# Exact digital requirements catalogue **Use this page to check the precise obligation after reading the [short answer](https://uk-digital-healthcare-legal-requirements.pages.dev/index.md), [national comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/comparison/index.md) or a [worked example](https://uk-digital-healthcare-legal-requirements.pages.dev/decision-workflow/index.md).** Each record keeps the information, responsible organisation, recipient, digital method, timing, authority and provider limits together. For a board, the key question is whether an applicable requirement has an accountable service owner and supporting evidence. Specialists can use the clauses and source links below to establish the exact duty. The [reading guide](https://uk-digital-healthcare-legal-requirements.pages.dev/requirements/index.md) and [terms](https://uk-digital-healthcare-legal-requirements.pages.dev/glossary/index.md) explain unfamiliar labels. ## Find the right exchange | Exchange | Start with these catalogue entries | Read the explanation | |---|---|---| | Summary record upload, retrieval or viewing | [England](#eng-001), [Wales](#wal-001), [Scottish ECS/KIS](#sct-d05), [NI professional portal](#ni-d08) | [Summary records](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/summary-care-records/index.md) | | Electronic GP registration-record transfer | [England](#eng-003), [Wales](#wal-002) | [National comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/comparison/index.md) | | Patient record access or electronic copy | [UK electronic copy](#uk-001), [qualifying portability](#uk-002), [English GP online access](#eng-004) | [Patient rights](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/accountability/index.md) | | Discharge or clinical correspondence | [English discharge](#eng-006), [other continuing-care recipients](#eng-007), [Scottish eye-care letter](#sct-d02) | [Hospital discharge](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/hospital-discharge/index.md) | | Blood results and pathology standards | [English pathology](#eng-012), [NI laboratory route](#ni-d06), [Scottish notification](#sct-d09), [Welsh notification](#wal-016) | [Blood tests and results](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/blood-tests-results/index.md) | | Child/adult protection reporting, system use and regulatory notices | [Protection catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/protection-requirements/index.md) | [Protection explanation](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/protection-and-safeguarding/index.md) and [worked examples](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/protection-sharing/index.md) | | National activity, extraction or payment reporting | [England](#eng-015), [Wales](#wal-003), [Scottish claims](#sct-d04), [NI report](#ni-p01) | [National service reports](https://uk-digital-healthcare-legal-requirements.pages.dev/national-service-reports/index.md) | The entries above deliberately include different evidence classes. A useful operational route and a confirmed legal obligation remain distinguishable below. ## Read the classifications The core catalogue below contains **56 assessed records**. The [protection catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/protection-requirements/index.md) extends this reference with separately counted child/adult protection exchanges and contexts. Its sections group the action and evidence together: [22 identified digital obligations](#confirmed-digital-obligations), [14 exchange conditions and qualified mandates](#standards-access-conditions-and-national-mandates-with-qualifications), [10 information duties without an independently required digital method](#information-duties-that-do-not-independently-require-digital-delivery), and [10 operational routes or recommendations](#operational-routes-recommendations-and-local-procedures). Read three dimensions separately: 1. **Action:** sending, availability, a condition on an exchange, or wider context. 2. **Legal force:** statute, prescribed term, adopted contract, administrative instruction or recommendation. 3. **Evidence:** what has been verified and what remains conditional or unresolved. A condition such as secure access can be legally binding even though it is not a new duty to send a dataset. Conversely, a national system can operate without proving a universal legal upload requirement. Each row retains its specific classification and limitations. The baseline is **3 November 2026**. Publicly funded healthcare is primary, with private-provider scope stated. Exact local terms and some collection-specific legal links remain unknown; the [validation record](https://uk-digital-healthcare-legal-requirements.pages.dev/validation-queue/index.md) preserves those limits. ## Confirmed digital obligations These rows have an identified statutory, prescribed-contract or published contractual digital requirement. Conditional rights, service participation and exceptions remain in the last column. Prescribed contract terms are labelled as such; they are not described as a universal duty on every provider. | Requirement | Information and action | Responsible organisation → recipient | Digital method / standard | Timing | Authority and legal force | Nations, covered organisations and limits | |---|---|---|---|---|---|---| | **UK-001** | Copy of personal data to which the person is entitled under Article 15 | Healthcare/social-care data controller → Patient or properly authorised representative exercising the right | Commonly used electronic form after an electronic request, unless the person requests otherwise | Article 12/12A applicable period: normally one month from relevant time; lawful extensions, identity/clarification provisions and exceptions apply | UK GDPR; Articles 15(3), 12 and 12A. **Conditional statutory digital-copy duty**. [SRC-260](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-260), [SRC-173](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-173) | All four nations; Public and private controllers in scope. A subject-access copy is not universal real-time portal access. Reasonable/proportionate search, health-data exemptions, third-party rights and representative authority remain. | | **UK-002** | Personal data provided by the person within qualifying automated consent/contract processing | Data controller → Patient; another controller directly where technically feasible | Structured, commonly used, machine-readable format; direct transmission where feasible | Request-response period under Articles 12/12A | UK GDPR; Article 20(1)–(4). **Conditional statutory portability duty**. [SRC-261](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-261), [SRC-173](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-173) | All four nations; Public/private controller only where qualifying processing applies. Excludes necessary public-task/official-authority processing. This is not a universal NHS transfer right, nor a duty covering all inferred clinical records. | | **ENG-001** | Summary medications, allergies and adverse reactions; other agreed/consented information within the SCR definition | GMS contractor; PMS contractor providing essential services → Summary Care Record national service and authorised subsequent users | Enable automated SCR upload using NHS England-approved systems | When patient medical record information changes | GMS 2015 reg 68; PMS 2015 reg 61; reg 68(1)–(2); reg 61(1)–(2). **Statutory prescribed-contract requirement**. [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184) | England; England GMS/PMS scope of each regulation. Summary scope, additional-data consent/agreement and recording exclusions apply; lawful access and confidentiality remain necessary. This does not require publication of the entire record. | | **ENG-002** | Computerised GP records and incoming consultation summaries | Contractor holding computerised patient records → Other permitted GP Connect users; GP as Update Record recipient | Configure GP Connect Access Record HTML, Structured and Update Record; take reasonable steps to keep them operational | Ongoing; provision inserted 1 October 2025 | GMS regulation 68A; PMS regulation 61A; reg 68A(1)–(3); reg 61A(1)–(3). **Statutory prescribed-contract requirement**. [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184) | England; England GMS/PMS contractors under relevant contract. The read capabilities are defined for direct care; Update Record integrates consultation summaries. Enablement does not establish unrestricted consumer eligibility, lawful disclosure or that all developers can onboard. | | **ENG-003** | Electronic registered-patient record on GP registration transfer | Outgoing GP contractor and incoming contractor in specified roles → New registered primary-medical-services provider | GP2GP secure direct transfer; paper/unconfirmed part fallback to NHS England | Requested outgoing complete record within 28 days of receipt of the request | GMS regulations 69/69A; PMS regulations 62/62A; GMS 69(1)–(3), 69A(1)–(3); PMS 62/62A. **Statutory prescribed-contract requirement**. [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184) | England; England; the GP2GP duty excludes temporary residents; PMS 62 has an essential-services qualification. The temporary-resident exception applies. Paper-only records do not become electronic; safe-transfer confirmation and fallback remain separate. This is not a transfer of every specialist social-care record. | | **ENG-004** | Prospective GP medical-record information; coded information offer | GP contractor holding computerised registered-patient record → Registered patient | Online access facility configured for access; coded information promoted/offered | Prospective relevant date no later 31 October 2023; ongoing; late written requests within statutory compliance period | GMS regulation 71ZA; PMS 64ZA; 71ZA(1)–(10); 64ZA. **Statutory prescribed-contract requirement**. [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184) | England; England registered patients of relevant GMS/PMS contractor. Excepted information, a patient declining prospective access, and coded/free-text separation affect scope. This is patient access, not interprofessional shared-record access or automatic proxy authority. | | **ENG-005** | Remaining relevant GP medical information outside existing online-access/excepted material | GP contractor whose clinical systems allow facility → Registered patient requesting in writing | Online access facility | By compliance period linked to UK GDPR Article 12, subject to applicable law | GMS regulation 71ZB; PMS 64ZB; 71ZB(1), (1A), (1B), (2); 64ZB. **Statutory prescribed-contract requirement**. [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184) | England; England relevant GMS/PMS contractor and registered patient. Written request, technical-system condition and excepted-information limits; not a universal live online hospital/social-care record duty. | | **ENG-006** | Discharge summary for inpatient/day-case/A&E transfer or discharge | Provider in applicable full-length contract service categories → Patient GP, where applicable under the GP and/or Referrer clause | Direct automatic transfer into GP EPR via suitable secure interface; structured narrative/SNOMED-capable summary | Within 24 hours after transfer/discharge | 2026/27 NHS Standard Contract SC11.5 and GC definitions; SC11.5; Delivery Method (i); Discharge Summary (i). **Contractual obligation**. [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | England; England contracts; SC11.5 categories A, A+E, CR, MH, MHSS. The actual adopted contract and categories must be established. The GP route differs from other recipients; creation of the summary is not proof of GP clinical action. SC11.5 uses GP and/or other Referrer; it does not unconditionally require both recipients in every case. | | **ENG-007** | Same scoped discharge summary | Provider in applicable full-length contract service categories → Other Referrer where applicable, and any relevant third-party health/social-care provider | Direct automatic EPR transfer OR secure NHS/equivalent email as protocol requires/permits | Within 24 hours after transfer/discharge | SC11.5; Delivery Method (ii). **Contractual obligation**. [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | England; England relevant NHS-funded contract; third-party social care expressly included. The protocol can select the permitted route. This does not give every provider every record. A recipient’s independent-provider or social-care status alone does not establish its own reciprocal contractual obligations. SC11.5 uses GP and/or other Referrer; the other-Referrer leg applies where relevant, alongside any relevant third-party health/social-care provider. | | **ENG-008** | Outpatient clinical information requiring