The contract notice for a “Federated Data Platform” spanning the NHS will be published within weeks.
That’s according to unnamed officials who told the Guardian that the controversial and much-delayed contract is awaiting sign-off by Health Secretary Steve Barclay – the fourth minister in charge of the NHS since 2021.
It comes a month after the Department for Health and Social Care said it would merge NHS Digital into NHS England by early January 2023 -- creating a single body responsible for NHS data and digital technology
The contract is set to be worth up to £360 million. It has been a lightning rod for fears that centralised medical data will be monetised and used by unknown third parties and that patient privacy will not be preserved.
An earlier Public Information Notice (PIN) suggested that the contract will be broken into two lots. One for the NHS Federated Data Platform itself and the second for "privacy-enhancing technology" to augment it.
Activists have raised particular concerns around contract awards to Palantir, speculated to be a “favourite” to win the upcoming tender. They cite its work for US intelligence services, recruitment of NHS analytics executives and the fact that it is “chaired by the billionaire Donald Trump supporter Peter Thiel” among other concerns.
Palantir won a contract for a COVID-19 Data Store (issued without a call for competition) in March 2020 that was then expanded to help with the distribution of the COVID-19 vaccine. The initial contract cost the government just £1 as Palantir eyed future expansion opportunities. The government has promised not to expand Palantir's role without public consultation, after facing legal action from openDemocracy and campaign group Foxglove.
(Swathes of the public sector, including the NHS, are already using services from cloud providers that also serve US intelligence services and which have also heavily recruited from the public sector. For some reason Palantir continues to attract particular mistrust as a SaaS provider however. Health officials emphasise that it is simply an analytics platform provider and will not be permitted access to the data for its own purposes.)
The government promised in June 2022 that “by December 2022, we will work with expert partners and the public to implement secure data environments as a default across the NHS” including “a robust accreditation regime to ensure our high standards for secure data environments are implemented [and] a full technical specification… to ensure interoperability, cyber security and the use of privacy enhancing technologies.”
NHS data strategy: “Rare willingness to move beyond aphorisms”
It has already been working with UK company Privitar which encrypts patients’ NHS number to link datasets as the NHS works to break down data silos. Privitar says that “with no ability to decrypt or discover the common identifier used to link them, the risk of re-identifying individuals in the combined dataset is removed.
Privitar says its technology includes the use of “Protected Data Domains ensure that datasets that should stay separate cannot be linked together, preventing analysts from creating bigger datasets than those permitted by their access privileges. Importantly, each Protected Data Domain can have a unique watermark – a signal in the noise added by de-identification – that records a description of the dataset, its purpose and its recipients.
"This means that it’s easy for compliance and security teams to trace the source of unauthorized copies of data from a Protected Data Domain. This also acts as a powerful deterrent against data misuse.”
The Federated Data Platform will incorporate NHS shared care records, or patient data from across the health and care system, officials have confirmed; critics say this fact should have gone out to public consultation.
Dr Nicola Byrne, the national data guardian, said her office was advising the government on public engagement. She said: “I strongly agree with the aims and ambitions of the federated data platform programme. Improving access to high-quality data is key to improving health and care outcomes.”
A June 2022 policy paper from the Department of Health and Social Care, "Data saves lives: reshaping health and social care with data", first said the government is “looking to develop a federated data platform which will be a system of connected platforms, placed in, and ultimately determined by, individual NHS organisations.”
Saying it plans to have the platform online by April 2023, the policy paper added: “The ambition is that every trust and integrated care system will have their own platform that protects data to the highest standards of privacy and security, in accordance with the secure data environment requirements, which can also interact with regional and national platforms when they need to fulfil specific, predetermined use cases.”
At a discussion hosted by the Professional Record Standards Body (PRSB) in October 2022, Ming Tang, National Director for Data and Analytics at NHS England and NHS Improvement Data Integration, said: “The Federated Data Platform is an operational tool that helps connect systems together and support better workflow.
“For instance, if you think about the current pathway of the patient going to hospital to be assigned a care home, there is a lot of information that gets passed in the system between different settings, which is not always consistent and up-to-date. This is an example of an issue that the platform is aiming to solve.”
