Organisation objective

• Statutory item
• Governance

Executive summary

This paper is for the Board’s information only to provide an overview of the ‘NHS login for health services supplied by third party Apps in Wales Request 2024’ (the Statutory Request). This was issued to NHS England (NHSE) in May 2024 by Digital Health Care Wales (DHCW) under section 255 of the Health and Social Care Act 2012 (2012 Act).

The purpose of the Statutory Request (Purpose) is to request NHSE to support DHCW in its statutory duty to secure services for the provision of healthcare in Wales. This is through NHSE providing the NHS login service, as an authentication and identification method, for residents of Wales to access digital health services delivered by third party suppliers on behalf of health providers in Wales.

The NHS login service may only be used by third party suppliers which have been assessed by DHCW as providing online services that are beneficial to health services in Wales and to the recipients of healthcare services provided in Wales.

Action required

The Board is asked to note the new Statutory Request and the information provided in this Paper regarding its purpose, effect, and requirements.

Background

1. Under section 255 of the 2012 Act, any person, including a devolved nation, can request NHSE to establish and operate a system for the collection or analysis of information (a Section 255 Request). They can make this request where they consider that the information that would be obtained by complying with the request, is information that it is necessary or expedient for them to have in relation to their exercise of functions or carrying out of activities in connection with the provision of health care or adult social care.

2. Collecting and analysing data in response to Section 255 Requests are functions which have been transferred to NHSE from NHSD under the Health and Social Care Information Centre (Transfer of Functions, Abolition and Transitional Provisions) Regulations 2023.

3. Deciding to comply with such requests is, except in limited circumstances, discretionary by NHSE. When considering whether to comply with a discretionary Section 255 Request, NHSE must consider whether compliance would impose burden on those NHSE collect information from, how NHSE could seek to minimise that burden and whether compliance would interfere to an unreasonable extent with NHSE’s ability to exercise its other statutory functions. The process for making a Section 255 Request is published on the NHSE website, which is a statutory requirement [see footnote 1].

4. DHCW is a Special Health Authority established under section 22 of the National Health Service (Wales) Act 2006 (the 2006 Act) and by the Digital Health and Care Wales (Establishment and Membership) Order 2020 (Establishment Order). DHCW’s functions relate to the provision of digital platforms, systems and services and supporting the improvement of such systems for the health service in Wales. They are an organisation that is eligible to make a Section 255 Request to NHSE and they have made a number of these to NHSD in the past, with which NHSE continues to comply [see footnote 2].

Purpose of the Statutory Request

5. NHSD previously accepted a Section 255 Request from DHCW to provide the NHS login services for residents in Wales to access the DHCW’s NHS Wales App under the NHS login for the NHS Wales App request 2022. Following the merger, this function has transferred to and is being discharged by NHSE.

6. NHSE has now been requested by DHCW to expand this service and to provide the existing NHS login service to residents of Wales that register for an NHS login account in digital services delivered by third party suppliers on behalf of health providers in Wales. The NHS login service may be used by third party suppliers where their digital product (digital health service) has been assessed by DHCW as being beneficial to health services in Wales and to the recipients of healthcare services provided in Wales.

7. NHS login provides patients and the public with a simple, secure and re-usable way to access multiple digital health and care services. Through delivery of NHS login to DHCW and commissioned third party digital services, NHS login will help support patients in Wales. This includes patients with cross boundary health and care who use the NHS App in Wales and its connected third party services. This will improve connectivity and increase interoperability between NHSE and DHCW NHS login services, including for those patients. NHS login and this proposal support the NHS Long Term Plan vision of mainstream access to digitally enabled primary and outpatient care, of a digital-first option for everyone and for straightforward digital access to NHS services.

8. DHCW use of NHS login also underpins the goals of the DCHW’s Digital Services for Patients and the Public (DSPP) programme to help people in Wales to access better healthcare and support health providers to deliver care more efficiently.

Effect and Requirements of the Statutory Request

9. From the date of signature of the Statutory Request, which occurs when NHSE has accepted the request. NHSE has a legal function to comply with the Statutory Request. NHSE is therefore asked under the request:

• to establish and operate such systems for the collection and analysis of information as are necessary to deliver NHS Login services for third party providers to Wales to meet the above Purpose of the Statutory Request; and
• to analyse the information collected, including linkage to other data lawfully held by NHSE, as NHSE determines is necessary, to achieve the above Purpose

10. These functions are to be exercised in accordance with the Requirements Specification attached to the Statutory Request (as they may be updated from time to time). The exercise by NHSE of the functions set out in the Statutory Request is also subject to the statutory guidance issued by the SoS to NHSE under section 274A of the 2012 Act: NHS England’s protection of patient data, 23 May 2023 [see footnote 3]. This is guidance that NHSE has a duty to have regard to when discharging its functions under this Statutory Request.

Approval of acceptance of Statutory Request and publication

11. The National Director of Transformation and National Medical Director approved acceptance of the Statutory Request on behalf of the Accounting Officer as set out in the NHSE Scheme of Delegation and the Statutory Request has been published on the NHSE website [see footnote 4].

Annex 1

NHS login for health services supplied by third party Apps in Wales Request 2024

Footnotes

1. https://www.digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/making-a-request-under-section-255-of-the-health-and-social-care-act-2012 
2. https://www.digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/nhs-wales-directions
3. https://www.gov.uk/government/publications/nhs-englands-protection-of-patient-data/nhs-englands-protection-of-patient-data
4. https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/nhs-wales-directions/nhs-login-for-health-services-supplied-by-third-party-apps-in-wales-request-2024

Publication reference:  Public Board paper (BM/24/33c(Pu))