NHS England makes another privacy mess (and will hide abuses from patients)

[If you’ve seen media coverage and want to help in finding out how to see who’s been creeping on your records, we have a page to help you find out. This piece was first published in August 2026 and relates to continuing high profile investigations and news. The September/October 2026 reannouncements about suspected abuse relate to “high profile” cases only. The NHS in England keeps track of who looks up which patients and when, but is insisting on keeping the audit log that NHS England has away from the patients – in most cases the only person who can provide confirmation of abuse is the patient, who may never be told anything unless it’s already proven. There is no Privacy, no Transparency and no Trust while patients are deliberately kept in the dark by NHS England about potential abusive access to their medical notes.]

NHS England has changed its mind, and decided you’ll still be kept in the dark about what one victim called “repugnant voyeurism” into your medical notes. Ministers promised you’d control your data; what was announced with such fanfare as protecting patients has quietly become its opposite. Promises keep getting broken.

The guidance that is supposed to stop unlawful access now gives creeps, voyeurs and ghouls more excuses to look. It’s easier for them to look, easier for hospitals to cover it up, and not at all easier for you to know anything happened.

Continue reading →

It could be you… why isn’t creeping being prevented?

NHS staff keep snooping on NHS patients, including terrorism victims. “A disgrace” said the Health Secretary; the Information Commissioner called it a “worrying trend”. Those are only words, and the Department of Health in England is refusing to do what it can to prevent the problem in the first place.

Your NHS record can be read by thousands of staff, and you aren’t allowed to see who read your notes. There is no privacy, no transparency, and no trust. The NHS talks about response in high profile cases, but response only happens after getting caught. It does nothing to remove the reason the day to day creeping keeps happening. The officials who could change that simply refuse to.

The NHS exists to help people. Creeps keep creeping via “Inappropriate access” partly because A&E has to work, and pharmacies have to work, and the creeps, voyeurs and ghouls take advantage. The other part is that nobody can see them doing it.

The Department of Health in England acts as though staff creeping on patients is just a cost of doing business, the same way water companies dump sewage in the river.

Officials insist that there’s nothing which patients can do to know whether anyone creeped on them, or be reassured that their medical notes were not read by people who shouldn’t have looked.

The Department of Health in England treats the hospital as the victim, and neglects the patients as an inconvenience. The official message to patients is, in effect: please stop complaining about staff looking up your records (our guidance is here).

You are generally not allowed to know who has looked at your medical records. The Department of Health in England knows when and where your records are accessed. They keep track in a database. They simply refuse to tell you in the NHS App, because the decision makers know it is worse for them for you to see the abuses than not to see them.

Officials keep things hidden because they can, and because they expect no impact on the NHS from the cover-up, even if that means staff can go creeping without getting caught. The vast majority of the time, that’s what happens.

Computer systems allow abuses to be hidden in a way that’s impossible in the real world

Think of the hospital room. Think of the records like the chart at the end of your bed.

There is a very wide range of things that go on to keep hospitals working. You might not like the number of people, and one of them might be your friend from primary school, but if they’re your doctor or on your medical team they can explain why they’re there. They’re responsible and they’re doing their job.

Anyone who wants to look has to walk into your room, and talk to you about what they’re doing as they look at your chart. You’d expect your doctor to do that, but being a doctor doesn’t automatically make someone your doctor – they should introduce themselves.

Now consider the person you once went on a date with, slinking in, reading your chart, smirking a bit, and leaving without saying anything to you. That’s weird, and most NHS staff would find it abhorrent, whether in the hospital or via a computer.

That NHS staff provide care doesn’t mean they’re providing appropriate care to you. That they can access your record doesn’t mean they have an appropriate reason for doing so. Someone being a teacher at a primary school doesn’t make them a teacher at your child’s school, and it doesn’t entitle them to mark your child’s homework. Being a doctor doesn’t make them your doctor, and only your direct care team gives you direct care. Direct care is the difference between a skilled surgeon in the sterile operating theatre and a stranger walking in.

When a computer is involved, the Department of Health in England thinks that anything a member of NHS staff decides to do must be appropriate because an NHS employee or contractor does it, and the NHS will keep you in the dark. It is a deliberate and institutional failure of privacy, of transparency, and of trust.

And that’s why it keeps happening.

It will keep happening until every NHS staff member knows that if they look up a patient, the patient will see that it happened, and they would have to explain it to the patient the same way a doctor coming into your hospital room can tell you why they’re there. Suspension is a start for cases that come to light. A record of every access, visible to the patient in the NHS App, is what would change behaviour because every case would be visible to the person most interested in your medical records: you.

===

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.

Recommendations of Public Inquiries (Covid, Thirlwall, and many, many others)

Parliament is considering what to do about public bodies ignoring recommendations from Inquiries. Every Inquiry recommendation and Coroner report should appear in the annual report of the Department responsible, every year, until it is done.

When public funds are spent on an Inquiry, the annual report of the Lead Government Department should discuss the Inquiry’s recommendations and how implementation is going, every year, until the report says they are all complete and the National Audit Office has verified that. A “dashboard” is not meaningful scrutiny, particularly now that the Department of Health in England has stopped saying whether it accepts recommendations: a dashboard of accepted recommendations shows nothing if acceptance is never stated.

Why does nothing change even after failings are clear? Those whose past decisions created a scandal often refuse to believe that the continuing mess is their fault, so actively undermine improvements, and inertia lets them get away with it. 

As Grenfell resident Gill Kernick describes in her book, every decision makes sense from some perspective, even if objectively catastrophic: “The point is not to see where people went wrong, but [to see] why what they did made sense… Without this perspective, we cannot learn.” If permitted, institutions will not learn as the people who insist they did nothing wrong are still there to continue unchanged, irrespective of the consequences. Every scandal demonstrates the capacity for institutional denial.

Recommendation 17 of the Thirlwall Inquiry into events at the Countess of Chester Hospital reads: “A new responsibility for auditing the implementation of the recommendations of statutory inquiries into NHS bodies should be given to the National Audit Office. Funding for appropriate additional staffing should be made available so that it may begin its work by September 2027.” 