prompt GP/referrer action | Outpatient provider in categories A, CR, MH → Patient GP and/or other referrer | Applicable Delivery Method; GP automatic EPR route, other referrer protocol route | As soon reasonably practicable; no later 7 days after attendance | SC11.7. **Contractual obligation**. [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | England; England adopted full-length NHS Standard Contract; trigger/category limited. This is not an unconditional letter after every attendance: the matter must necessitate prompt GP/referrer action. The row does not prescribe every social-care communication. | | **ENG-009** | Post Event Message after 111 care | 111 service provider → Patient GP where appropriate and consistent with guidance; relevant health/social-care provider to which the patient is referred | Applicable Delivery Method | By 8am next Operational Day after transfer/discharge | SC11.6A. **Contractual obligation**. [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | England; England adopted full-length contract, 111 service category. The GP appropriateness/guidance qualification and referral-recipient condition apply. This is not the same 24h rule as SC11.5. | | **ENG-010** | Key clinical information from GP records | Contracted provider arranging access for its staff → Staff providing urgent, emergency, unplanned care | SCR service or locally integrated electronic record supplemented by SCR | Ongoing capability | SC23.6. **Contractual availability obligation**. [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | England; England full-length contract; all service categories, subject to GC21. Access concerns key information, not the whole GP record, and remains subject to confidentiality/data protection under GC21 and actual authorised access. This does not itself impose each GP’s upload duty. | | **ENG-015** | Mandated CDS patient-level secondary-care activity datasets | In-scope NHS-funded secondary-care providers, AQPs and NHS private-patient units → NHS England via SUS+; the notice uses the former NHS Digital name | Secure SUS+ XML submissions using the current CDS types and schema | Ongoing. CDS v6.3 specifies weekly submission for types 020/120/130/140; other types and timetables vary. | Section 259(5) DPN; DAPB0092; contract Schedule 6/SC28; DPN pp3, 5–8; ISN pp1–3. **Statutory collection requirement and contractual reporting**. [SRC-011](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-011), [SRC-193](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-193), [SRC-194](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-194), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | England; England: NHS-funded independent activity and NHS private-patient units, rather than all wholly private care. The collection is distinct from direct care and researcher access. The older DPN links to v6.2 and historical bodies; apply the current types and timetable. ECDS is separate from CDS 6.3. Legally restricted information and exclusions remain relevant. | | **WAL-001** | Summary medications, allergies, adverse reactions and additional agreed/consented data within statutory definition | Welsh GMS contractor → Welsh GP Record and NHS Wales App through LHB-approved systems | Enable automated summary retrieval | When patient medical-record information changes | Welsh GMS 2023 regulation 29, Schedule 3 paragraph 79; Schedule 3 paragraph 79(1)–(3). **Statutorily prescribed contractual term**. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) | Wales; Welsh GMS contracts; WGPR retrieval for clinical use. Summary scope, not complete record or universal researcher access; additional data agreement/consent qualifications and lawful service permissions remain. | | **WAL-002** | Computerised registered-patient medical record on registration transfer | Sending/receiving Welsh GMS contractors → New/previous primary-medical-services provider | Secure direct electronic GP2GP transfer | As soon as possible; no later 28 days from outgoing-record request | Regulation 29, Schedule 3 paragraphs 78(6), 80; Schedule 3 paragraphs 78(6), 80. **Statutorily prescribed contractual term**. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) | Wales; Welsh GMS; temporary residents excluded from paragraph 80. Paper-only parts and unconfirmed safe transfers have fallback to LHB. Does not govern hospital discharge or every interagency sharing event. | | **WAL-003** | Mapped GP activity/appointment data | Welsh GMS contractor → Primary Care Information Portal and authorised extraction software | Maintain mapped appointments, keep categories current, server available for extraction | Server available at all times; review submission at least monthly | Welsh GMS 2023 regulation 23(1); regulation 23(1)(a)–(d). **Statutorily prescribed contractual term**. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) | Wales; Welsh GMS; planning/service-management flow. Exact authorised extract/data requirements remain necessary; not arbitrary third-party access to all patient records. Regulation 23(2) also requires collaborative discussion. | | **SCT-D01** | Eligible CGS patient ophthalmology record | Health Board → Authorised hospital/community CGS care users through Ophthalmology EPR | Update Ophthalmology Electronic Patient Record | Before Board provides information about accessing CGS | CGS (No.3) Directions 2026; Annex paragraph 22. **Statutory direction**. [SRC-216](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-216) | Scotland; Health Boards for eligible people not yet registered. Defined CGS eligibility; no universal hospital-discharge obligation | | **SCT-D02** | Letter informing eligible person of hospital-eye-service discharge and CGS registration | Relevant hospital eye service → Patient ophthalmology EPR, available to authorised care users | Upload issued letter to Ophthalmology Electronic Patient Record | Letter under paragraph 24; paragraph 25 has no separate numerical upload deadline | CGS (No.3) Directions 2026; Annex paragraphs 24–25. **Statutory direction**. [SRC-216](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-216) | Scotland; Hospital eye service within directed Health Board pathway. Only specified CGS discharge/registration letter; not every hospital discharge | | **SCT-D03** | Complete, accurate and current clinical records for registered CGS patient | Accredited CGS clinician → Ophthalmology Electronic Patient Record and