<!-- Derived Markdown alternate of evidence-matrix.md; canonical repository sources and registered evidence retain authority. -->


# Evidence matrix

The central question is what healthcare information organisations must send digitally or make digitally available. Individual care is primary; planning, research and public-health flows are also included. The [digital requirements table](https://uk-digital-healthcare-legal-requirements.pages.dev/digital-requirements/index.md) records **56 core rows**, with protection exchanges separately assessed in the [companion catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/protection-requirements/index.md). The core records comprise: **22 confirmed digital obligations, 14 qualified standards/access mandates, 10 information duties without an independent digital-delivery requirement, and 10 operational or recommended routes**. These are classifications of this verified catalogue, not universal coverage claims.

The grouped claims below support that table and the four-nation examples. Statutory duties, prescribed contract terms, adopted contracts, administrative mandates, guidance and service operation retain their distinct force. Supported does not approve a live disclosure or establish an unseen contract.

## Digital sending and availability

| Claim | Support | State | Limitation |
|---|---|---|---|
| UK GDPR provides conditional electronic subject-access copies and machine-readable portability, rather than a universal live patient portal. | [SRC-260](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-260), [SRC-261](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-261), [SRC-173](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-173) | Supported conditional statutory digital duties | Article 15 copy, Article 20 scope and Articles 12/12A conditions differ; public-task processing is excluded from portability. |
| English GMS/PMS terms require defined SCR uploads, GP Connect configuration, GP2GP transfer and patient online access. | [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184) | Supported statutory prescribed contract terms | Regulation-specific computerised-record, patient, timing, exclusion and request conditions; not every wholly private GP or APMS arrangement. |
| The adopted English full-length NHS Standard Contract requires scoped discharge and clinic-letter digital delivery, with recipient-specific methods and deadlines. | [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | Supported published contractual obligations | Actual contract/service categories required; SC11.5 uses GP and/or other referrer; GP automatic transfer differs from permitted other-recipient email. |
| English SC23.6 requires staff providing urgent, emergency and unplanned care to have defined GP-information viewing capability. | [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | Supported contractual availability obligation | Key information through SCR or supplemented integrated record; confidentiality, authorised access and actual contract apply. |
| SI 2025/807 preserves the older statutory have-regard framework for information standards already in effect before 7 July 2025. | [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192), [SRC-008](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-008), [SRC-009](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-009) | Supported statutory saving | A notice’s mandatory wording is not an unconditional new statutory comply duty; applicable contractual conformance remains separate. |
| DAPB4042 specifies a scoped acute-discharge content/transport approach; its notice and applicable contract obligations must be read together. | [SRC-185](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-185), [SRC-186](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-186), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | Supported standard and qualified contractual route | Saved have-regard regime; general contract definition alone says may conform. ISN 31 October 2022 and specification 1 October wording remain distinguished. |
| DAPB4101 defines laboratory-to-GP pathology reporting, but its original notice and later implementation plan have an unresolved conformance timetable. | [SRC-187](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-187), [SRC-188](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-188), [SRC-189](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-189), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | Supported scoped standard; deadline unresolved | Do not infer completed national FHIR rollout or replace 30 April 2025 with April 2027 pilot assurance. Await an authoritative replacement ISN/date. |
| English SNOMED and NHS-number requirements govern meaning and identification within their scope, without creating every clinical disclosure. | [SRC-190](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-190), [SRC-191](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-191), [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-184](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-184), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192) | Supported prescribed terms, contract and saved standards | Paper correspondence can carry NHS number; the SNOMED notice gives no national social-care implementation timetable. |
| The CDS Data Provision Notice requires defined secondary-care collections through SUS+, with specified electronic manner and current dataset/timetable qualifications. | [SRC-011](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-011), [SRC-193](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-193), [SRC-194](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-194), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | Supported statutory collection and contractual reporting | NHS-funded independent activity and NHS private-patient units are scoped; not every wholly private episode or unrestricted researcher access. |
| Welsh GMS terms require summary retrieval, GP2GP and activity/appointment extraction, with separate information and identifier conditions. | [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) | Supported statutorily prescribed contractual terms | Current amended Welsh regulations, not English GMS rules; temporary-resident, summary, timing and contractor boundaries remain. |