The NAO should be involved – but the recommendation appears influenced so as to close off and disempower effective scrutiny. (That NHS England didn’t object to it strongly is clearly a bad sign for its effectiveness.) The implementation should instead require the bodies responsible to outline progress in their Annual Reports, which the NAO already considers in their audit. This already happens for spending commitments, and the same explicit response should be applied to recommendations from Inquiries, and for prevention of future death reports. Because unless money is involved, organisations do not want to change – to be effective, bodies should expect to have to justify their failure to the Public Accounts Committee.

  1. Inquiries are Public Spending: Follow Up on Delivery of Recommendations
  2. A look at Departmental annual reports
  3. Health Investigations
  4. Someone Has To Be Watching
  5. What Parliament Can Do now

Inquiries Are Public Spending: Follow Up on Delivery of Recommendations 

The public interest doesn’t end when a report is public, but all too often external interest does. Departmental annual reports are usually scrutinised by the PAC and the NAO, who can see whether the platitudes of last year have been repeated yet again, or if progress has been demonstrated. PAC takes written evidence for outside expert input when the Official Truth stated in a report may not be entirely accurate or consistent with reality on the ground, and one Select Committee can borrow expertise from the members of another.

One of the strengths of the Lead Government Department model is that there’s always a government Department responsible, and it always has Parliamentary scrutiny. The times when a statutory inquiry would report and the recommendations would actually happen are long gone. Parliament has to catch up – it has all the necessary levers, and simply needs the will to act.

When an Inquiry or Review exists, the decision has already been made that this was a worthwhile use of public funds to investigate, uncover, and prevent from recurrence – so it’s entirely within the remit of PAC and NAO to check whether the recommendations to prevent a recurrence are being delivered. It always comes back to money. The status quo that lost the argument against an Inquiry plays a long game, and can prevent recommendations being implemented – nullifying the point of the review, and the political intent that created it.

The Hillsborough Law was paused because of entrenched interests; the first Spycops inquiry has been dragged out for a decade and now the Home Office is “consulting” on closing it before it finishes. (Though when inevitably reopened it will be under Hillsborough Law obligations, which might show discrepancies in past official statements.)

Reports and recommendations that go nowhere are useless when they’re just sitting on a shelf. When officials decide to put a recommendation on the ‘too hard’ shelf, they have to know that it’ll get lifted off again and re-examined. 

A look at Departmental annual reports

The Department for Transport annual report did mention the “two independent reports” it commissioned after the Stonehaven derailment – but it only mentioned them in one year, subsequently talking of recommendations being made (without discussion or description). The only mention after that is the financial penalty in the accounts from the health and safety prosecution.

Each Department for Education annual report studiously lists all of the PAC sessions they gave evidence at, and repeatedly mentions both the Independent Inquiry into Child Sexual Abuse and the Covid Inquiry – with no mention of recommendations from them, or follow-ups. Listing PAC appearances while saying nothing about outcomes shows that Departments record scrutiny events, not actual results.

Tasking the NAO to look at the implementation of recommendations cannot work unless there is material in the annual reports to read and scrutinise – whether by the NAO, PAC, or other committees.

One reason Inquiries are of current Parliamentary interest is the lack of follow-ups to the IICSA in practice, with Baroness Casey being “unimpressed” with changes across the public sector even when they are obviously the right thing to do; an inertia that means abuses of the records of three dead girls in Southport or a live boy has resulted in words not actions.

Health Investigations

In response to the Thirlwall Inquiry, DHSC said they’d have a dashboard for the implementation of the Inquiry recommendations they had accepted. This was claimed as a large improvement. Yet, in DHSC’s subsequent response to Module 3 of the Covid-19 Inquiry and again in Module 4, DHSC simply omitted to state whether they accepted each recommendation or not, sidestepping their previous commitment. A recommendation can’t be shown as failing or undelivered on a dashboard if the responsible body never said whether it had accepted it. Very civil service.

If you read the DHSC annual report, there are pages of descriptions of Inquiries, Reviews and Investigations, and basically nothing about the actual implementation of recommendations – except when it suits the Department to mention it. What is said should be scrutinised by the NAO when they go through the annual reports, and what is missing should be reported by the NAO and scrutinised by Parliament.

For example, the Inquiry into Ian Paterson (para 825) states that a response to the Inquiry was published, with a promise of a “year on” update to come. That “year on update” says “there are many actions and programmes that are still ongoing”, then it’s never mentioned again. DHSC hoped NAO wouldn’t notice the future omission and that no-one in Parliament would ask – and maybe they got away with it.

The Health Services Safety Investigations Body was set up by Parliament to make ‘no-blame’ recommendations about improvements to NHS care. Its recent report on the harms caused by NHS England’s method of rationing places on waiting lists (known as “advice and guidance”) is just brutal.

NHS leadership simply doesn’t want to know about failures, and the politicians have again helped the cover-up. This behaviour is long standing – NHSE was set up when DH didn’t care and didn’t want to know. And much of it still doesn’t. NHS England’s Chair has insisted HSSIB be abolished (alongside abolishing NHS England) because NHSE knows the new Department of Health in England would rather remain in the dark about avoidable harms. HSSIB is threatened precisely because it was created to speak honestly to power. 

Abolition comes after it emerged that DH/E tightly restricts other investigations by limiting how much they can say – refusing to allow them to make specific recommendations, and banning experts from answering questions about their reports. The usual practices of denial. 

The deaths and harms will continue. The only difference is HSSIB will no longer be around to learn from them. It is unclear who, besides the families of new victims, will pick up that baton.

Someone Has To Be Watching

There are always reasons that an accepted recommendation gets dropped – possibly even good reasons, such as the wider environment changing beyond what was called for in the report. But all too often it’s politics moving on as a controversy falls out of the public’s attention, and meaningful change gets kicked into the long grass. Exhibit A: Grenfell, because when the dust settles it always plays out that the poor had no lawyers.

At many of the Post Office Inquiry hearings, or the Spycops Inquiry hearings, the only people not being paid to be there were the victims. Victims who have had to cover costs out of their own pockets while still waiting for compensation; compensation long delayed by people who did not have to wait for their bills to be paid. This shapes priorities and incentives: every official in every room is paid to defend their Department’s decisions, even where those decisions undermine an Inquiry’s recommendations.

