HEALTH BILL · HOUSE OF LORDS · DELEGATED POWERS
This is the text of our submission to the Delegated Powers and Regulatory Reform Committee on the single patient record power (new section 250E of the National Health Service Act 2006), filed on 27 September 2026. It develops points made in our written evidence to the Public Bill Committee, published on the parliamentary record as HB130.
← Back to our work in the House of Lords
Download: the submission as a PDF (3 pages).
Summary
New section 250E confers a power to establish, by regulations, a whole-population health data system, and leaves to those regulations the entire regime governing who may access the record and what a patient may do to restrict access to sensitive information. The only safeguard on the face of the Bill is a duty on the Secretary of State to “have regard to the need to ensure that adequate safeguards are in place.” The Department’s own delegated powers memorandum justifies this on the basis that access arrangements “will evolve at pace” and are “better suited to inclusion within regulations.” We submit that this conflates the principle of patient access control — which is stable and belongs in the Bill — with its implementation, which may properly be left to regulations; and that the affirmative procedure, while welcome, does not permit Parliament to correct a deficient access regime, because affirmative regulations cannot be amended.
The power and the procedure
New section 250E empowers the Secretary of State to make regulations establishing a system for making patient information readily available to patients and to those involved in their care. The memorandum confirms (paragraph 141) that the regulations may make information available “to patients, their proxies, and healthcare providers”; the Bill itself extends this to those providing care anywhere in the British Islands, and defines “patient information” to include information whether or not the individual is identifiable. Regulations under section 250E(1)–(2), (3) and section 250F are all subject to the affirmative procedure (memorandum, paragraphs 146, 152, 160).
The substance of the access regime is left wholly to those regulations. The Bill does not require that access be limited to those with a legitimate care relationship, that access be logged, that a patient be able to see who has accessed their record, or that a patient — or a competent young person — be able to restrict routine access to sensitive information. The only safeguard on the face of the clause is the “have regard to” duty in section 250E(4), which prescribes nothing and confers no right on any individual.
The Department’s justification, and why it does not reach the safeguards
The memorandum’s justification for leaving the access regime to regulations is set out at paragraph 144:
“how access to the SPR is granted is likely to evolve based on advancements in technology along with public engagement as the SPR is implemented. This will evolve at pace and is therefore better suited to inclusion within regulations, rather than primary legislation.”
We accept that the implementation of access control — the technical means, the interface, the operational detail — will evolve and is properly left to regulations. But the justification elides implementation with principle. That access should be confined to those with a legitimate care relationship; that it should be logged and visible to the patient; that a competent young person’s confidence should be protected; that access exercised on a patient’s behalf should be bounded and reviewable — these are not matters that “evolve at pace” with technology. They are stable questions about the rights of the individual against a state data system, of exactly the kind ordinarily settled in primary legislation. The pace at which the means of enforcement change is not a reason to leave the principle out of the Bill.
The same elision appears in the justification for the confidentiality gateway. The memorandum defends leaving the setting-aside of the duty of confidence to regulations (paragraph 149) on the basis that:
“Placing changes to the duty of confidence on the face of the Bill would require a blanket approach which would not be appropriate.”
With respect, that is the reverse of the position. The power in section 250E(3) — that regulations may provide that processing “does not breach any obligation of confidence” — is itself the blanket approach. The National Data Guardian, the statutory office-holder for patient confidentiality, told the Public Bill Committee that this power should be narrowed to lift the duty only for the supply of information into the record, on the model of section 259 of the Health and Social Care Act 2012. That is the non-blanket alternative, and it is one that could be stated on the face of the Bill. The Department’s stated wish for a “nuanced” approach is an argument for putting the narrower formulation in the Bill, not against it.
Why the affirmative procedure is not a sufficient answer
The Department relies (paragraphs 146, 152, 160) on the affirmative procedure as the safeguard for parliamentary scrutiny. The affirmative procedure is welcome, and better than the negative. But it does not allow Parliament to do the job that matters here. Affirmative regulations may be approved or rejected as a whole; they cannot be amended. If, when the access regime is finally laid, it is deficient in a single respect — no audit visible to the patient, say, or no confidential route for a competent young person — Parliament’s only recourse would be to reject the entire framework on which the record depends. That is not a realistic remedy, and it is why the core safeguards should be settled now, in a form this House can scrutinise and refine, rather than deferred to an instrument that can only be accepted or refused entire.
The stakes make this immediate rather than hypothetical. The record is to be rolled out first in the maternity and frailty pathways — among the most confidentiality-sensitive areas of care — so the regulations will govern the most sensitive cases from the outset.
What we invite the Committee to consider recommending
That the core access and confidentiality safeguards be placed on the face of the Bill — in particular: that access be limited to what is necessary and proportionate to a person’s involvement in the patient’s care; that access be auditable and that intelligible information from the audit ordinarily be available to the patient; that a patient, including a competent young person acting personally and confidentially, be able to restrict routine access to sensitive information; and that access exercised on a patient’s behalf be granted, scoped, reviewed and withdrawn according to stated criteria — leaving to regulations the technical and operational implementation the Department rightly wishes to keep flexible.
We set out drafted clause text giving effect to these points at paragraph 17 of our written evidence (HB130), offered as policy drafting; the final form would be a matter for Parliamentary Counsel. We would be glad to assist the Committee further.
Statutory references checked against the Health Bill as amended in Committee (Bill 131), new sections 250E and 250F of the National Health Service Act 2006; memorandum references to the Department’s Delegated Powers Memorandum of 14 May 2026. Eden Openly is an independent clinical health-education publication and receives no funding from, and has no commercial relationship with, any provider of gender-related healthcare, any pharmaceutical company, or any supplier of NHS digital systems. See our statement of independence. Contact: [email protected].