Patient data sharing in the NHS: Risks, responsibilities and what’s changed

Patient data is now at the centre of how the NHS operates. From Integrated Care Systems (ICSs) to digital-first primary care and AI-driven diagnostics, the ability to share data safely and effectively is no longer optional; it underpins service delivery, planning, and patient outcomes.

But progress has not been without friction. Public concern around how NHS data is used has grown, particularly following debates around GP data sharing and secondary use of patient records. Trust, transparency, and governance are now just as important as technical capability.

As a result, health and care organisations are under increasing pressure to balance three competing priorities:

• Improving access to and use of patient data
• Maintaining compliance with UK GDPR and the Data Protection Act 2018
• Protecting highly sensitive data from a rising volume of cyber and insider threats

In this blog, we look at what this means in practice for primary care and wider NHS organisations, and the key data protection and security considerations that still apply today.

What’s changed since this was first published

Since this blog was originally written, the NHS operating model has evolved significantly:

• Primary Care Networks now sit within Integrated Care Systems (ICSs), with broader expectations around data sharing across health and social care
• The Data Security and Protection Toolkit (DSPT) has matured into a baseline requirement for all organisations handling NHS data
• Cyber threats targeting healthcare have increased in frequency and sophistication
• There is greater scrutiny on secondary uses of patient data, including research, planning, and commercial partnerships

Primary care networks background

PCNs are a cornerstone initiative of the £20.5bn extra funding annually for the NHS Long Term Plan. They are intended to address three very different challenges facing the NHS.

Firstly, there is a deep workforce crisis in general practice. The number of practices closing has risen rapidly in recent years, and the most affected areas are characterised by older, poorer populations and older GPs, often in rural and coastal locations where attracting new staff has been particularly difficult.

Secondly, to fill a key gap in NHS architecture, the integration of primary care with community and other services, or Integrated Care Systems, is required. Lastly, they will also be expected to play a key role in efforts to improve population health, targeting a range of conditions from preventing coronary heart disease to tackling neighbourhood inequalities.

In simple terms, the PCN plan requires that general practices join to form groups of neighbouring practices, typically covering 30–50,000 people. These practices will enter network contracts.

PCNs will be expected to take a proactive approach to managing population health, first assessing the needs of their local population to identify people who would benefit from targeted, proactive support.

A key component of the service delivery is the adoption of digital services (data and technologies) so that, within five years, all patients will have the right to access GP consultations via telephone or online.

The implications for patient data

Patient data is among the most sensitive categories of personal information. Beyond regulatory compliance, misuse or loss of this data has direct consequences for patient trust, clinical safety, and organisational reputation. In 2026, the expectation is not just compliance, but demonstrable accountability and resilience.

Greater efficiency through scale, pooled resources, and the adoption of digital and tele-health services are clearly key objectives of PCNs. Providing access to, and combining and sharing patient data, brings data protection considerations as well as information security risks.

Key risk areas now include:

• Increased attack surface from interconnected systems across ICSs
• Third-party and supplier risk (especially digital health platforms)
• Misuse of data for secondary purposes without clear transparency
• Insider risk and human error are still the leading causes of breaches

Whilst sharing patient data can have clear benefits (and is also a duty following the updated Caldicott review in 2013 and subsequent legislation) it still needs to meet the requirements of the GDPR and Data Protection Act 2018.

Patient data is clearly going to include ‘special category’ data under the GDPR. When processing (including sharing) special category data, a higher level of lawfulness is required (pursuant to Article 9 of GDPR), and the risks to data subjects are much higher because of the sensitivity of the data.

It doesn’t necessarily follow that all patient data shared within a PCN is shared within the public interest, so it’s going to be important to determine the correct lawful basis for transferring patient data for different purposes.

It is also going to be necessary to implement a data-sharing agreement between PCN members. NHS England has said it will produce a data sharing agreement template, but this is still awaited.

As with any data sharing agreement, there are a number of considerations to be determined, especially around the roles and responsibilities of the parties.

Things to consider include:

• What data is being shared, with whom and why? What is the lawful basis for sharing?
• How will patients be informed about data sharing? How will privacy notices and communications be updated to ensure transparency?
• Who will the data controller(s) be, or will parties be joint controllers?
• How will subject rights requests, such as Subject Access Requests, be handled?
• How will potential data breaches be investigated and who is responsible for reporting them if required?
• Which data processors are used and who is responsible for ensuring suitable data processing agreements are in place?
• Should Data Protection Impact Assessment be carried out in respect of the sharing?
• What mechanism will be used to share the data and how will the PCN members ensure security of the information during transit and when by the other parties?

Securing patient data

The last point of the previous paragraph is critically important. The security of the data during transfer and when available to other members of the PCN is going to be paramount.

With greater pressure on the NHS to deliver more for less, the ambitious plans to make efficiency gains by scaling up and making data sharing more effective will undoubtedly heighten the risk of further data breaches.

Under pressure to meet these deadlines, it could be easy for healthcare providers to lose sight of their obligation to ensure data protection ‘by design and default’ and to implement best practice security measures.

Organisations are now expected to evidence:

• Alignment to DSPT standards
• A clear data sharing governance model across ICS partners
• Routine testing of security controls (e.g. penetration testing, vulnerability scanning)
• Staff training that reflects real-world threats such as phishing and social engineering

Given the scale and complexity of the NHS, it’s not surprising that data breaches are not uncommon. According to FOI requests, in 2017, the NHS reported data breaches involving nearly 10,000 paper documents, which were either stolen or missing from 68 hospitals.

Our advice is to map the data flows and identify the risks associated with each step. Then apply suitable security controls to mitigate the risks on a prioritised basis. This doesn’t necessarily mean new technology.

Human error is the most common cause of data breaches in our experience. Setting out minimum employee expectations, roles, responsibilities and providing training aligned to clear policies and procedures is going to be important.

Evalian supports healthcare providers with data protection

We have worked with NHS trusts as well as health and social care providers, and we understand that staying on top of all data protection and information security risks is challenging. Resources and budgets are tight, and the environments in which you work can be complex.

“Through working with Evalian®, we have been able to educate our employees more in terms of data protection. There is definitely an improved awareness overall about what policies need to be in place and how to go about that.” – Generated Health

If you need assistance to ensure your PCN is meeting your data protection obligations and managing security risks, we can help. If you’d like to discuss your requirements or just get some informal feedback, please do contact us.