# Northern Ireland The reviewed NI sources identify a specific digital-access requirement in GP contract terms: audit-function access where records are computerised. Shared records, electronic results and hospital correspondence also operate, but their existence does not establish a universal legal upload or digital-discharge duty. KH03a activity reporting has a statutory Trust reporting framework and electronic instructions, with the precise digital legal linkage qualified. [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221), [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220), [SRC-218](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-218), [SRC-280](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-280), [SRC-283](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-283) For a Health and Social Care (HSC) organisation, the practical task is to trace the actual direction, contract or instruction for each exchange. Confirm the data, recipient, electronic method and timing. Integration and public funding alone do not put every independent provider under every Trust obligation. Protection provides further concrete digital examples: secure police referrals and electronic child-protection recording. Their procedural force must be distinguished from statutory disclosure duties. [SRC-380](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-380), [SRC-388](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-388) ## GP records and information requests The General Medical Services (GMS) Regulations 2004 prescribe terms for participating general practices. Their revised Schedule 5 distinguishes these duties. They are requirements for the prescribed GMS contract, rather than all private GP services. Legacy references to the Board must be read with the 2022 transfer legislation. [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221), [SRC-082](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-082) | Information and actor | Required action and timing | Digital effect | |---|---|---| | Contractor: computerised patient records | Allow the commissioning authority access as soon as possible after a request to verify that the audit function works. Paragraph 68(5). | Specific audit-function access; not general clinical-record browsing. | | Contractor: qualifying contract/function information | Produce information or allow access under applicable Department directions; agreed reasonable date, otherwise 28 days. Paragraph 72. | The provision does not prescribe an exclusively digital method. | | Contractor: qualifying treatment of a patient outside its list | Provide the consultation/treatment report as soon as reasonably practicable; the authority forwards it to the usual provider or appropriate authority. Paragraph 7. | No specified electronic method; private arrangements and the out-of-hours exception matter. | Paragraph 68 permits paper, approved computerised records or both. Transfer can use written copies or another form with the required consent; it does not impose universal GP2GP electronic transfer. [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221) The Paperlight accreditation policy contains a sample electronic-record agreement covering records, security and audit, with printout/electronic-media forwarding. It retains former HSC Board terminology. Current practice approvals and executed terms need their own evidence; the sample does not establish every contractor's present agreement. [SRC-222](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-222) ## Summary records and information available for care The Northern Ireland Electronic Care Record (NIECR) patient guide describes GP-derived Emergency Care Summary medicines/allergies and Key Information Summary care information among several feeds. It provides a functional comparison with England’s Summary Care Record (SCR). Its undated description cannot establish that every feed remains complete after encompass implementation, or that English SCR duties apply. [SRC-226](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-226) Encompass provides the regional Trust care record; all five geographical Trusts implemented it by May 2025. EpicCare Link is a professional portal over principally encompass information, including admissions, discharges, referrals and some results, with limited actions such as imaging requests. New users go through Site Administrators. A portal view differs from automatic delivery into another provider's clinical system. [SRC-087](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-087), [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220) My Care offers optional patient access to selected information. Its published scope excludes GP records, GP-requested results and pre-encompass history; social-care records are not currently displayed. Some results are released automatically, others after clinical action. These service limits are separate from statutory information rights. [SRC-225](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-225) The reviewed service documents do not establish a general dataset, upload frequency or digital-send deadline binding every provider for NIECR or encompass. A specific Trust, practice or commissioned service can have further contractual or operational requirements. ## Blood tests, hospital correspondence and discharge Belfast Trust's Haematology and Blood Bank Laboratory User Manual H-416 version 28.0, effective 15 June 2026, describes accepted requests as a service agreement covering tests and reporting. For encompass users, the collection workflow must be completed to generate the electronic request and meet minimum sample-acceptance criteria. Other users have the manual's other routes. These are local service conditions. [SRC-218](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-218) Validated hospital results become electronically available through EPIC; GP reports are sent to individual practice systems by electronic data interchange (EDI). Turnaround depends on the test and circumstances. This is evidence of a defined route, not an NI-wide statutory EDI deadline or an obligation to release GP-requested results in My Care. Actual service and commissioning terms remain relevant. [SRC-218](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-218), [SRC-225](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-225) The Business Services Organisation's September 2025 Docman10X notice describes most secondary-care documents arriving at GP practices by Electronic Document Transfer. It retains paper and practice scanning for other sources. This is an operational procurement description, not proof of the executed contract, completed deployment or a universal digital-only discharge rule. [SRC-219](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-219) EpicCare Link separately makes some discharge information available for viewing. The reviewed evidence does not establish an all-provider NI equivalent of a particular English discharge clause and deadline. A named hospital-to-community pathway needs its actual direction, Trust instruction and provider agreement. [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220), [SRC-219](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-219) Clinical communication and follow-up remain necessary when an electronic route fails or a result is urgent. Delivery or portal availability does not establish that the responsible team has reviewed and acted. Professional responsibilities apply within each registrant's scope alongside organisational duties. [SRC-174](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-174), [SRC-175](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-175), [SRC-176](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-176) ## Child and adult protection NI law requires particular protection disclosures. Regional procedures also specify electronic workflows. A shared record or visible flag does not alone complete either obligation. For child-protection inquiries, Children Order Article 66 requires specified