Written questions by Wrigley.

Whether (a) synthetic datasets, (b) model parameters, (c) algorithm weights and (d) derived feature maps generated using NHS training data have been (i) exported to and (ii) accessed from locations outside UK sovereign data zones.

There is no overseas processing of data of any type by the Federated Data Platform (FDP) programme, and this includes synthetic data and all functionalities. This is laid out in the FDP Information Governance Framework, which is available at the following link:https://www.england.nhs.uk/long-read/federated-data-platform-information-governance-framework/

Whether the Government has issued guidance to help ensure that AI solutions trained on NHS datasets align with NHS principles.

Artificial Intelligence (AI) solutions trained on National Health Service datasets must align with core NHS principles, including safety, fairness, transparency, and accountability. These principles are embedded in the NHS’s approach to digital innovation and data use.To support this, NHS England utilises guidance developed by the NHS Transformation Directorate, which sets out expectations for the safe, lawful, and ethical use of AI in health and care settings. This includes ensuring that AI systems are explainable, that data is used responsibly, and that decisions remain under human oversight.The guidance has been reviewed by the Health and Care Information Governance Working Group, including the Information Commissioner’s Office (ICO) and the National Data Guardian (NDG), and is publicly available on the NHS Transformation Directorate’s website:https://transform.england.nhs.uk/information-governance/guidance/artificial-intelligence/This framework helps ensure that AI innovations developed using NHS data are aligned with NHS values and are deployed in a way that benefits patients, supports clinicians, and maintains public trust.

Whether his Department has had deductions with Palantir Technologies Ltd on (a) profit-sharing arrangements and (b) access to derivative data linked to NHS research outputs.

NHS England has entered into a contract with Palantir, the NHS Federated Data Platform Associated Services (FDP-AS) contract, which is available at the following link:https://www.contractsfinder.service.gov.uk/Notice/0f8a65b5-23a2-4294-abb1-a7fd8efb3ad0The FDP-AS Agreement does not include provision for profit sharing arrangements and Palantir does not have access or rights to any National Health Service data under the FDP-AS, beyond those as required to perform its function as a data processor under instruction by the NHS.

Whether (a) outputs and (b) intermediate artefacts generated via Foundry workflows are permitted to be retained by Palantir Technologies for the purpose of product refinement.

All products, outputs, and intermediate artefacts generated within the Federated Data Platform, funded by the National Health Service under the NHS Federated Data Platform Associated Services (FDP-AS) agreement, are the intellectual property of the NHS, and Palantir is not permitted to utilise these for their own purposes. Further information on the FDP-AS is available at the following link:https://www.contractsfinder.service.gov.uk/Notice/0f8a65b5-23a2-4294-abb1-a7fd8efb3ad0

Whether (a) containerised services, (b) data pipelines and (c) Application Programming Interface integrations used within the Federated Data Platform are managed from (i) repositories and (ii) orchestration tools hosted outside the UK.

There is no overseas processing of data of any type by the Federated Data Platform (FDP) programme, and therefore transfer impact assessments are not required. This is laid out in the FDP Information Governance Framework, which is available at the following link:https://www.england.nhs.uk/long-read/federated-data-platform-information-governance-framework/

Whether pseudonymised NHS data processed within the Federated Data Platform is subject to remote (a) operability and (b) telemetry access by (i) engineers and (ii) DevOps teams located outside the UK.

There is no overseas processing of data of any type by the Federated Data Platform (FDP) programme, and this includes synthetic data and all functionalities. This is laid out in the FDP Information Governance Framework, which is available at the following link:https://www.england.nhs.uk/long-read/federated-data-platform-information-governance-framework/

What discussions he has had with NHS England on its data cleaning specification for Palantir; and whether that specification defines how patient data are (a) extracted, (b) transformed and (c) loaded into the federated data platform.

NHS England has not had any discussions with my Rt Hon. Friend, the Secretary of State for Health and Social Care on this matter. Each local organisation has their own instance of the NHS Federated Data Platform (FDP) for which they are the data controller, and can opt into any of the core products that support delivery of patient care. Local organisations can connect and share information currently stored in separate systems to support staff to access the information they need in one safe and secure environment, where there is a legal basis to do so. Data is only ingested into an FDP Tenant following establishment of the legal basis and a specific purpose for usage of that data. Most commonly this is for use in FDP products, for example those which support the management of waiting lists, theatre scheduling, or effective discharge of patients. Data is extracted, cleaned, enriched, and transformed according to the requirements of each use case or product. The FDP program uses the concept of the NHS Canonical Data Model to ensure that data is treated consistently across FDP Tenants, and this enables the development of consistent, reusable products. Prior to ingestion from the source systems to the FDP Tenant, the NHS-Privacy Enhancing Technology (NHS-PET) service registers the flow. NHS-PET is a standalone service located between primary data sources and the FDP-Associated Services (AS) platform, providing a data orchestration and privacy service for FDP-AS data ingress and inter-tenant transfers. The NHS-PET service creates records of the types and uses of data which are used in every instance of NHS FDP. If the data is to be used for secondary uses, not direct care, the NHS-PET service can treat personal data to remove identifiers utilising techniques such as anonymisation, masking, generalisation, and pseudonymisation. Privacy treated data is modelled by FDP-AS and is then made available for specific purposes.

