Where digital requirements come from

A duty to send or make information available digitally can come directly from law, from terms that law requires in a healthcare contract, or from an applicable contract. The route determines who is bound, which action is required and what conditions apply. This page explains those routes; the requirements table supplies the exact obligations.

For oversight, ask for the complete link from authority → responsible organisation → electronic action. A technical specification supplies part of that answer when an applicable law, notice, direction, contract or access arrangement gives it effect.

The authority chain

Route	Example in this guide	What to establish
Direct legislation	UK GDPR electronic access-copy and conditional portability rights. ^{260, 261}	The request or other trigger, entitled person, timing, exceptions and processing basis.
Statutorily prescribed contract terms	English/Welsh GP summary and transfer terms; Scottish/NI electronic audit-access terms. ^{183, 195, 212, 221}	Regulations require the named contract to contain the term. Check the actual national contract, contractor and service conditions.
Statutory direction / required service terms	Scotland's 2026 Community Glaucoma Service electronic patient-record and claim provisions. ²¹⁶	The direction binds the addressed Board and can require it to impose terms on participating clinicians. Eligibility, pathway and the relevant terms matter.
Statutory data collection notice	England's identified Commissioning Data Sets submission requirement. ¹⁹³	The notice identifies recipients, dataset and form of collection. Read its current submission method and timetable.
Published healthcare contract	England's 2026/27 discharge and correspondence Delivery Methods. ^{181, 182}	The adopted agreement, service category, defined recipient and actual clause.
Standard, administrative instruction or participation condition	Information-standard notices, Welsh circulars and Data Standards Change Notices, shared-record access rules.	The document's legal force, addressees, transition and any adopting direction or contract. An unverified route remains identified as a gap.

These routes explain why an obligation can be both legally prescribed and delivered through a contract. They also explain why a published national model needs the provider's adopted agreement before its local application is settled.

Trace one obligation into implementation

The English discharge example starts with the applicable NHS Standard Contract service condition. The clause identifies the handover and timing; its defined Delivery Method determines the electronic route for each recipient. A relevant information standard can then add content or format requirements within its own scope. ^{181, 182}

The discharge worked example follows that chain. How to read a requirement explains the legal-force labels used in the catalogue.

Enabling legislation is not the complete digital requirement

England's section 250/250A framework permits information and IT standards. Its amended scope includes relevant providers and IT roles. The particular notice, recipients and current legal regime determine the duty. The saving regulations preserve the earlier regime for standards already in effect. ^{008, 009, 014, 192}

The national organisational frameworks establish healthcare functions and particular cooperation or sharing provisions. These include the NHS Act 2006 in England, the NHS (Wales) Act and Welsh social-services law, the NHS (Scotland) Act and integration law, and NI Health and Social Care legislation. The specific digital message and recipient still need their applicable requirement. ^{007, 041, 044, 061, 062, 081, 082}

For example, England's section 251B requires individual-care sharing within defined conditions and preserves data protection and common-law confidence. It does not select a universal application programming interface (API) or electronic delivery method. ^{010, 141}

Confidentiality, rights and patient authority

Apply the digital requirement alongside lawful personal-data processing and a justified confidentiality route. The purpose, information and access must remain appropriate. Capacity, children's rules and representative authority determine who can decide or receive information in the relevant circumstances. ^{001, 002, 006, 171}

The information-law account explains those conditions. The four-nation discharge map applies the principal age, capacity and representative-authority rules to one care transition.

Current law, contract and evidence status

The catalogue keeps current duties, contractual conditions and implementation evidence distinct. Recommended standards, proposed reforms, procurement descriptions and deployed services can explain the setting while carrying a different legal status. Local schedules, directions and variations remain evidence gaps where they have not been supplied.

Use the national comparison to select the relevant system, then inspect current changes and the source register for the dated authority and limits.