maximum that may safely be made available, and which rules apply?
There is no single dataset or rule that answers this. Start with one specific flow: who sends what, to whom, about which person or population, for what purpose, and with what benefit?
The answer in 60 seconds
- There is no universal minimum or maximum primary-care dataset.
- Purpose comes before product. A platform, supplier, NHS badge or destination does not decide whether sharing is justified.
- Every applicable check must pass. Purpose and organisational authority, UK GDPR Article 6 and—where special-category health data are involved—Article 9, Data Protection Act safeguards, a separate confidentiality route, patient choices, transparency, security, safety, applicable contracts and information standards must all pass where they apply.
- Direct individual care and beyond-care use are different routes. Necessary, role-relevant information may—and sometimes must—be shared for individual care when the conditions are met. Section 251B is a qualified duty where it applies, not a right to the whole record. Research, planning, commissioning and other beyond-care uses need a separate decision. SRC-006 SRC-007 SRC-008
- “Maximum” means the widest justified, role-appropriate availability—not the whole record.
- Standards and digital programmes support delivery; they do not create the purpose or legal authority.
Choose the data flow
| If the flow is… | Start here | The first question |
|---|---|---|
| Information entering primary care, such as results, discharge or pharmacy messages | Sharing with the wider NHS and the NHS standards applicability register | Who owns matching, review, action, correction and downtime? |
| Primary-care information used by another team for this person’s care | Direct-care sharing route | Is the recipient genuinely involved in care, and is each item relevant now? |
| Information shared with an independent, voluntary, social-care or other provider | Sharing with other providers | What service and role justify access, and how is onward use controlled? |
| Record access, messages, proxy access or patient-generated information | Digital-first and NHS App analysis | What exact function is this, who is authorised, and what happens when digital delivery fails? |
| Research, planning, commissioning, audit or population health | Beyond-care sharing route | Can anonymous information achieve the purpose; if not, what separate confidentiality route and opt-out result apply? |
| A proposed NHS digital product or 10 Year Health Plan commitment | Chapter 3 commitment map | Is it law, a contract, a standard, a live service, a pilot or a future proposal? |
Not sure which row fits? Use the Decision guide before choosing a dataset, API or contract.
Minimum, conditional and maximum
1. Required floor
Define the purpose, parties and necessary data. Then evidence every applicable legal, confidentiality, patient-choice, transparency, security, safety, contractual and information-standard requirement. One passed layer does not cure a failure in another.2. Conditional sharing envelope
For individual care, disclose only necessary, role-relevant information under the applicable confidentiality route. Where section 251B applies, also test whether sharing is likely to facilitate care, is in the person’s best interests and is not barred by a statutory exception. Beyond care, use a separate and usually narrower route for identifiable information.3. Higher-assurance ceiling
Make no more than the necessary, proportionate and purpose-relevant information safely available to the right role, at the right time, in an interoperable form. Add reliable identity, access, audit, correction, safety, security and lifecycle controls. Do not turn technical access into whole-record entitlement.The maintained detail is in the Minimum-to-maximum requirement model.
What directors should require
Ask for one completed decision record for every materially different purpose:
- What exact flow and practical benefit are being approved?
- Is the purpose individual care or a separately named beyond-care use?
- Who decides the purpose and means, and who processes information for them?
- What organisational authority, Article 6 basis, Article 9 condition where needed, and separate confidentiality route apply?
- Which data items and staff roles are necessary, and which objections or opt-outs apply?
- Which current standards, contracts, safety, security, accessibility and fallback controls apply?
- Who owns approval, monitoring, correction, incidents, service exit and revalidation?
Stop or redesign
Do not proceed if the purpose is vague, authority or confidentiality is missing, whole-record access is the default, direct-care data are silently reused beyond care, a future programme is treated as current authority, or applicable standards and assurance cannot be evidenced.
Continue with the Decision guide and record the answer in the Sharing route decision workflow. For proof, use the Evidence matrix and Source register.