authorised care users | Record only using Ophthalmology EPR | Keep up to date; no fixed hours specified | CGS Directions 2026 required clinician terms; Annex paragraph 14; schedule 4 paragraph 5. **Statutory direction requiring service terms; clinician bound through required accreditation terms**. [SRC-216](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-216) | Scotland; Board must require clinician terms on accreditation. Not universal EPR law; actual participation/accreditation required | | **SCT-D04** | Claim for a community glaucoma assessment | Accredited CGS clinician → National agency: Common Services Agency, now PSD Scotland | Electronic communication | Within 3 months of assessment | CGS Directions 2026 required clinician terms; Annex paragraph 14; schedule 4 paragraph 6. **Statutory direction requiring service terms; claim obligation in clinician terms**. [SRC-216](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-216) | Scotland; Board accreditation and participating clinician. Claim-submission condition, separate from clinical handover; does not itself require reporting every assessment irrespective of claiming. Current form is explained in the national service-report comparison | | **SCT-D07** | Electronic patient-record audit-function information necessary to verify operation | GMS contractor holding electronic patient records → Health Board | Access through computer-system audit function | As soon as possible following Board request | GMS Scotland Regulations 2018 prescribed contract terms; Schedule 6 paragraph 68(4). **Statutory prescribed contractual term**. [SRC-212](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-212) | Scotland; Scottish GMS practices with electronic records. Only to extent needed to confirm enabled/functioning audit, not blanket clinical browsing | | **NI-D01** | Computerised patient-record audit-function information necessary to verify operation | GMS contractor holding computerised records → Commissioning authority; read legacy Board references with 2022 transfer law | Access by means of audit function | As soon as possible after request | NI GMS Regulations 2004 prescribed contract terms; Schedule 5 paragraph 68(5). **Statutory prescribed contractual term**. [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221), [SRC-082](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-082) | Northern Ireland; NI GMS contractors with computerised patient records. Only extent needed to confirm audit function; no national care-summary/result upload obligation | ## Standards, access conditions and national mandates with qualifications These are relevant requirements or published mandates, but they do not all prove the same legal proposition. In particular, a saved have-regard standard is different from an unconditional statutory comply duty. A Welsh administrative circular or consensus standard is not labelled a proven statutory direction or executed contract where that legal route has not been established. An adopted contract or access agreement may add enforceable duties. | Requirement | Information and action | Responsible organisation → recipient | Digital method / standard | Timing | Authority and legal force | Nations, covered organisations and limits | |---|---|---|---|---|---|---| | **ENG-011** | Acute inpatient/day-case discharge correspondence to the GP | NHS acute trust or independent NHS-commissioned secondary-care provider → Registered GP practice system | DAPB4042: PRSB 2.1 content, FHIR STU3, ITK3 and MESH, with SNOMED CT/dm+d alignment | ISN full conformance: 31 October 2022. Specification R3 refers to implementation by 1 October 2022. | DAPB4042; section 250 saved regime; SC28.2.2 where applicable; ISN pp1–2; specification sections 1.3, 4, 5.1, R1–R6; SC28.2.2. **Saved statutory have-regard duty plus applicable contractual conformance; not a universal statutory duty to comply**. [SRC-185](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-185), [SRC-186](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-186), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | England; England: specified NHS-service provider and message scope. The ISN uses mandatory language, but SI 2025/807 preserves the older law. The GC definition says DAPB4042 may conform: that sentence alone neither proves mandatory conformance nor removes independent applicable SC28.2.2 obligations. This does not cover every outpatient, mental-health or social-care message. | | **ENG-012** | Laboratory pathology reportables/request codes and the supporting report | Laboratory/LIMS or middleware sender; receiving GP-system role → Requesting GP organisation | DAPB4101: pathology-specific UK Core FHIR R4/SNOMED via MESH | Original ISN: 30 April 2025. Later implementation material says an extension is forthcoming, without a replacement date. April 2027 is the pilot assurance target. | DAPB4101; section 250 saving; applicable contractual conformance; Specification sections 5–7; ISN; implementation plan. **Saved standard plus conditional contract requirement; unresolved conformance timetable**. [SRC-187](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-187), [SRC-188](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-188), [SRC-189](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-189), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | England; England laboratory-to-GP direct care: biochemistry, haematology, immunology, transfusion and microbiology. This is not evidence that all blood results already use FHIR. The initial standard does not mandate coded result values, interpretations, units or specimens, and excludes specified screening EDIFACT variants. Do not invent a replacement deadline or universal public availability. | | **ENG-013** | Clinical concepts in applicable electronic patient-level recording and communication | In-scope providers and systems communicating coded clinical data to GPs → Clinical recipient within the specified flow | SNOMED CT under the appropriate edition, refsets and applicable standard | GP: 1 April 2018. Specified other direct care: 1 April 2020. The notice gives no national social-care timetable. | SCCI0034 Amd 35/2016; section 250 saving; SC28.2.2 where applicable; ISN pp2–3. **Saved standard/conditional contract; semantic condition**. [SRC-191](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-191), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | England; English