| Welsh FHIR and dm+d circulars prescribe administrative exchange conditions for covered NHS Wales systems. | [SRC-196](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-196), [SRC-197](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-197) | Supported administrative standards mandates | Statutory-direction or executed-contract basis is not established by the circular alone. Exchange conditions do not require every possible flow; devices excluded from the dm+d compliance scope. |
| Welsh DSCN2022/76 addresses medicines/allergy exchanges, procurement and affected supplier contracts across defined NHS and commissioned settings. | [SRC-198](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-198) | Supported administrative information mandate | Amended 22 May 2025; named private/social-care NHS-contract contexts, not universal self-pay scope. An unseen executed supplier/provider contract remains unknown. |
| Welsh reference-data and NHS-number notices set scoped harmonisation conditions; the 2015 SNOMED circular records policy expectations. | [SRC-202](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-202), [SRC-203](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-203), [SRC-204](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-204), [SRC-201](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-201) | Supported administrative notices and distinct policy expectation | No new disclosure gateway or universal digital-send duty. Exact recipients, phases, current data items and local adoption remain material. |
| The 2026 Welsh clinical-interface standards distinguish mandatory-language agreed referral routes from a should recommendation for electronic discharge advice. | [SRC-199](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-199) | Supported professional consensus standard; legal enforceability not established | Do not elevate consensus wording into a statutory direction or assumed executed contract. eDAL recommendation has no proven universal digital deadline. |
| Welsh Control Standard version 5.0 is the current identified shared-record access baseline; version 4 is historical. | [SRC-200](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-200), [SRC-046](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-046) | Resolved version identification; supported participation/access conditions | Front approval/review dates and effective footer differ. Actual organisational adoption and access terms remain service-specific; no universal upload duty. |
| WHC 2026/031 requires daily unvalidated and monthly validated WECDS returns, with full implementation by 31 March 2027. | [SRC-048](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-048) | Supported administrative national reporting mandate | Major emergency departments/minor injury units operated or hosted by LHB; current phase excludes SDEC. Future deadline does not prove completed rollout. |
| Current Scottish CGS (No.3) Directions require a defined pre-transfer EPR update and hospital discharge-letter upload; required clinician terms specify EPR recording and electronic claims. | [SRC-216](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-216) | Supported statutory directions and required service terms | Effective 1 November 2026 apart from fees. Defined CGS patient/accreditation scope, not every hospital/private discharge; claims have a separate three-month deadline. |
| Scottish ECS/KIS Directions and GMS terms require qualifying care requests and responses, with controlled further access and specific safeguards. | [SRC-211](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-211), [SRC-212](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-212), [SRC-217](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-217) | Supported directions and statutory prescribed contractual terms | Electronic means are included rather than exclusive. KIS only where it exists; paragraph 4 further access is permissive/conditional. The 2025 clarification retains applicable law and professional judgement. |
| Scottish and NI GMS terms require audit-function access where records are electronic/computerised. | [SRC-212](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-212), [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221), [SRC-082](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-082) | Supported conditional statutory prescribed contractual access terms | Access verifies the audit function, as soon as possible after request; not unrestricted care browsing. NI legacy Board references require the 2022 transfer framework. |
| Scottish EH4001 v5 recommends prospective clinical-document indexing; the document alone does not establish a universal statutory sending obligation. | [SRC-213](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-213) | Supported recommended technical standard | Separate adopting direction or contract must establish binding recipients, timing and scope. |
| NI result delivery, EDT correspondence and portals, and Scottish onboarding/research EPR procedures establish specific services or local practices. | [SRC-218](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-218), [SRC-219](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-219), [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220), [SRC-222](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-222), [SRC-223](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-223), [SRC-224](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-224), [SRC-225](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-225), [SRC-226](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-226) | Supported operational evidence, recommendations and local procedures | No automatic national statute/executed contract inferred. Belfast service conditions are local; Paperlight policy retains legacy wording; My Care excludes GP-requested results and current social-care display. |
| National public-health notification provisions require defined information and timing without a universal digital-only rule for ordinary blood results. | [SRC-214](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-214), [SRC-215](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-215), [SRC-205](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-205), [SRC-262](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-262) | Supported statutory notification duties; medium limits retained | Scottish/Welsh electronic options and urgent oral duties differ from NI practitioner certificates and England’s scoped laboratory rules. Current lists and special provisions still matter. |

## National service reports

The [four national examples](https://uk-digital-healthcare-legal-requirements.pages.dev/national-service-reports/index.md) explain required activity and payment reporting in plain language.