What intellectual property rights NHS England retains over (a) data models, (b) ontologies and (c) analytics solutions produced within the Federated Data Platform.

Within the NHS Federated Data Platform (FDP), the National Health Service retains the Intellectual Property of the solutions it funds or develops, including all associated data models, ontologies, including the NHS Canonical data model, products, and analytical solutions. Under the FDP-Associated Services Agreement between NHS England and Palantir, background Intellectual Property, prior to entering into the agreement, remains the property of the respective party.

Whether he has received recent correspondence from Palantir.

My Rt Hon. Friend, the Secretary of State for Health and Social Care received a letter from Louis Mosley, the Executive Vice President for the United Kingdom and Europe of Palantir Technologies, on 3 March 2025, offering to meet to discuss the roll-out of the NHS Federated Data Platform.

Whether his Department has made an assessment of the potential risks of cross‑contamination risk when data from multiple NHS trusts are ingested into a single cloud environment.

In order to assess the risk and impact to data privacy, all Federated Data Platform (FDP) installations are required to complete a Data Privacy Impact Assessment (DPIA). An overarching DPIA for the FDP was also undertaken. Each FDP Tenant is a logically separated instance of the Foundry Platform. Each tenant has separate administrators, and independent control of all data ingress and egress. User access is controlled by a combination of Role Based Access Controls and Purpose Based Access Controls to ensure that access to data is only available to users with a documented and auditable reason for access. All changes to the product or platform go through a careful process of development, testing, quality assurance, and change management before they are released. This helps to prevent errors and problems. The FDP has several measures in place to keep data safe. These include:¾strong network security, namely firewalls and intrusion detection systems that monitor all network traffic to and from the platform, to block unauthorised access and detect suspicious activity;data encryption of all data stored on the platform, both when transferred, or in transit, and when stored on servers;purpose based access, as users only have access to the data they need to do their jobs. This helps to minimise the risk of unauthorised access to sensitive information;detailed logging and monitoring, as all user activity on the platform is logged and monitored for suspicious activity. This helps to identify potential security breaches quickly and maintains a full audit trail. Security logs are encrypted and stored securely;regular security testing, with the platform undergoing regular penetration testing and vulnerability scanning to identify and fix any weaknesses in its security;development lifecycle, with all changes to the product or platform going through a careful process of development, testing, quality assurance, and change management before they are released. This helps to prevent errors and problems; andmonitoring, as live services teams constantly monitor the product or platform 24 hours a day, seven days a week to quickly identify and fix any issues that may arise.

If he will make an assessment of the potential impact of working with commercial suppliers whose senior leadership have expressed overt political affiliations on the reputation of NHS England.

Commercial contracts awarded by the Department, NHS England, or other National Health Service bodies are held with a company rather than individuals.NHS bodies set their own policies on how to award contracts, but they must do so in line with the law, specifically the Public Contracts Regulations 2015 and now the Procurement Act 2023 which came into force in February 2025, and central policy. The Government uses a standard selection questionnaire that requires suppliers to confirm they meet certain standards. Suppliers can be excluded for a variety of reasons, including where they are guilty of grave professional misconduct or where they have shown significant or persistent deficiencies in the performance under a prior public contract. Full guidance on the Procurement Specific Questionnaire, which replaces the standard selection questionnaire under the Public Contract Regulations, can be found on the Government Commercial Function’s Procurement Pathways website.

What assessment he has made of the potential impact of Palantir's involvement on the NHS model of being free at the point of use.

The provision by Palantir Industries of the NHS Federated Data Platform (FDP) has no impact on National Health Service care being free at the point of use.Palantir is a technology supplier providing the underlying technology that supports the FDP. They do not influence NHS policy, funding models, or decisions about access to care. Their role is limited to delivering technical services under the direction and control of the NHS.

Whether NHS‑funded analytics solutions created on the Federated Data Platform have been (a) patented and (b) registered by (i) Palantir Technologies and (ii) its subsidiaries.

Within the NHS Federated Data Platform (FDP), where the National Health Service commissions and funds the development of solutions, the intellectual property of these solutions remains with the NHS.Under the FDP-Associated Services Agreement between NHS England and Palantir, background intellectual property, prior to entering into the agreement, remains the property of the respective party.

Whether NHS England has stress‑tested the portability of (a) data schemas, (b) application programming interfaces and (c) dashboards for use on other vendor platforms.

NHS Federated Data Platform products are built using open-source technologies, for instance Python and Spark. End-user products can also be built using open market frameworks, for instance React, interfacing to the platform Application Programming Interfaces. The NHS Federated Data Platform has extensive integration capabilities. The platform has active integrations using alternative visualisation tools, for instance PowerBI. The NHS Federated Data Platform Data Schemas are published to GitHub.