standard: the notice includes NHS, public-health and adult-social-care organisations, but expressly omits a social-care timetable. The standard mandates terminology within its covered use. It does not create an obligation to send every record or require every care home to adopt SNOMED. | | **WAL-005** | Information exchanged by NHS Wales IT and digital systems/services | NHS Wales bodies/system owners → Receiving digital system/service | FHIR foundational interoperability standard; UK Core basis; R4 suggested default; alternatives require WTSB approval | Compliance from June 2023 with staged maturity adoption | WHC 2023/018; Circular pp1–3. **Administrative standards mandate; statutory-direction/contract basis not identified**. [SRC-196](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-196) | Wales; All NHS Wales bodies; no universal wholly private/social-care statutory scope proved. A standard for exchange, not a duty to create every flow or disclose every record. Exact profiles and version needed; R4 is suggested default, not mislabelled as the only permitted release. | | **WAL-006** | Medication identity recorded and transferred between digital systems | LHB, NHS trust or Special Health Authority procuring/using/updating relevant system → Receiving digital system | dm+d at appropriate structural level; receive/process relevant codes | Immediate effect from 30 October 2024 | WHC 2024/042 implementation requirements; Implementation requirements in Wales. **Administrative standards mandate; not identified statutory direction**. [SRC-197](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-197) | Wales; NHS Wales LHBs, trusts, SHAs. Medical devices excluded from compliance; relevant medication use case only. Supplier actual contract not inspected; does not order all medical information shared. | | **WAL-007** | Medicines, allergies, intolerances exchanged across care locations | NHS Wales organisations, DHCW and commissioned system roles → Receiving trusted applications/systems | Welsh FHIR profiles, dm+d, SNOMED CT; procure and address supplier contracts for compliance | Procurement from 1 November 2022; remaining legacy/not-operational implementation by 31 July 2024 per notice | DSCN 2022/76 amended 22 May 2025; Actions pp4–5, scope pp6–7. **Administrative information mandate; actual supplier contractual term unknown**. [SRC-198](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-198) | Wales; NHS Wales and named partnership/contracted settings including relevant social care, nursing, hospice/private care delivering NHS contracts. Defines covered exchange; does not prove all private providers are bound or all flows must be created. Past deadline not proof of implementation; exact local contract remains unknown. | | **WAL-008** | Referral and outpatient communications | NHS clinician/organisation; private clinician interfacing with GP → Relevant referrer, GP and patient as applicable | Nationally or locally agreed electronic method WHERE EXISTS | Required communication/action timing depends event; no universal digital deadline established | WHC 2026/015 organisational standard 6; Scope p3; standard 6 p4. **Professional consensus interface standard; statutory/contractual enforceability not established**. [SRC-199](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-199) | Wales; NHS Wales GP↔health-board services; also expressly private clinicians interfacing with GP. Conditional agreed route essential. Do not classify consensus must as proven legislation or executed contract. Declined-referral 48h reference is separate planned-care guidance, not an all-letter deadline. | | **WAL-010** | Monthly validated Welsh Emergency Care Data Set | Local Health Board → DHCW | WECDS enhanced technical output specification and national data-flow arrangements | 10th calendar day monthly; full implementation 31 March 2027 | WHC 2026/031; Implementation mandate; monthly validated information. **Administrative national reporting mandate; not identified statutory instrument**. [SRC-048](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-048) | Wales; Every major ED/MIU operated/hosted by LHB; SDEC excluded in current phase. New 31 March 2027 implementation deadline replaces 1 April 2026. Transmission details separately communicated; future deadline not proof every site already live. | | **WAL-011** | Daily unvalidated Welsh Emergency Care Data Set | Local Health Board → DHCW | WECDS technical output and national transmission arrangements | Daily; full implementation 31 March 2027 | WHC 2026/031; Daily unvalidated information. **Administrative national reporting mandate**. [SRC-048](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-048) | Wales; Same major ED/MIU scope; operational oversight purpose. Provisional daily flow does not replace validated monthly submission; not a direct-care viewer entitlement. | | **WAL-012** | Core reference/patient demographic data within covered systems/exchanges | NHS Wales national/local system and procurement owners → Exchanging applications, including named WCP/WLIMS/WRRS/WCCIS environments | DSCN 2022/16 Core Reference Data Standards | Immediate procurement; specified national/local systems 1 April 2022; remaining qualifying systems 1 April 2023 | DSCN 2022/16; Scope/actions, p5. **Administrative information mandate**. [SRC-202](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-202) | Wales; NHS Wales architecture and relevant local exchanges/partnership systems. Harmonisation requirement; does not itself create a new clinical disclosure purpose or prove every site conforms. Verify exact current data items. | | **WAL-013** | NHS number handling and transmission | NHS and partner health/care organisations, relevant systems → Receiving applications/providers | Welsh NHS Number Operational Standard | Immediate procurement; 2018 national/PAS; 2020 remaining phases | DSCN 2015/06 and WHC 2015/049; DSCN pp1–2; WHC pp3–4. **Administrative information mandate; GMS statutory term separately identified**. [SRC-203](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-203), [SRC-204](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-204) | Wales; Bodies commissioning/providing health/care in partnership with NHS Wales, including relevant suppliers. Identifier standards do not require every clinical record digitally shared; current relevant implementation scope needs assessment. | | **WAL-014** | Governed shared