| Claim | Support | State | Limitation |
|---|---|---|---|
| The chosen English outpatient CDS type 020 has weekly electronic reporting and defined independent-provider/private-patient-unit scope. | [SRC-193](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-193), [SRC-194](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-194), [SRC-290](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-290), [SRC-292](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-292) | Supported statutory collection and current digital implementation | Actual CDS type, release and timetable matter; not all self-pay independent care. |
| Current CDS release information retains v6.2 maintenance alongside v6.3. | [SRC-293](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-293) | Supported current publication status | No universal v6.2 retirement or exact provider schema patch is inferred. |
| Welsh regulation 23 practice duties differ from the national system’s extraction cadence. | [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195), [SRC-294](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-294) | Supported prescribed terms and separately attributed operations | Server availability and monthly review are legal contractual requirements; daily/tenth-of-month extraction does not create an extra statutory upload deadline. |
| CGS assessment claims require electronic submission within three months through direction-prescribed clinician terms. | [SRC-216](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-216), [SRC-274](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-274) | Supported conditional claim requirement and current implementation | Claim trigger and accreditation limits apply. Current form fields are not an exhaustive statutory field list; this is not all-hospital activity reporting. |
| NI KH03a is a required quarterly Trust report with electronic aggregate collection instructions and period-specific submission dates. | [SRC-280](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-280), [SRC-281](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-281), [SRC-282](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-282), [SRC-283](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-283) | Supported reporting framework and administrative collection; specific digital legal linkage qualified | The statute is medium-neutral and collection documents do not expressly invoke it. Email instruction uses should. Independent-sector beds excluded; no generic deadline for all quarters. |
| PHS documents electronic SMR01 reporting, NHS contracted-bed coverage and a 42-day target with monthly cutoffs. | [SRC-270](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-270), [SRC-271](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-271), [SRC-272](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-272), [SRC-273](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-273) | Supported operational route and target; binding collection authority unresolved | No SMR-specific duty to use the digital route or meet a six-week legal deadline is inferred; no universal direct private-provider duty established. |

## Capacity, children and representative authority

The [bounded discharge map](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/capacity-and-representation/index.md) now covers all four nations. Its completion resolves the previously open baseline map; individual cases, court disputes and additional liberty/safeguarding regimes retain their limits.

| Claim | Support | State | Limitation |
|---|---|---|---|
| Care/discharge decisions, disclosure for continuing care and representative digital access are separate legal questions. | [SRC-241](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-241), [SRC-244](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-244), [SRC-174](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-174), [SRC-172](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-172) | Supported legal distinction with implementation synthesis | The authority map supports the defined discharge scenario; no universal capacity-message dataset or automatic proxy entitlement is created. |
| England/Wales MCA capacity, support and best-interests rules differ from treatment-consent age and under-16 competence. | [SRC-241](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-241), [SRC-242](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-242), [SRC-243](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-243), [SRC-254](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-254), [SRC-255](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-255) | Supported current statutory/professional framework | Decision-specific assessment, actual parental status/orders and confidentiality remain; birthday alone does not resolve refusal disputes. |
| England/Wales LPA and deputy authority depends on age, registration/order, scope and activation conditions. | [SRC-241](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-241), [SRC-244](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-244) | Supported current law and official disclosure guidance | LPA donor must be 18 or over; relevant information for the role differs from unrestricted records or a SAR. Property/affairs authority is not welfare authority. |
| Welsh Part 10 advocacy requirements support participation when the Code’s conditions are met. | [SRC-263](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-263) | Supported statutory-code requirement within stated conditions | Independent professional advocacy is not a general substitute-consent power or all-record access entitlement. |
| Scottish AWI principles, welfare powers and treatment certification have distinct scopes. | [SRC-245](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-245), [SRC-246](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-246), [SRC-259](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-259) | Supported current Scottish law/guidance | Adult threshold 16; section 47 treatment certificate does not settle every residence/discharge decision; inspect grant/order and section 50 disagreement route. |
| Scottish general capacity and the under-16 medical-consent route differ from parental responsibilities and representation. | [SRC-247](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-247), [SRC-248](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-248), [SRC-254](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-254), [SRC-255](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-255) | Supported current statutory/professional framework | General capacity 16; understanding of particular treatment matters below 16. Most listed parental responsibilities concern under 16, guidance continues to 18; confidentiality remains. |
| NI MCA 2016 is partly implemented; the LPA/deputy provisions identified in this map remain prospective. | [SRC-249](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-249), [SRC-250](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-250), [SRC-253](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-253), [SRC-258](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-258) | Supported current text and corroborating official status | Sections 97–99 and 116 are not used to invent current welfare authority. Existing EPA concerns property/affairs; ordinary care authority and liberty restrictions need their applicable route. |
| NI treatment consent at 16/17 and Children Order parental responsibility do not establish unlimited disclosure or portal access. | [SRC-251](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-251), [SRC-252](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-252), [SRC-254](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-254), [SRC-255](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-255), [SRC-258](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-258) | Supported current statutory/professional framework | Competence, actual status/orders, relevant interests and disputes require assessment; do not import English/Welsh MCA rules. |
| DPA 2018 section 208 supplies the Scottish understanding test and rebuttable age-12 presumption for the specified data-protection rights/consent. | [SRC-257](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-257), [SRC-256](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-256) | Supported current statutory distinction | Not a universal treatment-consent age, automatic parent access or product age rule; historical guidance footnotes do not replace current law. |
| Representative information, electronic subject access and implementation access controls have distinct scope. | [SRC-244](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-244), [SRC-260](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-260), [SRC-173](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-173), [SRC-172](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-172), [SRC-255](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-255), [SRC-258](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-258) | Supported legal framework and bounded digital synthesis | Verify identity, powers, information need and restrictions; permissions, attribution and review controls are synthesis rather than an invented statutory interface standard. |