The political cycle generates churn, and the civil service moves staff around. It is civil society and academia who remain engaged long enough to measure the effects of any promised change and whether it happens. Victims should be able to get on with their lives – they should not have to keep coming back to their experience because the government has failed them yet again.

HSSIB’s Advice and Guidance report is only the latest in a long line of reports that show what is going wrong, with no power to stop it happening again. Coroners know that despair: promises made at one inquest are found to be undelivered at the next. With the abolition of HSSIB – abolished as punishment for speaking truth to the Department of Health in England – that will fall to someone else. [48 hours after we published this piece, it has been briefed that HSSIB may survive]

Those interested in particular topic areas – whether asthma, mental health, or even you and your local hospital – can use DeathLessons.org and the Preventable Deaths Tracker to see what Coroners notified on topics of interest, and shine a light on the procession of failures repeated and unaddressed. DH/E and NHS England or your local hospital will generally do nothing unless someone is asking why they haven’t.

What Parliament can do now

Since Grenfell and the Infected Blood Inquiries reported, Parliament has been considering what to do about following up on Inquiry Reports. 

The Public Administration Committee should expect that every Inquiry recommendation gets a page in the Lead Government Department’s annual report equivalent to the page that each accountability report item gets. It should say what the recommendation text was, what has happened, what is happening, and what is left to do – and that item should appear every year until the annual report confirms that the recommendation is complete.

As the Public Administration and Constitutional Affairs Committee are currently curating their Inquiry recommendations, in the second session of any Parliament, PACAC can (and should) ask the House Library to summarise the previous Parliament’s Inquiries, reports, and what disappeared. NAO/PAC scrutinise individual reports, with PACAC having the remit to take a broader public administration interest whenever appropriate, and select committees can engage on their particular topics in the normal way.

In the context of the current Health Bill, and the Hillsborough Law questions, and recent evidence of NHS England interfering in inquiries, one or more Parliamentary committees (probably PACAC and Health Select jointly) should write to every lead of health investigations asking them to submit anything they feel they were limited from considering or commenting on previously. Do Inquiry leads feel that the evidence they were given by public bodies would satisfy the Hillsborough Law, or do they feel that what the Inquiry was told was not, to reuse a phrase, “the truth”? Similarly, do coroners feel they’re being fobbed off in their work?

Prevention of Future Deaths reports can be read and are tracked to find major themes; minor themes remain hidden because Inquest findings generally aren’t published – although they easily could be where the coroner wished. Local health organisations can read the reports that relate to them locally, and condition-focused organisations can do the same when Parliamentary opportunities arise (a cheap use of an APPG’s limited time and resources).

Other political structures can do what Jennifer Pahlka calls an Outcomes Review to ask the question: did the intended change happen? Outcomes Reviews are a great idea, but require political power to start, carry out, and act on – and political power is the thing that change often lacks. Those selling new tech/AI will keep selling the tech, and HSSIB being fed into a woodchipper demonstrates what the tech people think of Outcomes Reviews. 

None of this process needs new Parliamentary actions or committees – it would simply be using the system the way it can work today. No government ever failed to have a justification for their actions or inactions. It is up to informed outsiders to assess those claims, and Parliament is where those get challenged.

The victims and their survivors deserve nothing less than lessons being learned. Currently, the victims are being repeatedly failed.

===

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.

A survey on the Single Palantir Record

When an NHS data programme starts flailing around, the Department of Health in England asks the National Data Guardian to bail them out.

DH/E’s institutional dysfunction means they expect an NDG Review will tell them that they’re all doing wonderfully; that the defensive and tone deaf staff are right and the rest of the world is wrong. NDG Reviews rarely turn out that way.

The NDG has put out a survey to health and care professionals, supposedly only them, and only about the Single Palantir Record. It closes on Friday 9th October

NHS England has started referring to many things around the Federated Data Platform as being part of the Single Palantir Record and so we’d encourage NHS staff to respond to the NDG survey as if it covered both the FDP and the SPR – because to NHS England, they are now the same thing. Same Senior Responsible Owner, same culture, same software.

The Single Palantir Record will be used to implement the National Online Hospital and redesign care pathways as the NHS zombies on with Wes Streeting’s vision and the Sunak administration’s changes to the scope of patient opt outs (ie allowing DH/E to use data however they wish).

It seems that neither NHS England nor NDG has published a framework for what the survey sits within, so following the precedent that anything not provided is assumed not to exist, we presume there are no Terms of Reference or any jointly agreed framing. As such, the NDG can comment wherever the survey replies and evidence take her. 

It would be perverse for the NDG to ask NHS staff for their views, and then to outright ignore them. It may be routine for NHSE to do that, but it is odd for the NDG to. It is equally odd that there appears to be nothing for patients – the FDP/SPR programmes assume they can do things to patients rather than with patients as the programme has chosen to reflect the culture of their tech supplier.

We therefore expect the Review must take a view on the minimum requirements for access to systems already shown as being abused in the ongoing series of scandals exposed by Sky News. NHS England is data controller for the nationally held records of access to systems, and the same staff who institutionally deny any contribution to facilitating such abuses are the same senior staff refusing to change on FDP/SPR. When NHS England claims that such abuses are from a “small minority”, the survey and writeup is a chance to show the scale (the survey doesn’t ask of course, but there are free text boxes). Are they a “small minority”? The survey effectively tells those who aren’t “professionals” working in the NHS that their views don’t matter, but they can have equivalent access to systems. 

NHS England continues to burn public credibility on the topics of Privacy, Transparency or Trust as their senior staff hide in Gray meeting rooms, insisting they are right to facilitate the coverup used by creeps, voyeurs and ghouls. After the abolition of NHSE in the Health Bill, there will need to be a leadership and structural reset. DH/E could solve the problem tomorrow by announcing that patients will see how data about them is used, but instead they simply refuse. NHS England wrote two letters, because the first was so woeful. We’d cite the Department of Health’s view, but they seem not to have commented at all. Silence. Curious that…

For its limitations, the survey is important, and if you’re reading this, you should consider filling it out before it closes on Friday 9th October – we have seen no indication that a survey for patients or victims of inappropriate accesses is coming.