electronic health/care-record access | Organisation seeking national-system access → Authorised individual workforce user | Signed Control Standard v5; legitimate purpose/local role, unique credentials, audit, access withdrawal | Before use; withdraw unneeded access immediately | Welsh Control Standard v5 sections 2, 6–8; sections 2, 6–8. **National-system participation/access condition**. [SRC-200](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-200) | Wales; Health boards/trusts and other national-system participants including GP contractors. No universal upload duty or override of confidentiality. Front approval/review dates and effective footer differ; v4 is historical. | | **SCT-D08** | ECS/KIS data and access audit records | Health Board governing exchange → Approved users/recipients under Directions | Encryption, appropriate training, individual credentials, audit/access reasons, rights processes, current accurate dataset | Continuing controls when processing under Directions | ECS/KIS Directions 2023; Paragraph 6(a)–(h). **Statutory direction**. [SRC-211](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-211) | Scotland; Health Boards. Care/recipient/purpose boundaries in paragraphs 3–5 and data protection remain | | **NI-P01** | Quarterly aggregate hospital bed use and specified non-acute activity (KH03a) | HSC Trusts → Department of Health statistical branch | Electronic aggregate templates; published timetable gives Department email route | Quarterly; September 2026 quarter: 19 October 2026. Future quarters use their own timetable. | 1991 Order Schedule 3 paragraph 8 and Department collection instructions. **Statutory reporting framework; particular digital legal linkage qualified**. [SRC-280](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-280), [SRC-281](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-281), [SRC-282](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-282), [SRC-283](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-283) | Northern Ireland; Trust duty. Independent-sector beds and non-consultant-led activity excluded. Public collection documents do not expressly invoke paragraph 8; email instruction uses should. No freestanding statutory email-only command established. | ## Information duties that do not independently require digital delivery These provisions are legally significant. Their wording does not establish the claimed digital-only sending obligation. Writing, an electronic option, an identifier condition or a ministerial policy duty must not be converted into a universal provider upload duty. | Requirement | Information and action | Responsible organisation → recipient | Digital method / standard | Timing | Authority and legal force | Nations, covered organisations and limits | |---|---|---|---|---|---|---| | **ENG-014** | Patient NHS number on clinical correspondence and datasets | GP contractor; contracted provider in the relevant roles → Other healthcare providers, referrers or dataset recipient | Use the NHS number as the primary/consistent identifier in digital or paper correspondence | Ongoing; the GP exception applies where the number cannot be ascertained for reasons outside the contractor’s control | GMS 70; PMS 63; SC23.4/23.5; SC28.2.5; GMS 70; PMS 63; SC23.4/5; ISB0149-02 amendment. **Statutorily prescribed term/contractual identifier condition; not a digital-only mandate**. [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-190](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-190) | England; Relevant England contracts; the legacy secondary-care standard has its own conditional scope. An identifier requirement does not itself order disclosure or choose the medium. The legacy amendment relaxed verified-only transmission restrictions; retain that distinction. | | **WAL-004** | NHS number as primary identifier in clinical correspondence | Welsh GMS contractor → Other health-service provider | Include NHS number; electronic OR other written correspondence | On issue | Regulation 29, Schedule 3 paragraph 81; Schedule 3 paragraph 81. **Statutorily prescribed identifier term; medium neutral**. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) | Wales; Welsh GMS correspondence; exception if number cannot be ascertained outside contractor control. Does not itself require digital sending; do not equate identifiers with authority to disclose. | | **WAL-016** | Specified causative-agent lab notification and defined associated information | Operator of diagnostic laboratory → Proper officer of relevant local authority | Writing required; electronic communication permitted under regulation 7 conditions | Within 7 days of identification; urgent oral notification as soon reasonably practicable | Health Protection (Notification) (Wales) Regulations 2010 regs 4, 7; regulations 4, 7. **Binding statutory notification; medium-neutral negative control**. [SRC-205](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-205) | Wales; Welsh public/private diagnostic laboratories; defined scope/exceptions. Recipient written consent/address conditions for electronic route. Not all blood results, not digital-only; special 4A–4D provisions need separate scope analysis. | | **SCT-D05** | ECS; existing KIS where patient has one | Health Board requests; GMS/section 17C contractor responds under applicable terms → Requesting Board; further recipients subject to paragraphs 4–5 | Board chooses appropriate request/access means, including electronic | When necessary for care/treatment; Directions do not specify update/upload interval | ECS/KIS Directions 2023; Paragraph 3(1)–(3), schedules 1–2. **Statutory direction plus prescribed contract response**. [SRC-211](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-211), [SRC-212](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-212) | Scotland; Directed Boards and defined NHS GP contractors. KIS only where exists; necessity/purposes, data protection, separate GMS/PMS requirements; further access uses may not must | | **SCT-D06** | Qualifying practice/patient data or other reasonably required information | GMS contractor → Health Board or appropriately authorised recipient | Produce/disclose or allow access; computer/electronic means included | For paragraph 69(1)(b) production/disclosure: agreed reasonable date, otherwise 28 days | GMS Scotland Regulations 2018 prescribed contract terms; Schedule 6 paragraph 69(1)–(5). **Statutory