## Legal framework supporting the digital flows

| Claim | Support | State | Limitation |
|---|---|---|---|
| UK health-data processing normally requires an Article 6 basis plus an Article 9 condition. | [SRC-001](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-001), [SRC-002](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-002), [SRC-003](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-003) | Supported legal framework | Purpose, necessity, safeguards and current amendments still need assessment. |
| Organisational authority and confidentiality are distinct from UK GDPR lawfulness. | [SRC-005](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-005), [SRC-006](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-006), [SRC-025](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-025) | Supported analytical distinction | A project must identify its own function and specific disclosure route. |
| Current Article 6 includes recognised legitimate interests; public-authority task processing is excluded from ea/f. | [SRC-001](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-001), [SRC-029](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-029) | Supported current law | Not a shortcut to routine healthcare reuse; Article 9 remains separate. |
| Public-authority acts engage Convention compatibility duties. | [SRC-004](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-004) | Supported statutory framework | Private-provider public-function status is fact-specific; full rights analysis not completed. |
| England s251B sharing duty preserves data protection and common-law confidence. | [SRC-010](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-010) | Supported exact text | Defined persons, individual care, best interests, objections and other exceptions limit the duty. |
| England standards framework covers specified providers and relevant IT suppliers. | [SRC-008](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-008), [SRC-009](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-009), [SRC-014](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-014), [SRC-015](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-015), [SRC-016](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-016) | Supported framework | Actual notice, version, duty, transition and deadline must be checked. |
| CQC-regulated providers have records and governance duties. | [SRC-018](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-018) | Supported regulation/guidance | England registered-activity scope; does not mandate a particular EPR. |
| Welsh DHCW functions are assigned by directions which preserve other disclosure prohibitions. | [SRC-041](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-041), [SRC-042](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-042), [SRC-043](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-043) | Supported directions | Institutional function does not itself lift confidentiality. |
| WASPI documents sharing governance rather than creating a general power. | [SRC-045](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-045) | Supported framework | Direct source availability intermittent; adoption and underlying legal bases matter. |
| Welsh notices and shared-record access conditions have their own scope. | [SRC-200](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-200), [SRC-047](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-047) | Supported administrative and participation instruments | Control Standard version 5 is identified; exact notice, organisational adoption and local access terms still matter. |
| Welsh independent-care regulation has records and policy duties. | [SRC-050](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-050), [SRC-051](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-051) | Supported regulatory framework | Service category and current amendments matter; code historical references may be stale. |
| Scottish integration sharing power has a bounded confidentiality override. | [SRC-062](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-062) | Supported exact statutory route | Recipients and integration purposes constrain the power; not every shared record qualifies. |
| Scottish Care Reform section 1 commenced on 7 January 2026; sections 2–7 are recorded prospective at 3 November 2026. | [SRC-063](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-063), [SRC-064](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-064), [SRC-111](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-111), [SRC-112](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-112) | Supported section-specific current legal status | Current official revised record and complete effects table support the position; reopen on a new instrument or changed status. |
| Enacted Scottish powers do not establish an operative Part 1 sharing scheme or statutory standard. | [SRC-111](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-111), [SRC-112](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-112), [SRC-113](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-113) | Supported legal consequence and bounded implementation check | Sections 2–7 are prospective; distinguish programme plans and other national standards from instruments under these powers. |
| Scottish public records and patient-rights regimes add duties in their scope. | [SRC-067](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-067), [SRC-070](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-070) | Supported framework | Do not apply all NHS/public-authority duties automatically to wholly private services. |
| Article 8 requires clear safeguards for intrusive information sharing. | [SRC-072](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-072) | Supported case-law principle | The case concerned named-person provisions; it is not a ban on lawful safeguarding. |
| NI HSC organisational structure reflects 2022 transfer changes. | [SRC-081](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-081), [SRC-082](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-082) | Supported statutory framework | Historical references to the former Regional HSC Board require care. |
| NI DHCNI/encompass programme does not itself supply every disclosure gateway. | [SRC-083](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-083), [SRC-086](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-086), [SRC-087](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-087) | Supported institutional/governance distinction | Confirm the actual policy, legal route, controller and recipient. |
| NI private-provider records and NIS oversight have local regimes. | [SRC-088](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-088), [SRC-089](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-089), [SRC-090](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-090) | Supported framework | RQIA establishment scope and NIS operator designation matter. |