Palantir Inc’s Tory-supporting advocacy team will surely be informing employee Tom Watson’s submission. Here’s ours.

==

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.

The Adolescent Health Study: reckless and designed for catastrophe, “a bit like UK Biobank”

The Adolescent Health Study will ask teenagers about their mental health, their families and their sexual experiences, and link the answers to their school, health and tax records. It will make them promises. The people building it have already broken promises of exactly this kind – to Scottish schoolchildren, to Biobank volunteers, and to 55 million NHS patients – and consequences have never reached the shared culture behind all three projects. The children being asked about adolescence in 2027 are the ones the ONS will ask to fill in a census in 2031 and surveys for the rest of the century.

“A bit like UK Biobank” has long been the description, and “like UK Biobank, will be accessible to all bona fide researchers”, a promise that turned into a trainwreck after the HDRUK/Sudlow review and UK Biobank lobbied to repeal promises already made to patients. The other precedent from the same people is the “Scottish School Sex Survey” which tried to get away with ignoring promises to school children, using intrusive emergency capabilities to address an endemic issue.

The same people. The person now leading AHS came to it from UK Biobank via HDRUK, where she co-authored the preprint on a project that trained an AI on 55 million patients’ records shared for Covid purposes only. HDRUK told the Information Commissioner it made no decisions about that access. Its own preprint says otherwise. The signs are that AHS decisions will be a gamble, with all bets placed by those with a track record of not caring about the outcome, of doing whatever they want with the data, irrespective of promises made to the individuals who contributed their data (either voluntarily or otherwise) and with a track record of telling regulators who make inquiries whatever is convenient at the time assuming no one will check (and that’s why this piece is so long). 

As stated in the Goldacre Review, “The NHS must maintain trust and active enthusiasm from patients and the public”, and that applies to other studies too. There will be a promise that “Five Safes” will safeguard data – they can not protect against data owners’ deliberate actions. (but that’ll be a topic for a followup post to avoid this being even longer!)

Breaking the trust of children, teenagers (and everyone else)

Continue reading →

Clinical Trials – Dexamethasone vs the fifteenth baldness pill

Doctors across the NHS rolled out dexamethasone within hours of clinical trials showing a significant measurable effect on Covid. The difference wasn’t the trial or the doctors – it was finding something materially better for a major pressing need. Most trials don’t.

The problem is not a lack of trials. The problem is all the incentives that influence which trials get done, and who gets to decide. Those incentives are not always aligned with the NHS, and not entirely aligned with patients.

Continue reading →

The previous Government’s consultation on more data brokers – envisaging a future that is already past

The new Government has inherited an open consultation on allowing data brokers to be ever more creepy, to buy and sell more data with less regulation. It’s coated in the language of helping individuals, but the focus is giving data brokers more permission to sell data about you, and giving you less say in the process. 

The consultation assumes data must be copied to be useful, but on-device AI makes copying unnecessary, so DSIT was envisaging a world that’s already ending.

The consultation isn’t about consent – all the positive use cases discussed are things that are already legal today; it’s about allowing data flows in all aspects of your life that you wouldn’t say yes to if they had to ask you. DSIT internalised that when the law says you should be able to see data about you, they know Government, the NHS, and the private sector just ignore that because it’s convenient to keep data subjects as literal subjects of decisions made by others. 

Open Banking works because it’s a well-defined interface between many different systems, where there is strong regulation and directly measurable gain and loss (it’s money). The first movers are always those who’ll most benefit with least friction. Open Banking was used by landlords to creep on their tenants, because positive new business models take years. If there was a positive example of where the model would work, it would headline the consultation. Instead it’s akin to “smart data” which generally degrades to copying data behind your back for someone else’s financial gain (if you materially disagree, please copy your (positive!) bank balance to our account).

Data policy in DSIT was broken by tech advances

The consultation was conceived a long time ago, before AI got good in the hands of everyone. The former parts of DSIT are being chopped up and spread around. The consultation has outlived the department that envisaged it. There has been much wailing about the change, as it could go either way. In medConfidential’s dealings with DSIT, officials seemed to assume they were the smartest guys in government, so why shouldn’t they do whatever they choose? Because they thought they could, often they thought they simply would – capability was confused with licence. 

The consultation is poor, even before we consider that the tools to empower individuals are moving faster than the consultation could imagine. Copying data is often no longer a necessity and should increasingly become a last resort, but DSIT’s consultation (and the NHS app redesign philosophy) assumes that the tech of 2017 is the same as tech of 2027. That’ll interact badly with real life.

What if we look at the goal another way? Much of the data held is accessible somewhere by the person it is about. It may be deliberately difficult to read, but the AIs don’t get bored and can do the drudgery. 

You can already make some choices to use data. Your device tomorrow will give you more choices than today. 

The future is here, but not yet distributed

The “remarkable new feature” in iOS27 is a Siri that can do things. In a few weeks, any mac user can say “Siri, download the data from the table on this webpage, and add it to mydata.csv on my Desktop” followed by “create and run a shortcut to do that every day”, and it works (more complex cases are “write an applescript to…”). Equivalent instructions work for an iPhone/iPad. One can also task Siri to compare it with the details in your calendar or tone of your emails, to see if it can see a pattern. All on device, no data copied anywhere unless you decide it should be (mostly; different problem).

Those with UK “settled status” – where the right to live and work in the UK is entirely dependent upon the Home Office computers being correct today – get no paperwork. It relies on the website working and people are punished more if you don’t notice the State’s systems have failed. Those who are most concerned could ask Siri to log in twice a week to check their magic code still appears, and warn them if not. That’s currently a website, but if it moves to “app only” with the Digital ID scheme, you’d need to run it on your phone which will supposedly make access harder, but Siri doesn’t care about the hoops – if they’re passable by humans they’re passable by Siri too. (Note to Government Digital Service and NHS App teams: this is not a challenge. We’ll have a more technical piece on the architectural choices/mistakes being made because they give Department of Health in England teams a quieter life at the expense of patients and users). 