prescribed contractual term**. [SRC-212](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-212) | Scotland; Scottish GMS contractors; Board functions and required directions. Request must satisfy legal conditions/directions and specified diagnosis/care, planning/management or contract purpose; timing must not be generalised to every request | | **SCT-D09** | Known name/address/sex/date of birth/NHS identifier and identified notifiable organism | Director of diagnostic laboratory → Recipients specified in section 16(5): territorial Board, Common Services Agency/PSD Scotland and Public Health Scotland | Writing; reproducible electronic document may satisfy writing; urgent additional oral notification | Written within 10 days beginning identification; urgent oral as soon as reasonably practicable | Public Health etc. (Scotland) Act 2008; Section 16(1)–(6), (8)–(10); section 18(1)–(2). **Primary statutory notification duty**. [SRC-214](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-214) | Scotland; Defined diagnostic laboratories identifying notifiable organisms. Only listed notifiable organism trigger; known data; not every routine blood result; current lists/instruments needed for condition-specific use | | **NI-D02** | Information reasonably required for contract or authority functions | GMS contractor → Authority or person authorised in writing | Produce or permit access following a request under applicable Department directions | Agreed reasonable date; otherwise 28 days | NI GMS Regulations 2004 prescribed contract terms; Schedule 5 paragraph 72. **Statutory prescribed contractual term**. [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221), [SRC-082](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-082) | Northern Ireland; NI GMS contractors. Actual Department direction/request required; cannot infer that every research/planning request is compulsory | | **NI-D03** | Consultation and treatment clinical report for qualifying patient outside practice list | GMS contractor → Authority, then usual provider or relevant authority | Provide clinical report; no digital-only mode | As soon as reasonably practicable | NI GMS Regulations 2004 prescribed contract terms; Schedule 5 paragraph 7. **Statutory prescribed contractual term**. [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221) | Northern Ireland; NI GMS contractor providing qualifying non-private services. Excludes private arrangements and stated out-of-hours services exception; not a general hospital discharge rule | | **NI-D04** | Patient name/age/sex/address, examination address and suspected/diagnosed notifiable disease | Attending medical practitioner → Director of Public Health | Send statutory certificate; no express digital transmission requirement in section 2 | As soon as aware or has reasonable grounds for suspicion | Public Health Act (NI) 1967; Section 2(1)–(3). **Primary statutory notification duty**. [SRC-215](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-215) | Northern Ireland; Attending medical practitioners; subsection 2 hospital exceptions. Not every laboratory result; disease lists and statutory exceptions matter; must not import English laboratory reporting regulations | | **SCT-D12** | Integrated digital care records as statutory policy objective | Scottish Ministers → Recipients of health care/social services through future framework | Exercise powers to enable digital integrated records | Section 1 operative 7 January 2026; sections 2–7 recorded prospective at cutoff | Care Reform (Scotland) Act 2025; Section 1; previously checked Part 1 status. **Primary statutory ministerial duty**. [SRC-064](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-064), [SRC-111](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-111) | Scotland; Ministers; not blanket provider connection command. No operative provider scheme, standards or sharing requirement inferred from prospective sections | ## Operational routes, recommendations and local procedures These rows explain how the worked examples function or identify a published local requirement. They remain separate from verified national statutory/contractual digital duties. An existing interface, service manual or procurement notice does not by itself prove an all-provider legal mandate. | Requirement | Information and action | Responsible organisation → recipient | Digital method / standard | Timing | Authority and legal force | Nations, covered organisations and limits | |---|---|---|---|---|---|---| | **WAL-009** | Electronic discharge advice letter and patient copy | Discharging service → GP/continuing-care recipient and patient | eDAL with patient copy | Recommended at discharge | WHC 2026/015 standard 9; standard 9 p5. **Professional consensus recommendation; not proven binding digital mandate**. [SRC-199](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-199) | Wales; Clinical-interface scope above. Do not elevate should to must; no universal API/deadline for every community/social-care recipient established. Actual local contracts/protocols unknown. | | **WAL-015** | Clinical terminology in relevant programmes/projects | NHS Wales LHBs, trusts, GPs and successor national digital roles → Clinical systems/users | SNOMED CT in relevant programmes/projects | 2015 policy; no universal acute/community migration deadline in circular | WHC 2015/053; p2. **Policy expectation; not a proven universal 2026 digital-transmission duty**. [SRC-201](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-201) | Wales; NHS Wales relevant projects/programmes. Original circular acknowledged no acute/community implementation programme; more specific medicines DSCN has its own current exchange scope. | | **SCT-D10** | Clinical document type/subtype metadata | Clinical-system/document owners → Receiving clinical systems, particularly across Boards | EH4001 v5 document indexing | Prospective recommended use; revalidation sought March 2028 | HBDL/PHS official standard; Page 3 compliance field; sections 3.1–3.3. **Recommended technical standard**. [SRC-213](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-213) | Scotland; Scottish clinical systems in published scope. Separate adopting instrument/contract required to establish binding scope, deadlines and recipients | | **SCT-D11** | Care-relevant research study information in NHS Lothian EPR | Investigator or designee / study team → NHS Lothian clinical