WIREDGOV

The NHS Modernisation Bill (known formally as the Health Bill), which was introduced to parliament in May 2026, includes measures to enable the establishment of a single patient record (SPR) to support direct patient care, with the overall aims of enabling better joined-up and proactive care, improving patient safety and experience, and empowering patients. 

Although most health and social care records in England are now electronic, records from one part of the health and care system are often not available to clinicians working in another part. Several countries including Singapore, Estonia and Denmarkalready have unified electronic health records, similar to the proposed SPR. 

During the second reading debate on the Bill in the House of Commons, many MPs referred to the SPR, from acknowledging its potential role in ending the fragmentation of patient information and care to raising questions around data security, privacy and controllership. Questions were also asked about the NHS Federated Data Platform (FDP) and the company providing the software for the platform, Palantir, although neither are aspects of the Bill. 

These are important issues to get right. In The King’s Fund’s view, with the appropriate data governance, security and safeguards, as well as an effective implementation programme, the SPR has the potential to be transformative for patient care and experience. It could enable safer decision-making as clinicians would have access to more complete patient information. For example, for people living with frailty who may interact with services across primary, secondary, community and social care settings, the SPR would mean clinicians from across these services having access to the same up-to-date records of patients’ conditions, medications, care plans and other interactions with services. This could enable more consistent and co-ordinated care, earlier intervention when patients need extra support and reduce emergency admissions to hospital. 

Public engagement exercises indicate that there is broad support for the SPR, particularly for the benefits around joined-up care. They also show the public has strong expectations around privacy, security, transparency and accountability for inappropriate access. These requirements will need to be addressed through a combination of routes, including the Bill, secondary legislation and choices of technology. Ensuring these aspects are fully addressed will be essential for the public and parliament to have confidence in the SPR. 

To support better understanding of these issues, this explainer outlines what is currently known about the SPR as set out in the Bill and provides clarity on the distinction between the SPR and the FDP.

What is the single patient record (SPR)? 

The government’s vision for the SPR is to provide a single view of a person's health and care history to support the provision of care and to make it possible for people to access their own complete health and care records. This will be enabled through data flows from existing records being combined and displayed to the user. For the patient this will be within the NHS App. The SPR is described in the 10 Year Health Plan as giving people a ‘single, secure and authoritative account of their data’. 

There are a number of different options for how the SPR could be created. One possibility is making a single pool of patient information, stored in one place. Another option is an interface that displays information from multiple sources, without changing where the data is stored. These options pose different considerations such as speed of access to the data, cyber-security, data controllership and public trust in how the data is used. The choices around how to implement the SPR are therefore critical and – for now – largely unspecified in the Health Bill itself.

How will the SPR be accessed? 

Clinicians will continue to access patient records through their existing clinical systems. NHS England has stated that staff access to the SPR will be role-based (so staff will only be able to see patient information relevant and necessary to their role) and auditable. Patients (and people acting on their behalf such as parents and carers) will be able to access their own record (and the record of those they care for) via the NHS App. The Department of Health and Social Care has said that clinicians will have improved access to linked patient data by 2027 through the connection of existing shared care records, and has set an ambition that all patients will have access to a core set of their data via the NHS App from 2028, with access to their complete data by 2030.

How could the SPR change patient experience?

The SPR could change patient experience in several ways. Joining up people’s records across services through the SPR could enhance people’s overall experience of NHS care, particularly in terms of timeliness, co-ordination and organisation. In addition, providing clinicians with faster and more complete access to critical patient information could support safer decision-making and reduce the need for patients to repeatedly share their medical history. It would also make receiving care in different areas around the country more seamless – currently details of care provided in a hospital in one area are not visible to clinicians in a hospital in a different area.

Currently most, but not all, patients have some access to their GP record, hospital appointments and letters, and test results via the NHS App. However, this access can be fragmented and incomplete: for example, people may not automatically be able to view the results of tests carried out before 2023, or they may be directed to a different platform to view some hospital records. The SPR would enable people to access a comprehensive view of their health and social care information through the NHS App. Having full access to health records and information can help people better understand and act on their health and navigate services more easily.

There are currently a number of legal and governance frameworks in place around the use of NHS patient data for secondary purposes such as research, service planning and commissioning, to improve health and care provision. These will not be changed via the Bill, although data from within the SPR will be available for these uses beyond direct patient care.

What does the Health Bill say about the SPR? 