No data intermediaries are needed – if it’s useful enough that people can do it for themselves, if it’s used, then there will be innovation around it. DSIT has seen that it could mandate in one place and has decided it should be able to mandate data be sold in other places. If the cart really can go before the horse, where’s the obvious example?

The AI running for you on your devices can pull together all the documents in your NHS app, the test results, and then analyse them for you on your device. You can spend as long as you like asking what those actual figures might mean – the ability to talk to a non-judging machine to interrogate the data is a new option, it doesn’t replace anything (it can’t prescribe for a start). 

As a patient you’ll gain the ability to generate better informed questions when you do see your doctor. You can have confidence that a process working exclusively for you has looked at your paperwork answering the questions you might want to ask, like “is there a test that was recommended that wasn’t done?”, or “is there a test result that was out of normal that was never followed up on?”, or make unseen connections like “my breath/heart rate monitor tells me I feel terrible after being in the office for two consecutive days” or “I sleep terribly when I email this client late at night” or “on days that pollen is very high I feel terrible at home and fine in venues that have filtered air”. None of those will be possible with Palantir’s FDP. The Palantir-managed “Canonical Data Model” could provide data to inform individual on-device processing if patients are allowed a copy of their data. 

Whether the DH/E will empower patients in the NHS App is unclear – the legacy institutions and silos will see removing friction as enabling complete visibility into the mistakes that are made and their cover ups. Unempowered and underinformed patients are less effort to manage, and anything that gives them benefits will be buried in the NHS England treacle (which is one reason NHS England is being abolished). However, improvements will come from the persistence of people who know it will change their care and lives. There are patient centred opportunities that don’t involve copying all data into NHS/Palantir AI Platform where any data written to your Single Palantir Record will be retained and sold. DH/E has many meetings with people who want to buy data, it doesn’t have meetings with those who don’t, so decisions are always about more data and more data sales – meaning they confuse unique magic for commodity analysis.

What DH/E may offer (or refuse to offer) will matter less when Siri can parse what you see on your device, and knows the other details about your environment (it knows the weather in your house, it knows your calendar, it knows where you were and what you did yesterday and the days before, it can measure your voice if you talk to it). Individually empowering approaches were entirely ignored by DSIT in favour of access where there’ll be business traction. DCMS can change direction.

Who will be writing the prompts?

AI and other communities are legitimately concerned that the first use of cheap AI will be creeping on people for profit. After all, the first use of expensive AI was creeping on women for orgasms (and the first use of Facebook was…)

Device by device, there’s no way to creep at scale, only work one app at a time with people who get some benefit from their device working for them.

Who is writing the prompts to show what is possible, and what works today? Whose interest will those prompts be written in? Who will share what knowledge of what works? Who’s going to do things for citizens and patients, not for data brokers – it sure wasn’t DSIT.


Our consultation response is below, but this is a consultation on a project that should die with the closure of DSIT. DCMS can make different choices.

— 

Enclosures: consultation response on data brokers, and on data and AI

==

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.

The start of medConfidential’s Week Two briefing to Ministers

New ministers will have had their Week One briefings, learning what the NHS and officials wants them to know and think. 

The culture of NHS England, an organisation soon to be abolished, is that whatever is done is always the best it could be, and that whether the outcome is any good should never be questioned. Cover-ups are better than bad headlines, a culture which drives many decisions about data centralisation. Data decisions are made in a Gray meeting room where past precedent protects voyeurs, creeps, and ghouls, prevents improvement and ignores patient wishes. Whether the FDP has a repository is something that mostly in public is undecided, but the suggestions made to ministers may suggest otherwise. What did the briefings say?

The NHSE culture leads to suppression of debate; it leads to cover-ups (uncovered); it leads to greater patient harm, with complicit staff hoping the patient harm won’t be discovered until their successors are in post. Institutional loyalty is to a fiction of Service, rather than to honesty about it. The culture refuses to learn unless made to.

Similarly, contempt of democracy and Parliament is not unusual in tech companies, but after Palantir’s involvement in the NHS, Palantir culture is spreading inside the Department of Health in England (DH/E) – public relations, not reliable statistics.

If you want to see what’s going to happen next, reading the Health Bill is not going to tell you very much – the Bill gives the Secretary of State a lot of power to do whatever they want, but there are no written proposals, no detailed speeches, no discussion of what that’ll be. It is Wes Streeting’s Health Bill, now in the hands of Andy Burnham’s government (which is a definite improvement).

The new Health Secretary, Yvette Cooper, has been around long enough to realise that reducing spending on a major NHS supplier, which is willing to hold cancer patients hostage and whose PR agency also represents the Opposition, is going to be a tricky needle to thread. Government has pathways forward, if there is a political choice to explore them.

Under the previous political leadership, only the most optimistic lines got briefed out by DH/E, on their own timescales, with the best possible framing.

“NHS App AI” “to help avoid the 8am rush” is the headline – unless the AI thinks you didn’t need an appointment,  in which case you’ll go towards the back of the queue, but maybe still ahead of people who didn’t use the App. (We’ll write on the App soon.) The thinking of DH/E staff is that pesky general practice will go the same way as your local bank branch. When NHSE says “neighbourhood health centre”, what they mean is “neighbourhood” like that served by your ‘nearest’ large post office, jobcentre, or bank.

“GPs have too much space” is the DH/E framing. Post-merger DH/E expecting well over half of GP surgeries to close in 2027/28 is the same story, with the same outcome. The ICB will cite the App as accounting for the majority of appointments and simply not give the GPs the budget that pays their rent. When other decision makers propose closing the last bank branch, the last pub, or the last post office in a village (or town), MPs write strongly worded letters in the face of public campaigns. Because NHSE won’t be around by then, NHSE’s planning assumes that MPs will be ignored, an assumption proven true in business, but in public service?

The NHS AI Platform, on which DH/E will run the AIs over the Single Patient Record, is the Palantir AI Platform with a new name. The Platform will be processing all your health notes, all your diagnoses, all your prescriptions. You will have to write your (mental) health needs down in a text box that the AI will analyse and the SPR will store, and an AI will compare every future time you ask for an appointment. The algorithmic transparency report will be ‘interesting’ – and show all the flaws that were simply never considered.

What was Wes’s choice will become Burnham’s burden.