EPR and authorised care staff | Direct TRAK entry or authorised verified paper scanning into SCI Store | Throughout study as information pertinent to clinical care arises; no fixed hour limit | ACCORD AD001 v5.0 local SOP; Sections 4.1–4.2 and 5.1.1–5.1.6. **Local research procedure; contract/regulatory linkage application-specific**. [SRC-224](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-224) | Scotland; Investigators/study teams entering participant information into NHS Lothian EPR. Study protocol and applicable law separate; no universal research extraction/redisclosure gateway; local SOP current-version check required | | **NI-D05** | Request and minimum identifying/sample information for haematology examination | Belfast laboratory user; encompass user where applicable → Belfast Trust laboratory | Correctly complete encompass sample collection to generate electronic request; other users follow manual request routes | At request/sample submission; otherwise minimum acceptance criteria unmet | Belfast H-416v28.0 service procedure; Pages 13–15, service agreement and minimum acceptance criteria. **Published local service conditions; executed contractual effect not independently established**. [SRC-218](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-218) | Northern Ireland; Users of named laboratory service. Local service requirement, not NI-wide statute or every-request digital mandate; actual accepted service terms matter | | **NI-D06** | Validated haematology/blood-bank results | Belfast Trust laboratory → Hospital clinical users through EPIC; individual GP practice systems by EDI | EPIC availability after validation; GP EDI download | After validation; test-specific turnaround guidance, no universal statutory deadline established | Belfast H-416v28.0 service procedure; Pages 22–23 availability of results. **Operational evidence and published service procedure**. [SRC-218](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-218), [SRC-225](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-225) | Northern Ireland; Named laboratory and its users. Does not establish all NI labs, all recipient systems, automatic clinician action or My Care release | | **NI-D07** | Secondary-care clinical correspondence arriving at GP practices | Secondary-care document sources → NI GP practice document workflows | Most by Electronic Document Transfer; other sources paper and practice scanning | Notice gives no universal digital-discharge deadline | BSO Docman10X transparency notice 2025/S000-059307; PDF pages 1–2, scope description. **Procurement description of service operation**. [SRC-219](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-219) | Northern Ireland; Workflow described for NI GP practices. Not executed contract, all-provider mandate or completed Docman10X deployment proof | | **NI-D08** | Admissions/discharges/referrals and some test results documented in encompass | Trust record/service participants → Approved professionals through EpicCare Link | Read-only core-record portal plus defined limited actions | No universal upload frequency/result deadline established by page | DHCNI operational service page; EpicCare Link published service description. **Operational service information**. [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220) | Northern Ireland; GPs and other approved professionals; new users via Site Administrators. Actual user permissions, record coverage and source duties separate | | **NI-D09** | Selected encompass information, appointments and released results | DHCNI/Trust patient portal → Patient and approved proxy according to service permissions | Optional My Care website/app | Some results automatically released, others after clinician action | DHCNI patient service page; My Care access/important information sections. **Operational patient-service guidance**. [SRC-225](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-225) | Northern Ireland; Portal users within available secondary-care scope. Excludes GP records/GP-arranged results and currently social-care display; data rights independent | | **SCT-P01** | General/acute inpatient and day-case episode data (SMR01) | NHS Boards → Public Health Scotland | Electronic SMR records through eSMR, using the published layout and validation | **Target:** 42 days after end of discharge month; September 2026 data cutoff 6pm 11 November 2026 | PHS dataset, rules, specification and 2026 timetable. **Verified operational collection and target; binding SMR-specific legal chain unverified**. [SRC-270](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-270), [SRC-271](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-271), [SRC-272](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-272), [SRC-273](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-273) | Scotland; includes contracted NHS beds in non-NHS institutions. Population coverage does not prove which private provider must submit directly. No statutory digital channel or six-week legal deadline inferred from routine reporting or a general cooperation power. | ## Using the register England service-category codes in the contract remain the source's applicability codes; read the actual contract and service schedules. The full-length contract is the published reference version, not proof of an unseen provider's adopted agreement. GP and other-recipient Delivery Methods differ. Digital receipt does not prove clinical review or action. The three worked examples are [SCR and equivalent records](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/summary-care-records/index.md), [blood tests and results](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/blood-tests-results/index.md) and [hospital discharge](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/hospital-discharge/index.md). The [capacity and representative-authority map](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/capacity-and-representation/index.md) addresses care, disclosure and proxy access at discharge. [How to read a requirement](https://uk-digital-healthcare-legal-requirements.pages.dev/requirements/index.md), [national comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/comparison/index.md), [source register](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md) and [validation queue](https://uk-digital-healthcare-legal-requirements.pages.dev/validation-queue/index.md) provide the supporting analysis.