bodies to provide relevant information and advice when called upon. Assistance need not be given where unreasonable in all the circumstances. A qualifying Safeguarding Board request has a separate statutory duty: respond as soon as reasonably practicable. Its conditions can cover private providers. Neither provision specifies digital-only transmission. [SRC-370](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-370), [SRC-371](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-371) Criminal Law Act (NI) 1967 section 5 requires materially useful information about a qualifying offence to reach a constable within a reasonable time. Knowledge, the offence definition, reasonable excuse and other exceptions matter. This applies across public and private settings; it is not a rule to report every confidential disclosure. [SRC-373](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-373) The following digital procedures serve different purposes: - **Adult protection and police:** the August 2026 Joint Protocol requires completed AJP1 referrals between HSC Trust protection services and PSNI's Central Referral Unit through Criminal Justice Secure Mail (CJSM). Its form records the adult, incident, risk and protective action. Initial risk assessment starts on the referral day. The protocol specifies this digital route; section 5 supplies a separate reporting test. Emergencies require prompt action. [SRC-380](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-380) - **Children's Gateway:** the SBNI Referrals procedure requires receiving managers to ensure referral entry on the computer system that day. Staff should follow a verbal referral with writing within 24 hours. Protection must not wait for that writing. [SRC-388](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-388) - **Child Protection Register:** authorised enquiries use a verified process and regional electronic logging. Specified changes require immediate written notification; the coordinator updates the register within one working day. These are procedural requirements, with current platform arrangements requiring confirmation. The chapter retains former HSC Board wording. [SRC-376](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-376) - **RQIA:** registered nursing-home providers must notify specified safety events without delay; oral reports need written confirmation within three days. RQIA directs providers to its portal, using unique identifiers and excluding names/personal details from notifications. The statutory notice duty and regulator's digital procedure have distinct sources. [SRC-382](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-382), [SRC-381](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-381) Private providers have applicable statutory, registration and contractual duties. They do not automatically acquire Trust system access or CJSM membership. The 2023 NIECR notice lists child-protection information, but proves neither complete current feeds nor delivery of a particular referral. Police-to-school **Operation Encompass** is a separate scheme from the **encompass** healthcare record. [SRC-389](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-389), [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220), [SRC-387](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-387) At 3 November 2026, the Assembly records the Adult Protection Bill awaiting Consideration Stage, without Royal Assent. Its proposed duties must not be presented as operative law. [SRC-379](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-379) Follow the [protection requirements map](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/protection-and-safeguarding/index.md) for exact scope and the [protection-sharing example](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/protection-sharing/index.md) for hospital-to-community application. The [capacity and representation map](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/capacity-and-representation/index.md) explains why a relative or portal proxy does not automatically have disclosure authority. ## National reporting, research and public health KH03a covers quarterly aggregate bed-use and specified non-acute activity. Schedule 3 paragraph 8 of the 1991 Order requires HSC Trusts to provide Department-required reports and planning information in the required form. Official sources describe electronic reporting and a period-specific timetable, but do not expressly identify KH03a as an exercise of paragraph 8. The email instruction uses “should”; the precise legal linkage remains qualified. Independent-sector beds are excluded. [SRC-280](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-280), [SRC-281](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-281), [SRC-282](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-282), [SRC-283](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-283) The [national service-report comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/national-service-reports/index.md#northern-ireland-hospital-bed-use-and-activity) explains the September-quarter example and the difference between submitting reports and publishing statistics. Separate independent-sector statistics do not establish a direct KH03a duty on every private hospital. Qualifying GMS requests under paragraph 72 can concern commissioning functions under the required Department directions. An interest in planning or research is not enough to make every disclosure compulsory. The 2016 data-processing Act's [implementation record](https://uk-digital-healthcare-legal-requirements.pages.dev/context/secondary-use-status/index.md) remains separate from an operative universal digital-return requirement. [SRC-221](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-221), [SRC-084](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-084) Public Health Act (NI) 1967 section 2 requires an attending medical practitioner to send a certificate when aware of, or reasonably suspecting, a notifiable disease, subject to its exceptions. It specifies patient details, examination address and disease, with notification as soon as awareness or suspicion arises. It does not expressly require digital transmission. A laboratory surveillance feed and this practitioner certificate are different obligations. [SRC-215](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-215) ## Confidentiality and private-provider boundaries The 2009 integrated-care framework, 2022 changes and Trust delegation arrangements explain institutional responsibilities. An actual commissioning contract can add digital duties. Independent-care and domiciliary-care rules also apply within their own scopes; public funding or registration does not confer unrestricted system access. [SRC-081](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-081), [SRC-082](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-082), [SRC-163](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-163), [SRC-088](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-088), [SRC-165](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-165) Confidentiality and data protection govern information sent or accessed. The NI Code distinguishes multidisciplinary care-team sharing from planned involvement of another agency, where discussion and explicit consent should be sought. This remains relevant when a discharge crosses into separate social-care services. [SRC-161](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-161), [SRC-001](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-001), [SRC-002](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-002) [Requirements catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/digital-requirements/index.md) · [Four-nation comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/comparison/index.md) · [Worked exchanges](https://uk-digital-healthcare-legal-requirements.pages.dev/decision-workflow/index.md) · [Public and private providers](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/public-private/index.md)