| Existing DCB notices and enhanced future standards powers must be distinguished. | [SRC-101](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-101), [SRC-102](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-102), [SRC-103](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-103) | Supported June 2026 official clarification | Specific notice, organisation and contract govern applicability. |
| Public-sector accessibility rules coexist with reasonable-adjustment duties. | [SRC-019](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-019), [SRC-092](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-092) | Supported official framework | NI uses distinct disability law; exemptions and service facts must be checked. |
| Health Bill reforms were prospective at baseline. | [SRC-017](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-017) | Supported parliamentary status | Check later stage, final text and commencement before operational use. |
| Article 5 applies purpose, minimisation, accuracy, security and accountability requirements to care sharing. | [SRC-171](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-171) | Supported current framework | Care purpose does not establish unrestricted access or later reuse. |
| Controller, joint-controller and processor responsibilities continue on shared digital platforms. | [SRC-172](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-172) | Supported current framework | Actual roles govern; Articles 25, 28, 32 and 35 have distinct conditions. |
| Patient transparency, access, correction and other rights remain relevant to care sharing. | [SRC-173](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-173) | Supported current framework | Each right and exception must be read in current amended law. |
| GMC implied-consent guidance for direct care has defined conditions and an unexpected-sharing qualification. | [SRC-174](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-174) | Supported current framework | Professional guidance for its registrants; national law and interagency guidance remain relevant. |
| NMC and HCPC professional standards connect appropriate sharing with confidentiality and safe care. | [SRC-175](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-175), [SRC-176](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-176) | Supported current framework | Applies to respective registrants; these codes do not create a general statutory gateway. |
| Section 251B must be read with section 251C definitions and the 2015 exclusions. | [SRC-010](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-010), [SRC-141](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-141), [SRC-143](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-143) | Supported current framework | Defined care in England, relevant persons, direct facilitation and exceptions determine scope. |
| Independent-provider coverage under section 251C depends on public arrangements for the relevant care. | [SRC-141](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-141) | Supported current framework | CQC registration alone does not bring every self-pay activity within section 251B. |
| Section 251A imposes a qualified consistent-identifier duty. | [SRC-142](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-142) | Supported current framework | Care purpose, best interests, objections, exclusions, data protection and confidence remain material. |
| NHS Act section 82 establishes cooperation duties in England and Wales. | [SRC-144](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-144) | Supported current framework | Organisational cooperation is not unrestricted patient-record disclosure. |
| Care Act sections 6 and 7 establish England adult-care cooperation duties. | [SRC-145](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-145), [SRC-146](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-146) | Supported current framework | Actor/function scope and specific-case exceptions remain relevant. |
| Welsh section 164 information responses and section 165 integration duties are conditional. | [SRC-147](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-147), [SRC-148](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-148) | Supported current framework | Direction of request, recipients, conflicting duties and statutory conditions matter; not an EPR mandate. |
| Welsh Local Health Board functions are assigned through the applicable statutory framework and directions. | [SRC-149](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-149), [SRC-041](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-041), [SRC-042](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-042) | Supported current framework | A platform function does not by itself override disclosure restrictions. |
| Scottish NHS section 13 requires listed bodies to cooperate in exercising their functions. | [SRC-151](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-151) | Supported current framework | Does not create unrestricted disclosure of patient records. |
| Scottish patient-rights principles reach relevant NHS bodies and qualifying contracted care. | [SRC-152](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-152) | Supported current framework | Section 5 imposes NHS-body duties concerning contracted providers; not automatic coverage of wholly private care. |
| Scottish national patient information and records guidance explain purposeful care sharing and digital safeguards. | [SRC-153](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-153), [SRC-154](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-154) | Supported current framework | Patient explanation and governance guidance do not create a new unlimited statutory gateway. |
| NI Code distinguishes multidisciplinary sharing from planned involvement of other agencies. | [SRC-161](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-161) | Supported current framework | Paragraphs 3.7–3.9 advise discussion and explicit consent for planned other-agency involvement; guidance is not a new power. |
| NIAS electronic direct-care handovers illustrate a controller’s public-task and health-care processing explanation. | [SRC-162](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-162) | Supported current framework | One Trust’s operational notice is not legislation for all providers. |
| NI Trust functions can be delegated by directions under Article 10B. | [SRC-163](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-163) | Supported current framework | Actual delegation and functions must be identified for the organisation. |
| NI nursing-home and domiciliary-care regulations impose specific record and disclosure limits. | [SRC-164](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-164), [SRC-165](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-165) | Supported current framework | Applies to the regulated service; does not authorise unrestricted shared-record access. |