What proportion of Federated Data Platform development work is carried out by UK‑based engineers; and whether data processing beyond AWS input processes is off‑shored.

All NHS Federated Data Platform (FDP) development work is carried out by United Kingdom based engineers, therefore there is no offshoring. This is documented in the contract, Information Governance Framework, and Memorandum of Understanding. It is a contractual requirement that personal data stored in the FDP and National Health Service Privacy Enhancing Technology cannot be accessed by its provider’s personnel or contractors based outside the UK. These measures collectively ensure that NHS data remains under UK jurisdiction and that all processing of patient information will be within the UK only. This is a contractual requirement, and one of the key principles of the Federated Data Platform Information Governance Framework. Data cannot be accessed or processed by non-UK Government entities.Information on how data is protected, who can access it, and under what conditions, is available at the following link:https://www.england.nhs.uk/long-read/overarching-data-protection-impact-assessment-dpia-for-the-federated-data-platform-fdp/#18-in-which-country-territory-will-personal-data-be-stored-or-processed

What milestones are included in the Federated Data Platform contract to (a) facilitate orderly off‑boarding and (b) data migration to an alternative provider.

The NHS Federated Data Platform Associated Services (FDP-AS) agreement has a comprehensive Exit Management Schedule which sets out the contract terms for exit, including the requirements on Palantir to support in re-procurement planning, exit, and transition assistance which would facilitate the migration to a future solution/state. Data migration is in the scope of the Exit Management provisions.The terms of the FDP-AS agreement, within the context of the potential total contract duration, sets out the timeframes and periods of assistance that NHS England may utilise to facilitate exit and migration.

Whether patients will be consulted on changes to purpose‑based access policies during the contract with Palantir.

The National Health Service is committed to maintaining public trust and transparency in the use of patient data and to ensuring that patients and the public are informed and engaged in decisions that affect how their data is used. This aligns with NHS England’s broader commitment to working in partnership with people and communities.The Federated Data Platform uses a Purpose-Based Access Control model. This ensures that access to data is strictly governed by the specific purposes approved by NHS England.Any change to the approved use cases, or new use cases, will require further engagement with patients and stakeholder advisory groups, including the Specialist Information Governance Advisory Group, and approval from the Data Governance Group. This engagement would be prior to, and inform any changes to, purpose-based access policies.

Whether he plans to periodically review NHS AI models to ensure continued alignment with (a) data protection and (b) clinical safety standards.

There are strict safeguards in place throughout the National Health Service to protect data. All providers of services which handle patient data must protect that data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and every health organisation is required to appoint a Caldicott Guardian to advise on the protection of people’s health and care data, and to ensure that it is used properly. This includes where artificial intelligence (AI) is used in relation to patient records. The Information Commissioners Office has developed detailed AI guidance which provides an overarching view of data protection, including the need for Data Protection Impact Assessments and to ensure compliance with UK GDPR. They have also produced an AI toolkit to support organisations auditing compliance of their AI-based technologies. NHS bodies are expected to make use of this guidance and toolkit. The NHS has published two clinical risk management standards relating to clinical safety, with the codes DCB0129 and DCB0160, both of which are applicable to AI. Under the Health and Social Care Act 2012, manufacturers of health IT systems and health organisations that deploy and use these systems must have regard to these standards. In line with current Data Coordination Board practice, each standard comprises of: a specification, which defines the requirements and conformance criteria to be met by the user of the standard, and with the user responsible for how these requirements are met; and implementation guidance, which provides an interpretation of the requirements and, where appropriate, defines possible approaches to achieving them.

What steps NHS England is taking to verify that derivative analytical outputs from the NHS Federated Digital Platform cannot be reverse‑engineered to reveal identifiable patient data.

All analytics products created by NHS England, including those developed on the NHS Federated Data Platform, are subject to a full Data Privacy Impact Assessment (DPIA) as part of the design and development process, with further information available at the following link:https://www.england.nhs.uk/long-read/overarching-data-protection-impact-assessment-dpia-for-the-federated-data-platform-fdp/#18-in-which-country-territory-will-personal-data-be-stored-or-processedAll data used by the NHS Federated Data Platform integrates with advanced Privacy Enhancing Technology (PET). This has been procured from a separate supplier to ensure independence and to mitigate any potential conflicts of interest. This technology ensures that data is processed in a secure and privacy-preserving manner.

Whether patients who are data controllers under the national data opt‑out can (a) review and (b) challenge how their records are processed within the Federated Data Platform.

The Federated Data Platform fully complies with the National Data Opt-Out policy. Confidential patient information is not used in the national instance, and only in a local instance for the purposes of direct care, and therefore the National Data Opt-Out does not apply. If this changes in the future, because a new product processes confidential patient information for a purpose other than direct care, the process for managing the opt out is laid out in the FDP Information Governance Framework, which can be found at the following link: https://www.england.nhs.uk/long-read/federated-data-platform-information-governance-framework/