Andy’s government has choices that new ministerial briefings might have omitted.

====

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.

carry on Creeping, by NHS England

Ministers promised you’d control your data. The Health Bill and NHS England say otherwise

NHS England is in denial. Story after story after story of NHS staff creeping on patients and victims, the Chief Exec of NHS England has decided the problem is only in hospitals and national systems have no ability or responsibility on access.

It is as if Sir Jim Mackey and his staff, the Secretary of State and the DHSC policy leadership, have looked at the series of abuses, and said the problem is not the coverup but the response to the failed coverup – make the response better but cover up the abuses better too. But there’s a slide so NHSE can claim they did something:

It was only because evidence of the creeping got into the hands of the patient victims that the accesses were shown to be illegitimate. And illegal. And NHS England have decided that patients should remain in the dark when NHS England runs the systems facilitating abuse – NHS England claim their Federated Data Platform can show a patient who has gone creeping, and they refuse to show patients. Maybe that culture of coverup that’s why NHS England is being abolished, but it’s not like abolition is going to help.

Ministers are responsible for the coverup

Hansard records that Ministers have reassured patients and the public about unethical and illegal access to their medical records, saying: [ emphasis added ]

“A receptionist might meet someone at a party, then go back to the practice and try to gain access to the person’s records. I am informed, and I believe, that access rights will not enable those who are not involved in the provision of care to see records. Unauthorised access will be marked on the system, and therefore subject to audit. That is one of the opportunities granted to us by an electronic system.

We have provided the most stringent safeguards for security and confidentiality. We hope that anyone who is concerned about information will be reassured by them. The new system will allow patients to determine whether information recorded in one organisation can be seen elsewhere in the NHS: it will be their choice. Even when patients permit such access, only those involved in their care will have access to their records or to information that identifies them, and they will see only the parts of the record that are needed to inform care. That answers some of the hon. Gentleman’s points about the whole health record, and about the possibility that some people might have access to information that was not appropriate. The system is designed to tackle that. Everyone who may have access will be authorised appropriately, and will need a smart card as well as a password. Crucially, the system will register the identity of everyone who looks at the records. That is important as a safeguard and as an audit trail.”

Those statements aren’t about the new Single Palantir Record, however – they are about the Summary Care Record in 2005. (To be clear: the SCR does what the new SPR will do, and the SCR is partially the framework on which SPR will start.)

The NHS never delivered on what Ministers said 20 years ago, and without meaningful protections on the face of this new Health Bill, that pattern is going to repeat again now.

Last week, Ministers promised even less than in 2005, saying: [ emphasis added ]

“…applying advanced cloud-based audit and oversight capabilities, enabling near real-time monitoring of system access and detection of unusual or inappropriate patterns. That will allow NHS security teams to track and detect access patterns, and to quickly intervene if specific records are accessed by staff who have no clinical relationship with the patient in question.”

An audit trail registering the identity of everyone who looks at patients’ records, which supposedly “marked” unauthorised access, failed to prevent 20 years of creeping. And now we are told there’ll be “cloud-based” tracking of “patterns”. In the face of widespread illegal access – only a proportion of which ever come to light – Ministers still refuse to promise that patients, i.e the only people who will know for sure that an access is inappropriate, will see the audit trail of when and where their records were accessed.

“NHS security teams” aren’t a real thing for most patients. It’s like saying the bouncer at A&E on a Saturday night will protect your records from being accessed any time, anywhere else. In reality, the NHS has no way to know whether you walked into the pharmacy that accessed your Single Palantir Record – containing all of your diagnoses, notes and prescriptions, and the “summary” of all of the most sensitive details of your life, in order to “avoid having to tell your story” to different clinicians (or so the spin goes).

As a relentless series of revelations keep showing, the NHS is entirely blind to these abuses. And it will continue to do nothing about them as the Single Palantir Record, “essentially a repository for the story of people’s lives”, widens access to your records even further.

Ministers argue their actions have no possible negative consequences. After 20 years of evidence to the contrary, they are either being utterly disingenuous or wilfully ignorant. And their argument is even less credible because of the way the Health Bill changes who controls what data in hospitals. 

Today, if a hospital notices that its records have been accessed in a questionable way, the hospital considers itself the victim, because it is the responsible actor under data protection and employment law. But the hospital investigates itself – hence coverups – because it is the data controller. 

Under the Single Patient Record, the hospital will no longer be the data controller and will only have responsibility for its staff. And Ministers won’t want to know about the abuses for which they will be responsible, which this Bill does nothing to prevent.

If GPs are to be data controllers for the information in the Single Patient Record, then your GP will be the one who is responsible for auditing access to your record. But GPs aren’t being provided with any mechanism to do this, so GPs and patients will be forced to rely on those most incentivised to cover it all up – the employer of the perpetrators. (Things will get even worse when GPs’ control of their patients’ data is eliminated, when the Secretary of State eventually announces that GP data will be copied into the Single Palantir Record, and not accessed at source as needed.)

Government has seen the abuses of Southport, Nottingham, Cambridge (multiple times), and more, and has decided that the status quo “safeguards” are making bad headlines, so must be reduced. They won’t even share a draft of the Regulations, which suggests they are toothless.


To use the analogy discussed in Committee, should a doctor in Dover look up the records of Andy from Manchester, it would entirely depend upon which Andy as to whether that access ever got checked. (Maybe that Andy did have a pressing need for GP, Ambulance or Pharmacy First while on a walkabout – the NHS simply doesn’t know and NHS England didn’t bother to communicate with any of them on what it sent to hospital CEOs – guidance which allows the hospital to continue to cover up abuses) 

Any Andy can walk into any pharmacy or front line service anywhere in the country, and the NHS can have no idea whether they actually did, or whether someone just went creeping. The only person who can know for sure whether any particular access needs investigation is the patient.   Indeed, if a patient has concerns, NHS England guidance is that they should  ask every Pharmacy in the country whether their record has been accessed and whether the Pharmacy thinks that was appropriate – the patient gets no information whatsoever. 

Access to patients’ records is being widened, and the demonstrably inadequate protections are unchanged – in effect they’ll be narrowed, given they’ll be known in advance. There’ll be no meaningful protections in the Single Patient Record unless you’re a high profile individual capable of getting the attention of what the Minister pretends are “NHS security teams”. 

