What must healthcare organisations share digitally?

What information are healthcare and social care organisations legally required to send digitally or make digitally available in England, Wales, Scotland and Northern Ireland, to whom, by when and under which statutory or contractual authority?

The short answer

There are specific duties to send information electronically or keep it electronically available. They include defined GP summary records and record transfers, patient record access, particular care handovers, applicable protection-system use and national service reporting. Each duty identifies the responsible organisation, information, recipient, action and conditions. The nation, service and applicable NHS arrangement determine which duty applies. ^{183, 195, 181, 216, 193}

Publicly funded healthcare is the main focus. An independent provider can be covered through an NHS contract or service scheme; wholly private work has a different boundary. Across all four nations, data-protection rights can also require an electronic copy of personal data following an electronic access request, subject to the applicable conditions. ^{141, 181, 216, 260}

Protection reporting often has a binding duty without a prescribed digital channel. The protection map separates these duties from CP-IS, secure-email and regulatory system requirements. ^{181, 320, 350, 380}

The reviewed law does not establish one UK-wide duty to send every patient record to every care provider. A general duty to share useful information, a technical standard and a working shared-record service each answer a different part of the question. ^{010, 211, 220}

The key national differences

These are examples of the national requirements, with fuller scope and conditions on the linked pages.

Nation	What the identified requirements include	What the organisation must check
England	Covered NHS GP contracts require Summary Care Record updates, configured record access and electronic registration-record transfers. The applicable NHS service contract requires covered discharge summaries to the GP and/or other referrer and relevant continuing-care providers within 24 hours. ^{183, 181}	The GP contract, service category, recipient and delivery method. Other clinical and reporting flows have their own rules.
Wales	Covered NHS GP contracts require summary retrieval through approved Welsh GP Record/NHS Wales App systems when the record changes, electronic registration-record transfer, and appointment-data extraction arrangements. ¹⁹⁵	Welsh contract terms and the particular system/flow. A practice's monthly data review differs from the national extraction timetable.
Scotland	The Community Glaucoma Service requires defined record updates/uploads and electronic assessment claims to the national Agency within three months when claiming. Electronic GP records also carry a specific audit-access requirement. ^{216, 212}	The eligible service, accredited participant, claim or request. Broader hospital-record reporting targets need their own binding authority.
Northern Ireland	Covered GP terms require commissioning-authority audit-function access as soon as possible after a request to verify that function. Trusts provide quarterly bed/activity reports to the Department; that report’s specific digital legal link remains qualified. ^{221, 280, 283}	The actual request, Trust instruction or adopted contract. The evidence does not establish a universal clinical upload or digital-discharge rule.

The four-nation comparison explains these differences before the national chapters examine the provisions.

See what this means in practice

Summary records: a GP record changes and another care team needs the relevant summary. What must be uploaded, retrievable or viewable?
Blood tests and results: a laboratory produces a result. What must reach the clinician, what can the patient access, and when is a separate public-health report required?
Protection concerns: suspected abuse or neglect involving a child or adult, at any point in care. What information must be shared, with whom, through which digital route and by when?
Hospital discharge: a patient moves to community healthcare and social care. Who receives the handover, by what digital route and by when?

The protection examples use hospital discharge as one worked setting. The discharge example also includes a capacity, children and representative-authority map. For planning and payment, the national service-report examples show a different kind of information exchange.

What a board needs to establish

For each important exchange, the organisation should be able to identify the applicable duty, the responsible service, the information and recipient, the digital action and timing, and evidence that the duty is met. This is a management reading aid; it does not add a statutory checklist.

Use how to read a requirement to distinguish a law, prescribed contract term, adopted contract and operational instruction. Then use the exact requirements catalogue for the clause, version, method, deadline and provider limits. The legal framework explains why those sources have different effects.

flowchart TB
  accTitle: From the legal answer to a checked information exchange
  accDescr: Read the answer, apply a worked example, then check the exact requirement and evidence.
  A[Read the answer] --> B[Apply an example]
  B --> C[Check the requirement]

Check the evidence and limits

The legal baseline was reviewed on 3 November 2026. Current law and gaps, the source register and the evidence matrix show the support and remaining uncertainty. Exact local contracts and some collection-specific legal links still need evidence. This is a source-backed guide, rather than certification of an individual organisation.

Terms and abbreviations · How the wiki is organised · Research and review record