## Protection duties and digital workflows

These claims support the separately counted [protection catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/protection-requirements/index.md), [explanation](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/protection-and-safeguarding/index.md) and [worked examples](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/protection-sharing/index.md). A reporting duty, digital specification and operational system are separate findings.

| Claim | Support | State | Limitation |
|---|---|---|---|
| England's conditional child-welfare information duty in section 16LA and standards framework in section 16LB became operative on 30 September 2026. | [SRC-313](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-313), [SRC-317](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-317), [SRC-318](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-318) | Supported current statutory position | Birth to under 18; qualifying persons/functions/information, detriment and data-protection tests; no universal digital channel or all-adult application. |
| Education/childcare designation and the consistent-identifier scheme must be distinguished from the operative English child-sharing duty. | [SRC-313](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-313), [SRC-326](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-326), [SRC-327](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-327) | Supported dated scope/status distinction | Broad guidance wording is not designation; indicative 2027/2028 implementation milestones are not current duties. |
| Applicable English NHS Standard Contract SC32.8 requires CP-IS access, appropriate use, guidance compliance and cooperation. | [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | Supported conditional contractual digital duty | Actual adopted full-length contract and codes A+E, A, AM, CS, MH, U; not all private providers or all GP services. |
| CP-IS v3.0 specifies indicator/contact/event data, participant-specific timings and alternative integration/viewing routes. | [SRC-310](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-310), [SRC-311](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-311), [SRC-312](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-312), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192) | Supported scoped standard and operational routes | Saved older section 250 regime; local-authority statutory-scope caveat, inconsistent notice dates, actor-specific clocks and scheduled silent-read; no complete case-file feed or deployment proof. |
| English section 47 enquiry assistance and Care Act section 45 Board information requests impose conditional medium-neutral information duties; section 42 is a local-authority enquiry duty. | [SRC-314](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-314), [SRC-315](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-315), [SRC-316](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-316) | Supported statutory distinctions | Public-body/request/condition limits differ; private bodies can fall within qualifying Board requests. No universal hospital electronic-referral duty follows from section 42. |
| Welsh sections 128/130 require defined relevant-partner reports and cross-area notices; section 137 governs conditional Board information requests. | [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320), [SRC-321](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-321), [SRC-324](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-324) | Supported statutory duties without prescribed digital-only channel | Risk tests, partner list, request conditions, refusal and purpose limits remain; every independent provider is not automatically a relevant partner. |
| Welsh protection guidance prescribes/encourages prompt reporting and written follow-up, while shared-record programmes have a separate implementation role. | [SRC-322](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-322), [SRC-323](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-323), [SRC-325](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-325) | Supported guidance and operational evidence | Preserve should/must and have-regard force. Phone/email/writing are distinct; programme milestones do not prove universal WCCIS/Connecting Care integration. |
| Scottish adult protection separates public-body section 5 duties, defined healthcare section 5A permissions and required section 10 records. | [SRC-350](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-350), [SRC-351](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-351), [SRC-352](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-352), [SRC-064](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-064), [SRC-065](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-065), [SRC-361](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-361) | Supported commenced law | Adults 16+ under section 3 tests; s5A permissive from 7 January 2026; records inspection safeguards and reasonable excuse; no digital-only method. |
| Scottish child cooperation and Reporter information duties are actor-specific; registers and secure IRD records have guidance/operational roles. | [SRC-353](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-353), [SRC-354](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-354), [SRC-357](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-357), [SRC-358](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-358), [SRC-359](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-359), [SRC-360](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-360) | Supported legal/guidance distinction | National child-protection guidance is non-statutory; private health reporting permission is not the LA/police duty; no universal national interface established. |
