Policy paper

Health Bill: data and digital functions - fact sheet

Published 19 May 2026

Applies to England

Introduction

The Health Bill (‘the bill’) will transfer digital and data functions currently exercised by NHS England to the Secretary of State (exercised through the restructured Department of Health and Social Care (DHSC)). This will ensure that vital data collections and essential digital systems continue without disruption to the services that patients, clinicians and the public rely on. This document provides an overview of these changes, and the new roles and responsibilities of the Secretary of State for Health and Social Care in relation to digital and data functions.

Background

NHS England’s health and adult social care digital and data functions are set out in Part 9 of the Health and Social Care Act 2012 (the 2012 Act). These statutory functions include responsibility for:

• national data collections, such as waiting times and length of stays and discharge, to improve the quality of care and services
• the analysis and publication of data
• the operation of national information systems for the NHS, such as the NHS App, NHS Spine and the Personal Demographics Service (PDS), which is the national source of NHS numbers and contact details for individuals in England and Wales

These digital and data functions:

• support the planning and delivery of health and adult social care in England
• support service improvement, research and policy development
• include the operation of essential national systems

They also provide the ability to establish information systems for devolved authorities and Crown Dependencies, at their request.

These digital and data functions were transferred to NHS England in 2023, when it was merged with NHS Digital, which was the national data and technology body for the NHS and adult social care in England and previously held statutory responsibility for those functions.

Objectives of the bill

The bill will transfer statutory health and adult social care digital and data functions, currently exercised by NHS England under Part 9 of the 2012 Act, to the Secretary of State. This will ensure that functions continue to have the appropriate lawful basis, and that the essential data collections and live services upon which the NHS depends are able to continue undisrupted. DHSC will discharge these functions on behalf of the Secretary of State.

DHSC’s priority in exercising these functions will be to process and manage data safely and securely, in ways that will maintain public trust, in the same way that NHS England does currently. NHS England staff, infrastructure and assets will be brought into DHSC, so there will be the resources and the expertise to continue to deliver these functions.

The digital and data functions will be transferred to the Secretary of State almost in their entirety with a few adjustments including those necessary to reflect that the Secretary of State may be delivering some of these functions directly. DHSC will exercise these on behalf of the Secretary of State. A few functions will be adapted or discontinued, either because there will no longer be a need for them or because current needs or practices are not being met or met well by the existing legislation.

The main changes are outlined below.

Establishing information systems

The Secretary of State currently directs NHS England to establish and operate an information system where the Secretary of State considers it is needed, and others can request that NHS England establishes and operates an information system. Information systems include those to collect data on NHS services or those used with systems which allow the management of operational data to deliver services in the NHS. The bill will instead impose a duty on the Secretary of State to establish and operate information systems where they consider it appropriate to do so in the interests of the health service in England or recipients or providers of adult social care in England. Others, including health and care bodies, will also be able to request that the Secretary of State establishes and operates an information system.

Mandatory requests to establish an information system

Currently the Care Quality Commission (CQC) and the National Institute for Health and Care Excellence (NICE) can make mandatory requests to NHS England to establish and operate an information system. These are mandatory because NHS England must usually comply with the request. The bill will not place the Secretary of State under a similar requirement as CQC and NICE generally do not have the ability to place requirements on the Secretary of State. CQC and NICE will, of course, be able to request that the Secretary of State establishes and operates an information system.

How health and care information can be used

The law currently refers only to health and care information systems being set up for collection and analysis. The bill will update this and refer to processing. The term ‘processing’ is aligned to the UK GDPR definition and encompasses all the activity necessary to establish collection and analysis of data, including areas such as retrieval and storage of data. This will better reflect the scope of how the law is currently interpreted and applied in practice, providing greater clarity and flexibility, for example in relation to future use of artificial intelligence.

This will not change the strict rules on access, use and security of data which will be maintained in line with the current NHS England uses of patient data. Access to identifiable information will continue to be strictly limited to those who need to see it as part of their role, for example to maintain, validate or fix records, or to access data for the purpose of pseudonymising it (making it less identifiable).

Provision of information

NHS England routinely requires health and care bodies to share data, such as for the purposes of understanding service provision across England, monitoring quality and identifying improvements. The bill will transfer this function to the Secretary of State so that they can require certain bodies to provide DHSC with any information considered necessary or expedient for the exercise of data functions being transferred from NHS England.

Publication of information obtained through an information system

The bill will allow the Secretary of State to publish information obtained in the operation of an information system established for the collection, analysis or other processing of information. This will have to be in accordance with data protection law, and personal information can only be published with consent or where this is a proportionate means of achieving a legitimate aim.

Disclosure of information obtained through an information system

The Secretary of State will be able to disclose (other than by publication) information obtained in the operation of an information system and this includes personal information in certain circumstances. For example:

• if the individual to whom the information relates has consented to the disclosure
• if the disclosure is made in accordance with a court order or for the purpose of criminal proceedings
• if information is disclosed for the purpose of facilitating research

In practice, DHSC will continue NHS England’s approach to:

• ensure compliance with data protection law
• ensure disclosures are performed in a way that maintains public trust

Delegation

The Secretary of State will be able to delegate most of these functions to a public body.

Regard to guidance

NHS England is currently under a duty to have regard to guidance set by the Secretary of State. The bill will not place the Secretary of State under an equivalent duty to have regard to their own guidance.

Quality of information assessment

NHS England is required to assess the quality of information it collects from time to time and publish a record of the results of this assessment. The bill will not transfer this requirement to the Secretary of State. The Secretary of State can do this if they wish under their existing powers.

Annual reporting

As part of NHS England’s annual reporting duties, they are currently required to report annually on how effectively they have discharged the data functions. The bill will not place the Secretary of State under an equivalent requirement as Parliament can directly question and hold the Secretary of State to account through parliamentary questions, debates and through the Health and Social Care Select Committee, and the Secretary of State can report on this in DHSC’s annual report.

Together these changes will ensure the transfer of existing digital and data functions while making changes to reflect that the Secretary of State will deliver some of these functions directly or may choose to delegate them where appropriate.

Delivering digital and data systems to support patient care

The provisions in the bill will bring the operational delivery of essential digital and data functions together with policy development and central leadership. This will improve the join-up between policy and delivery of digital and data services under one organisation, accountable to the Secretary of State, and better support the 10 Year Health Plan for England’s 3 ‘big shifts’: from analogue to digital, from hospital to community, and from treatment to prevention.

Following the transfer, the Secretary of State will be able to continue delivery of essential services to support the delivery of care, and the use of data to plan and research improved care, including:

• the NHS App platform
• the National Proxy Service - a digital service for individuals registered with a GP in England that enables other authorised individuals to access digital NHS services on behalf of a patient to support the delivery and management of the patient’s care
• PDS, the national master database of all NHS patients in England, Wales and the Isle of Man. It holds basic patient information including name, NHS number, address and registered GP. PDS allows healthcare workers to identify patients, so that they can link them to their care records across different care settings
• national data collections, for example data from hospital electronic Prescribing and Medicines Administration (ePMA). ePMA systems are used to record medicines prescribed and admitted to patients in England. NHS England currently uses this data to monitor the quality of service provision and to help plan and improve services