England

England has identified requirements for digital GP summaries, record transfer and patient access. Applicable NHS service contracts also require electronic discharge correspondence and access to key GP information. National activity collections have their own digital submission duties. Each requirement applies to defined providers, information and circumstances. ^{183, 184, 181, 193}

For a publicly funded organisation, the practical task is to map each exchange to its statutory or contractual source. Confirm the service and recipient, required method, timing and exceptions before approving the interface. An independent provider can be covered when delivering NHS-funded care; its self-pay services may have a different position.

GP summaries, record transfer and patient access

The General Medical Services (GMS) and Personal Medical Services (PMS) Regulations prescribe terms for the relevant English GP arrangements. Their legislative extent must not be mistaken for application to Welsh GP contracts. Alternative Provider Medical Services (APMS) and other arrangements need their actual terms checked; PMS provisions also have their own service qualifications. ^{183, 184}

GMS regulation 68 and PMS regulation 61 define SCR information: medications, allergies and adverse reactions, with additional data subject to agreement, consent and exclusions. The duty concerns that summary, not the whole GP record. GP Connect's read capabilities concern direct care; Update Record receives consultation summaries for integration. Enabling those functions does not establish every applicant's authority to access information. ^{183, 184}

GMS regulations 69–69A and PMS regulations 62–62A govern GP2GP. Paper-only material and transfers without safe-transfer confirmation have separate fallback arrangements; temporary residents are excluded from the GP2GP requirement. Patient online access is separately governed by GMS regulations 71ZA–71ZB and PMS regulations 64ZA–64ZB. Prospective, coded and remaining requested information have distinct conditions, including excepted information. ^{183, 184}

Hospital correspondence and information available for care

The full-length 2026/27 NHS Standard Contract imposes duties when adopted within its service scope. SC11.5 requires the discharge summary within 24 hours after the relevant inpatient, day-case or A&E transfer/discharge. The recipients are the patient's GP and/or other referrer, plus any relevant third-party health or social care provider. ^{181, 182}

The defined Delivery Method is part of the requirement. GP communications require direct automatic transfer into the GP electronic patient record (EPR) through a suitable secure interface. Other referrers and health/social-care providers can receive automatic transfer or secure NHS/equivalent email, as the protocol requires or permits. ^{181, 182}

SC11.7 covers outpatient information requiring prompt GP/referrer action: send the clinic letter as soon as reasonably practicable and within seven days. SC11.6A gives NHS 111 a separate Post Event Message deadline, 8am on the next Operational Day. Other discharges can depend on local protocols under SC11.6. The actual agreement, service category and local schedules determine applicability. ¹⁸¹

SC23.6 separately requires staff delivering urgent, emergency and unplanned care to be able to view key GP information through SCR, or a locally integrated record supplemented by SCR. This is an availability duty, subject to confidentiality and data protection. It differs from the GP's summary-upload duty. SC23.4 and GP contract terms also require NHS-number use in relevant correspondence, including paper. SC24 concerns counter-fraud. ^{181, 183}

Child and adult protection

Since 30 September 2026, Children Act 2004 section 16LA requires covered organisations to disclose relevant child-welfare information, including relevant information about someone connected to the child, to another covered person. The duty applies where, and only so far as, the holder considers disclosure may facilitate the recipient's relevant functions or arranged services. It also applies to qualifying requests. The exception is where the holder considers disclosure more detrimental to the child than withholding it. ^{313, 318}

The duty applies from birth to under 18 and retains data-protection requirements alongside its specific confidentiality override. It includes listed health, local-authority and police bodies and covered arranged-service providers. Direct coverage of every school or childcare setting must not be presumed: designation is a separate step, described in October 2026 guidance as still to follow and planned during 2027. Other lawful safeguarding arrangements remain relevant. Section 16LA does not prescribe a digital channel. Under section 16LB, a person specified in an applicable published standard must have regard to it; the power itself does not select an interface. The wider consistent-identifier duties remain prospective beyond regulation-making powers. ^{313, 317, 326, 327}

For covered NHS services, SC32.8 of the adopted 2026/27 full-length contract adds a concrete Child Protection–Information Sharing (CP-IS) obligation. It requires compliance with the defined guidance and data protection, staff access and appropriate full use, and cooperation with relevant local services. Its listed accident/emergency, acute, ambulance, community, mental-health and urgent-treatment categories apply only within the guidance's service scope. This can cover an NHS-commissioned independent provider; it does not bind all self-pay services. ^{181, 182}

CP-IS version 3 covers specified scheduled and unscheduled settings. It exchanges defined safeguarding indicators, contacts and access events, rather than complete protection case files. The standard distinguishes local-authority updates, clinical access and central-service notifications; a scheduled silent-read route can avoid an alert to the authority. Approved viewing and system integration are different implementation routes. Read the 2024 notice under its saved statutory regime and any separate contractual compliance obligation. Its inconsistent implementation-date wording does not establish completed rollout or a new universal API deadline. CP-IS is not a general adult-protection system. ^{310, 311, 312, 192}