The Princess of Wales has armed guards. You shouldn’t need them to know your medical notes are secure.

Ministerial intent

When Mr Streeting spoke in the House of Commons debate, he said:

“Our health, our data, our NHS—patients should control who can access their data, and they should control their own data.”

Even if Mr Streeting’s intent was honest – and it probably was – it is not delivered by the text of the Bill.

Those undertakings were absent in Committee, and they are not what the surviving Ministers have said will happen. Indeed, after Mr Streeting resigned, Ministers have walked back that commitment – if DH officials ever really considered it. According to the text of the current Bill, patients will not control who can access their own data, and they will not control their own data.

If promises about privacy, access and patient control aren’t on the face of the Bill, they will be watered down in future.

While the Minister said “Members from across the House have asked how those safeguards will be built into how the system is designed and operated, which is what we are doing”, what they are doing will still allow creeps and ghouls to stalk terrorism victims or their neighbours – and patients will have no way to know anything about it. 

The fact that a patient is in a hospital does not mean that anyone in the hospital should be able to just take a look, but in practice they can.

When Ministers say data access will be “only for the right reason”, they are stating an intent not a constraint. The patient won’t get to determine the reason, and there’ll be no meaningful constraint unless patients are given access to evidence that means any complaint they make is taken seriously. Without a patient-visible audit trail of access to their records via the NHS app, then that threshold won’t be met unless you’re a high profile victim (and those who creep on you regularly do so again).

Because the draft Regulations have not been published, it’s impossible to know when Ministers say “that is what we are doing” that what they say matches what the former Secretary of State said – or whether what they’re doing will continue to enable creeps, as has been happening for the past two decades.

Patients are being required to trust that the Singe Palantir Record will work in their interest – a terrible place for a new Government to start from. The new Government must give patients a way to see that promises made are what is being delivered.

To be trustworthy, an audit trail must cover everything

Ministers parrot US company Palantir Inc’s assertions that Palantir has audit capabilities that others don’t – but if those capabilities are unavailable to patients, they may as well not exist.

Contrary to what Palantir may believe, “audit” means revealing everything that happened with your health records, not just the things that the NHS would like you to know about.

The Single Patient Record is caught up in political spin, and the Single Palantir Record is something entirely different than what’s being promised – benefitting the creeps, ghouls and Palantir, and creating an even more murky situation for patients, who will be forced by this Bill to accept whatever Ministers and Palantir choose to give them.

==

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.

The Coming NHS They Didn’t Campaign On

A new Prime Minister is coming.

He will have views on what he wants to do. Good intentions always meet unforeseeable events, and some events entirely foreseen from the decisions made by his predecessor’s health secretary.

A new Secretary of State will come in, and ask about the problems everyone has, as all his predecessors have done. 

  • “What do we do about waiting lists?”
  • “What do we do about GP appointments?”
  • “What can we do about A&E?”

Labour are about to have their “grayling reforms” moment.

Waiting lists 

The Department of Health’s logic on waiting lists is simple – about 1.7m people flow onto a waiting list every month, and about 1.7m people flow off, and the stock is 7m backlog. If no new people joined a waiting list, you’d be done in about 4 months. The “single point of access” was designed to get the 1.7m down by about half – which is impossible if it’s doctors, but it’s not going to be doctors. It’s not going to be humans.

In a Single Patient Record world, it’ll be a central AI, which will decide whether the referral goes through, or whether the “NHS Online Hospital” (NHSE expects this to be even more Palantir AI) will monitor you in the community. That doesn’t count as being on a waiting list.

Waiting lists will come down because the AI will only let through the people most in need of care at the capacity that they can flow through. When the Department of Health in England says half the people on a waiting list don’t need to be there, they mean that they can stop them joining. Without any change in productivity, that will mean the waiting list drops to zero in eight months (in theory – 1.7m people flow off per month, but only 0.85m join, and 8 months later the backlog is magically gone, in theory; not all treatments, etc).

That’s the theory from the tech people that Wes Streeting bought wholesale.

GP appointments

The current 8am rush and botched imposition of mandatory online triage has made no one happy. GPs are constrained by what DH/E will let them do, and suppliers are being bullied by NHS England to not improve what GPs can do. It is almost as if it is actively designed to make everyone miserable, including patients.

As the Single Patient Record rolls out (this financial year), you’ll get a new button in the NHS App, which is to ask the NHS AI whether you can have an appointment (running on the NHS AI platform, which forms part of the Federated Data Platform, provided by Palantir). Now, many things don’t need a GP, but it will be up to the patient to explain to the chatbot what’s up with them, and the AI will decide whether you get to see a GP, or maybe you get to see someone less trained. If you don’t use the NHS app, you’ll be at the back of the queue when the NHS national AIs prioritise appointments.

NHS England will say if you “need” to see a GP, then you can. But it is the NHS England AIs deciding if you “need” to. If the AIs that read your Single Patient Record says no, then those AIs running in Palantir will handle like Palantir’s bouncer handles these NHS records.

The roll-out of Single Patient Record will be imposed by the amalgamation of the existing Summary Care Records, existing GP Connect, (all run by NHS England) and the Shared Care Records schemes (over time, currently run by ICBs). Your local GP won’t get a say – in a Single Patient Record NHS, all GP data will be extracted into the Single Patient Record, and since DH/E controls the NHS App, a GP will never see the patients who are routed elsewhere without their knowledge. It’s not that a GP won’t catch something, it’s they’ll never be given the opportunity to.

The notion of “your GP” will become as irrelevant to you as the notion of “your bank branch’s manager” is – you’ll be expected to use the app for everything, and your branch/GP gets closed.

Banning people from walking into A&E

It used to be that you could walk into A&E while bleeding and get care.

The Conservative Governments of 2010-2024 kept trying to dissuade people from doing that, under the banner “111 first”.

Yes, that image on the right is a bunch of phone booths outside of A&E which you should stand and bleed in, rather than walking in the door.  

One of Wes Streeting’s legacies is that you’ll now be faced with an iPad that’ll potentially not let you register at A&E. If you walk in you’ll be given the same triage as 111 would do over the phone.