| The Scottish 2014 statutory named-person and child's-plan provisions were repealed on 5 May 2025. | [SRC-355](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-355), [SRC-356](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-356) | Supported repeal and commencement | Non-statutory GIRFEC practice is distinct; the repealed provisions cannot supply a current digital-sharing duty. |
| Care Inspectorate protection notification uses sector-specific digital forms: adult concerns within 24 hours, children immediately, with one-month updates. | [SRC-362](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-362), [SRC-363](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-363), [SRC-364](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-364), [SRC-365](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-365), [SRC-366](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-366), [SRC-367](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-367) | Supported regulatory/registration specification with current-form limits | Match registered service and applicable notice/form; protected latest fields not inspected. Manage My Service future-launch wording is not proof of completed migration. |
| HIS current linked independent-healthcare guidance specifies public-protection notification 15 through its portal within 24 hours. | [SRC-368](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-368), [SRC-369](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-369) | Supported published regulatory route with qualification | Initial personal details not required; actual written registration notice and revised-legislation access remain limits. One-working-day regulator response target is not provider deadline. |
| NI Article 66, SBNI information requests, long-stay child notices and qualifying-crime reporting impose distinct statutory information duties. | [SRC-370](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-370), [SRC-371](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-371), [SRC-372](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-372), [SRC-373](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-373), [SRC-383](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-383) | Supported statutory duties and cooperation context | Actor/threshold/request/exceptions differ; these provisions do not independently require one electronic channel. |
| NI procedures require same-day computer referral recording, 24-hour professional written follow-up and regional electronic register enquiry logging. | [SRC-374](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-374), [SRC-375](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-375), [SRC-376](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-376), [SRC-388](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-388) | Supported current regional procedural requirements | Urgent action does not wait for writing; register chapter retains legacy HSCB wording. Actual platform migration and binding local adoption are not established. |
| NI August 2026 adult joint protocol specifies AJP1 through CJSM and two-working-day no-joint-case outcomes; Adult Protection Bill remains unenacted. | [SRC-377](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-377), [SRC-378](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-378), [SRC-379](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-379), [SRC-380](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-380) | Supported protocol route and current Bill status | Protocol is not digital-transmission legislation. Landing-page update does not redate the September 2016 operational-procedures PDF. |
| RQIA incident law and portal guidance, and DBS referral law and online/paper routes, have different digital force. | [SRC-381](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-381), [SRC-382](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-382), [SRC-384](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-384), [SRC-385](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-385), [SRC-386](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-386) | Supported statutory duties plus method guidance | Service/employer/regulated-activity conditions apply; oral/written and paper alternatives prevent a universal digital-only conclusion. |
| NI Operation Encompass school notifications are distinct from the healthcare encompass EPR; NIECR access evidence does not prove every live protection feed. | [SRC-387](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-387), [SRC-389](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-389), [SRC-087](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-087), [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220) | Supported bounded operational distinction | Official scheme/2023 privacy information is not an all-provider upload obligation or proof of November 2026 feed completeness. |
| DPA safeguarding processing and rights restrictions do not themselves create a report duty, blanket consent override or unlimited proxy access. | [SRC-390](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-390), [SRC-391](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-391) | Supported conditional statutory framework | Paragraph 18 adult threshold is 18+; paragraph 21 child-abuse access restriction excludes Scotland; health/social-work/requester tests differ. |
| GMC protection guidance supports prompt relevant disclosure with child/adult, capacity, consent and required-law distinctions. | [SRC-392](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-392), [SRC-393](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-393) | Supported professional regulatory framework | Professional instructions are not statutory digital-only channels; preserve exceptional delay/refusal/overall-benefit conditions. |