For adults at risk, Care Act section 42 places the qualifying enquiry duty on the local authority. Section 45 separately requires a person to supply information following a qualifying Safeguarding Adults Board request, with statutory conditions and purpose limits; private organisations can be covered. Neither provision itself prescribes a universal electronic hospital referral. Children Act section 47 similarly requires specified bodies to assist requested child-protection enquiries, subject to its reasonableness exception. ^{315, 316, 314}

The protection-sharing account and worked example separate the referral, digital indicator exchange, clinical handover and cross-agency response. The Crime and Policing Act 2026 section 85 reporting duty remains prospective at this baseline; it must not be substituted for current operative duties. ³¹⁹

Standards: content, coding and transport

Sections 250 and 250A provide for information and IT standards. The applicable notice, actor, version and legal regime determine a particular duty. SI 2025/807 regulation 3 preserves the older framework for standards already in effect before 7 July 2025. An older notice's mandatory wording must therefore be read with the saved have-regard duty. SC28.2.2 can separately require contractual conformance where a standard applies. ^{008, 009, 192, 181}

For acute inpatient/day-case discharge to a GP, DAPB4042 combines PRSB content, terminology, FHIR STU3 and MESH. Its scope includes NHS-commissioned independent secondary care. The specification distinguishes human-readable narrative from later structured automation and addresses configured use, testing and quality review. The notice gives 31 October 2022 for full conformance; a specification implementation criterion refers to 1 October. ^{185, 186}

The contract definition says a summary may conform to DAPB4042. That sentence alone does not settle conformance: read the independent standard, its saved regime and applicable SC28 terms together. ^{182, 181, 192}

For laboratory-to-GP blood-test reporting, DAPB4101 specifies pathology-specific UK Core FHIR R4, SNOMED CT and MESH. Its initial scope covers five specialties and does not mandate coded representation of every result value, interpretation, unit or specimen. ^{187, 188}

The pathology timetable remains unresolved. The linked notice states 30 April 2025; later implementation material describes a pilot, intended assurance by April 2027 and a forthcoming extended conformance date. April 2027 is a pilot milestone, not a verified replacement deadline or proof of national rollout. ¹⁸⁹

SNOMED CT supplies clinical terminology; NHS-number standards govern identification within their scope. The SNOMED notice gives GP and other clinical-system dates but no social-care implementation timetable. The NHS-number amendment relaxed verified-only transmission restrictions. These conditions govern covered information; they do not create every disclosure or select one digital channel. ^{191, 190}

National reporting, research and public health

The Commissioning Data Sets (CDS) Data Provision Notice invokes section 259(5) and requires defined secondary-care activity data through the Secondary Uses Service (SUS+) in XML. Current service information identifies MESH as the transfer route. The selected outpatient type 020 is reported at least weekly; types 120, 130 and 140 are also named as weekly, while other types and cut-offs differ. ^{011, 193, 194, 290}

The collection includes covered NHS-funded independent activity and NHS private-patient units. Its older organisation names and version links need current interpretation. The current release page retains v6.2 maintenance alongside v6.3. The national service-report example explains the scope and timing. ^{193, 293}

Public-health notification and research disclosures have their own authorities, recipients and method requirements. A compulsory national collection does not confer unrestricted researcher access to its outputs. Use the blood-results example and purpose-specific account for those distinctions.

General sharing duties and private-provider boundaries

Section 251B creates a qualified duty to disclose information likely to facilitate an individual's health services or adult social care in England, where disclosure is considered in that person's best interests. Section 251C and the 2015 Regulations define its persons, arrangements and purposes. Publicly arranged independent provision can be covered; CQC registration alone does not put all self-pay care within the duty. Objection, anonymous-service, reasonableness and other exceptions remain. Data protection and common-law confidence are expressly preserved. ^{010, 141, 143}

Section 251A's consistent-identifier duty also has conditions. NHS Act section 82 and Care Act sections 6–7 support NHS/local-authority cooperation, including individual requests. These provisions do not themselves prescribe an electronic discharge message. The 2015 interpretation regime excludes specified children's-social-care and education functions; it does not generally exclude children's NHS treatment. ^{142, 144, 145, 146, 143}

A provider must also satisfy lawful processing, health-data and confidentiality conditions. GMC guidance explains professional direct-care sharing; CQC governance requirements concern records and organisational handling. Neither substitutes for the exact digital obligation. ^{174, 001, 002, 003, 018}

Requirements catalogue · Four-nation comparison · Worked exchanges · Public and private providers