You can hang up on 111; the iPad just won’t let you open the door to A&E. 

Every new minister is told the next step down this pathway will help, an incremental step of good political intentions that will ever diminish the service to the public. Both will get endlessly cut as AI and algorithms that are designed to benefit the Department of Health in England, not your care.

The Reform/Restore line will be simple: “we’ll revert ‘Burnham’s ban’ and let you phone your doctor or walk into A&E” (actual progress is harder). While current Ministers chicken out of patient accountability on who has accessed records, political leadership can decide to show patients who has gone creeping. They may even promise to reopen your closed GP…

NHS England is looking at closing over half GP practices – if you halve the floor space, you have to close more than half of practices and move the staff to “Neighbourhood Health Centres”. Wes Streeting has set in train a Labour legacy of your GP practice being sold for flats (in the South – they’ll just be another set of neglected buildings where that’s not profitable)

Follow the money

All the outgoing government’s plans are heavily dependent upon the tech working and getting data.

Where is the funding in the 2027/28 ICB budgets for the Shared Care Records schemes? Go look, we’ll wait, you’ll be a while.

Across the NHS, political priorities come first, and the safety, usability, and safeguards that make a service usable and safe for everyone are only promised for later, and often never get delivered. Summary Care Records were supposed to be safe, with audit trails, in 2005, but DH never delivered. Single Patient Records will be no different – as DH/E will side with the creeps and ghouls given any opportunity – accountability and transparency always get pushed every further back behind other priorities. That’s how politically led organisations work.

When DH/E talks about the Single Patient Record having a summary of your medical history so you don’t need to tell your story again and again, that’ll be an AI summary that maybe you’ll be allowed to edit. DH/E will pick the cheapest AI for the job, which can mean grok and the Palantir AI Platform.


The Politics

Wes Streeting’s NHS never clearly articulated what the experience would be – it was just a promise of tomorrow with no description of how to get there or recognition of the trade-offs that are inherent in those decisions (reflective of Mr Streeting and the Government he served in) – akin to Mr Grayling’s reforms of probation services.

They’re the “winter fuel allowance” of the NHS. The administrators think they have an easy thing to do, but there’s a reason it’s never been done.

Mr Streeting’s belief was that if you fix waiting lists and GP practices, it’ll all be wonderful. As with the rest of the culture of the Blair Government in Exile, the assumption was it didn’t matter how things were done. Mandelson’s approach that human rights are an inconvenience, patient choice is an inconvenience.

Government can tell patients that the only way patients get to see a GP is via the app or showing up in person and begging. They can do this because DH/E controls the phone lines, it controls the app, it controls 111 (and then the slimmed down ICBs will be unable to justify keeping so many GP practices open, and they will be forced to close to move to the “neighbourhood health centre” which will be about as local as your nearest job centre – so if you go to knock on the door, you’ll be met with a permanently closed sign).

Mr Streeting assumed that the public will accept what they’re given. His culture has continued after he resigned (speaking of unchanged cultures, this new drivel is supposed to be the Government’s response to the Biobank debacle, guidance which changes nothing)

GPs are apparently data controllers for material in the Single Patient Record, but will not have access to who has looked at the record. Ministers will cover up the records because that’s what always happens. 

Dr Dash’s Ratner followup

Why didn’t Mr Streeting’s NHS talk about what they were planning? Because when their leadership opened their mouths, they filled them with their own metaphorical foot.

Enthralled by her undisclosed investments AI, the Chair of NHS England had a Ratner moment about doctors. Consequences have been covered elsewhere, some questions:

  • Where will these AIs run?
    • Will the “summary” proposed by Ministers be written by Grok?
    • How will patients know?
  • Who authorised the reuse of “direct care only” records in One London to be copied and sold for secondary uses?  (the ICO will figure out who the data controller is, and so who is responsible for the breach) Because data was taken for care, no opt outs applied to the GP data that is being sold by One London (on everyone in Greater London).
  • While Chair, why did her linkedin appear (click the first name here) on the website of a notorious company which “breaks national [data] guidance”? How did the company Dr Dash advised get their data given those FOIs? 

Under the powers in the new Health Bill to create prizes, will companies who have “unclear” data provenance be able to win prizes out of the NHS budget after their cheating? 

Will Ministers give NHS contracts to companies that stole NHS data and commercialised it?  

According to those same Ministers, the Health Bill means you will have no idea who has accessed your health records even as they are made much more widely available across the NHS (Palantir Inc’s VP for the UK claims “audit” covers only the topics he wants to talk about in the way he wants to talk about them – which isn’t audit it’s just PR)

Why the secrecy and dishonesty?

If Streeting were the politician he believed himself to be, why the secrecy?

If he believed this would work, why not say this is the pathway? We’ll close GPs, ban you from walking into hospitals, AI everything, but care will be better, and you’ll elect me as PM!

Why wasn’t any of this mentioned in advance of the Health Bill with its vague wording and unlimited powers to a Secretary of State who resigned minutes after the Bill was laid – clearly Mr Streeting knew he wouldn’t be around to implement any of this.

Why did the SRO not talk about it in Parliament?

There’s no argument that Government is taking the powers to do what it is claiming. The only question is how to convince patients that once it’s implemented it’s better. Or perhaps they simply hope the “prevention of future deaths” reports will only roll in after the election…

Why did the Minister claim no implementation decisions had been made, only days before it was announced that NHS AIs using the Single Palantir Record will sit between you and your GP, and those AIs will decide whether you should have an appointment. Only if the AI decides you need one will it let you through. If no decision has been made that FDP will remain with Palantir, can they show any contingency planning for this change? Or is the leadership ignoring the topic  until they claim it’s too late to do anything?

Deception and lack of integrity undermines confidence – the way to fix that is absolutely transparency and accountability. Maybe the above will work – Wes Streeting bet the entire NHS on him being right, and he ran away to make sure he wouldn’t be held responsible for the failure. When your GP surgery building has been turned into flats, it can’t be turned back again.

=== 

Find out what happens next: Sign up for our newsletter (we don’t email often) or get small frequent updates via Substack — free to follow, and we are grateful to all those who can donate to help more of this work.