## Specialist protection reporting

| Claim | Support | State | Limitation |
|---|---|---|---|
| Known-FGM police reporting is a personal professional duty in England/Wales with oral/written methods and a one-month outer limit. | [SRC-330](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-330), [SRC-331](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-331) | Supported statutory duty and procedural guidance | Direct disclosure/observed qualifying signs, current age under 18 and professional scope; not mere suspicion or an exclusive electronic report. |
| Prevent law and healthcare referral guidance impose different obligations; secure email is a defined guidance route. | [SRC-332](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-332), [SRC-333](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-333), [SRC-334](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-334), [SRC-335](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-335), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | Supported due-regard/cooperation/contract/guidance distinctions | Nation, specified authority, panel tests and actual contract apply; no universal automatic disclosure or EPR flag. |
| DBS and Scottish PVG organisational referrals have statutory triggers and current digital routes with paper/post alternatives. | [SRC-336](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-336), [SRC-337](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-337), [SRC-338](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-338), [SRC-384](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-384), [SRC-385](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-385) | Supported reporting duties and medium alternatives | National law, regulated activity/role and removal/conduct conditions differ; Scottish three-month offence threshold is not a universal UK digital deadline. |
| England/Wales MAPPA statutory cooperation differs from the conditional disclosure power and local electronic implementation. | [SRC-339](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-339) | Supported bounded statutory position | Listed bodies differ from contributing private participants; Part 3 processing provisions apply where engaged; no universal provider ViSOR feed proved. |

## Retained wider context

These rows preserve valid research about secondary-use authority, implementation status, product regulation and wider governance. Planning, research and public health are within the agreed subject where they concern digital sending or availability. Product and procurement context does not itself establish a clinical data-exchange obligation.

| Claim | Support | State | Limitation |
|---|---|---|---|
| CAG/s251 support is not UK-wide permission or a UK GDPR basis. | [SRC-012](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-012), [SRC-013](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-013) | Supported with national qualifications | Approval scope and Welsh decision-making arrangements must be checked. |
| WECDS full implementation deadline is 31 March 2027 in September 2026 circular. | [SRC-048](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-048) | Supported dated operational mandate | Specific emergency-care service scope and phase exclusions apply. |
| Scottish adult-protection s5A powers reach relevant healthcare services. | [SRC-064](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-064), [SRC-065](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-065) | Supported commenced provision | Permissive powers and defined purposes differ from public-body duties. |
| NI 2016 Act commenced 12 April 2016; its statutory secondary-use machinery remains pending on the official record checked 3 November 2026. | [SRC-084](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-084), [SRC-085](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-085), [SRC-121](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-121), [SRC-122](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-122), [SRC-123](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-123), [SRC-124](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-124), [SRC-125](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-125), [SRC-126](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-126), [SRC-127](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-127) | Supported law and corroborated current-status inference | Act commencement is not implementation. Parliamentary index publication lag and later instruments remain relevant; project authority and approval cannot be inferred. |
| NI medical-device law differs from GB. | [SRC-091](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-091), [SRC-107](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-107) | Supported regime distinction | Software intended purpose, device class and applicable conformity route must be assessed. |
| Standalone IT procurement is not automatically within England PSR. | [SRC-020](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-020), [SRC-021](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-021) | Supported procurement distinction | Mixed contracts, devolved rules, transitional arrangements and actual contract need checking. |

[Digital requirements table](https://uk-digital-healthcare-legal-requirements.pages.dev/digital-requirements/index.md) · [How to read a requirement](https://uk-digital-healthcare-legal-requirements.pages.dev/requirements/index.md) · [Legal frameworks](https://uk-digital-healthcare-legal-requirements.pages.dev/legal-framework/index.md) · [Sources](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md) · [Validation queue](https://uk-digital-healthcare-legal-requirements.pages.dev/validation-queue/index.md)