The Health Bill creates the legislative conditions that will allow the government to meet its ambitions for the SPR. It gives the Secretary of State for Health and Social Care powers to introduce regulations to create and operate an SPR, but it is relatively high-level and leaves much of the detail to be determined through subsequent regulations, technology choices and implementation decisions. 

The Bill enables the secretary of state to introduce regulations to establish the SPR, and to require health and care providers, technology suppliers and others to share patient data so that it can be made available both to the patient (or an authorised representative such as a parent or carer) and to professionals involved in their direct care (including private care). 

An individual’s SPR will be created when they access health or social care in England. The Bill also makes it possible in the future for patient information from health and care providers elsewhere in the British Islands (a legal term meaning the UK, Channel Islands and the Isle of Man) to be included in an individual’s SPR, and for those providers to be able to access an individual’s SPR when the individual is being treated in the British Islands. To facilitate this, the Bill enables regulations to lift the common law duty of confidentiality for the specific processing of data to operate the SPR for direct patient care. Currently, shared care records can enable clinicians to access health and care records across local services, but functionality varies across the country, and records do not connect nationally (or allow for straightforward sharing between UK nations, Channel Islands or the Isle of Man) or allow patients direct access to their own records. 

The Bill includes a requirement that the secretary of state must consider safeguards to prevent the ‘improper use’ of data shared under the provisions of the Bill. This is not specified further, but the government intends for this to include consideration of equivalent data security and roles-based access when sharing patient data with clinicians based outside of England but within the British Islands. 

To support compliance with the establishment and operation of the SPR, the Bill enables the introduction of financial penalties through further regulations. The Bill does not set out the circumstances in which fines may be imposed, how much the fines may be or on which individuals or organisations they may be imposed. The Bill requires the secretary of state to consult with people they consider appropriate before laying regulations, but the government has not provided any further information or specification of who should be consulted or how. These are areas which MPs and the Lords may wish to scrutinise to gain further clarification on how these measures could be implemented in practice.

The SPR is intended primarily to support direct care, and the Bill does not create any new legal routes for using SPR data for secondary purposes such as research, service planning or commissioning. However, the Bill does include a provision that allows the SPR to be used as a source of data for these secondary purposes where a separate, existing legal basis already allows this. The Bill does not alter existing data controllership arrangements, so GPs, hospitals, social care providers and other health and care providers would remain the data controllers for the patient data they hold in their own systems. The Bill does not include any changes to existing UK data protection laws or make any new provisions for patients to opt out of their data processing.

The Bill does not set out which, if any, company will provide the software for the SPR and does not make any link between the SPR and the FDP, however contractual matters such as the provider would not usually be expected to be set out within primary legislation.

More broadly, the Bill is one tool among many that will be required to build a functioning SPR. Delivery of the SPR will depend on how the regulations enabled by the Bill are developed and, critically, on effective implementation, including whether data sharing is successfully realised in practice, given the mixed track record of previous NHS digital transformation initiatives.

What is the NHS Federated Data Platform (FDP)? 

The FDP is a digital platform designed to bring together data from existing NHS systems to support NHS staff in decision-making about patient care, operational management and service planning. The FDP operates across national, integrated care board (ICB) and trust levels. It is not a patient record, but data used within the FDP includes patient data. Each organisation retains data controllership for its data within the platform. The FDP is used by approved clinical and non-clinical staff for authorised purposes, with access determined by staff role. The platform is specified and procured by the NHS, and a technology supplier (currently Palantir) provides the platform but does not control the data, which remains subject to NHS governance and data protection requirements. 

There are range of software tools, known as ‘products’, available within the FDP tailored to different purposes, such as improving care co-ordination across NHS services for patients; management of operating theatre capacity to support elective care capacity; management of vaccine stocks and monitoring of vaccination uptake; and planning services to meet the needs of local people to support population health management. The specific data used varies according to the purpose of each application, with only the minimum data necessary being processed. While use of the FDP is not yet mandatory, the Medium Term Planning Framework sets an expectation that all providers and ICBs will adopt its core capabilities over time.

The SPR represents a significant opportunity to improve people's experience of health and care through the joining up of fragmented patient information and providing patients full access to their own records. The Bill leaves much open to secondary legislation, however. This lack of clarity raises questions and concerns from both the public and those working in the health and care sector about data governance, security and privacy. Appropriate safeguards will be essential to ensuring public trust in how data are being used. Questions also remain around the implementation of the SPR, with different models for data flows still on the table. Legislation is just one early step in establishing the SPR; implementation must be managed well for its success. With the right safeguards and protections, and with effective implementation, however, the SPR could be transformative for patient care and experience.