# Wales Welsh GP contract terms require defined summary availability, electronic registration transfer and appointment-data extraction arrangements. NHS Wales also has national interoperability and reporting instructions, but their legal routes differ. The reviewed sources do not establish one statutory digital-send rule for every hospital result or discharge. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195), [SRC-196](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-196), [SRC-199](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-199) For boards and service owners, separate the settled GP contract duties from administrative standards, recommendations and local agreements. Identify the organisation, information, recipient, electronic action and timing for each exchange. England's section 251B and NHS Standard Contract do not supply general Welsh mandates. [SRC-010](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-010), [SRC-141](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-141) ## GP summaries, record transfer and patient access Regulation 29 of the NHS (General Medical Services Contracts) (Wales) Regulations 2023 incorporates the relevant Schedule 3 terms. Paragraph 79 requires Welsh General Medical Services (GMS) contractors to enable automated retrieval of defined summary information through Local Health Board-approved systems when the medical record changes. The services are Welsh GP Record and the NHS Wales App; Welsh GP Record retrieval must be for clinical use. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) The summary covers medications, allergies and adverse reactions. Additional information requires contractor agreement and patient consent, with the provision's other qualifications. This is a defined availability requirement, rather than whole-record access for every connected user. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) Paragraph 80 separately requires GP2GP for specified incoming registration transfers and outgoing requests. Paragraph 78(6) requires the outgoing contractor to act as soon as possible and within 28 days. Paper-only material and transfers without safe-transfer confirmation use the Local Health Board fallback. Temporary residents are excluded from paragraph 80. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) Paragraph 81 requires the NHS number in clinical correspondence, subject to its exception. It covers electronic and other written correspondence, so the identifier duty does not itself select a digital medium. These prescribed terms concern Welsh GMS contractors, not every wholly private GP service. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195) ## Hospital results, referrals and discharge The 2026 All Wales General Practice and Health Board Clinical Interface Standards cover NHS clinicians across GP/health-board interfaces and expressly include private clinicians interfacing with general practice. They are professional consensus standards endorsed by medical directors. This review has not established a statutory instrument or executed contract making every statement a legally enforceable digital obligation. [SRC-199](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-199) Standard 6 uses mandatory language for agreed electronic referral/outpatient methods **where one exists**. Standard 9 says an electronic Discharge Advice Letter (eDAL) **should** be completed at discharge, with a patient copy. That recommendation is different from a verified statutory all-discharge duty or universal digital deadline. Actual adopting contracts and local protocols can add obligations. [SRC-199](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-199) For blood results, distinguish ordering, reporting, clinical review, action and patient communication. National systems and standards can support those exchanges, but a result view does not establish every sender's or recipient's legal duty. England's DAPB4101 pathology requirements cannot simply be treated as Welsh law. See the [blood-results](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/blood-tests-results/index.md) and [discharge](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/hospital-discharge/index.md) examples. [SRC-199](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-199), [SRC-202](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-202) ## Child and adult protection Welsh law expressly requires relevant partners to report children and adults at risk to the appropriate local authority. Social Services and Well-being (Wales) Act 2014 section 130 covers reasonable suspicion of abuse, neglect or other harm **and** care/support needs. Section 128 uses the adult-risk definition, which additionally concerns inability to protect oneself because of care/support needs. Local Health Boards, NHS Trusts and police are among the defined partners; independent providers are not automatically included. The sections also require local-authority notice when an at-risk person moves or proposes to move to another authority's area, including England. They do not prescribe a digital-only method. [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320), [SRC-321](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-321) The section 131 statutory guidance adds practical timing and routes. Volume 5 says child reports must be made as soon as possible; Volume 6 says adult reports must be made as soon as possible and within one working day. Telephone reports **should** be confirmed in writing within 24 hours. The guidance also addresses police involvement where danger or suspected crime requires it. Phone, email and writing are recognised routes: a written-confirmation expectation is not a universal electronic-transfer requirement. [SRC-322](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-322), [SRC-323](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-323) Section 137 separately requires qualifying persons or bodies to supply information requested for Safeguarding Board functions. Incompatibility with duties or adverse effects on functions can justify refusal, with written reasons; supplied information has purpose limits. Children Act section 47 requires listed bodies to assist requested enquiries unless unreasonable in all the circumstances. Section 28 of the 2004 Act adds safeguarding-arrangement duties for listed Welsh bodies and their commissioned services. These provisions do not select one electronic record or message. [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320), [SRC-314](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-314), [SRC-324](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-324) The Welsh Community Care Information System (WCCIS) and its Connecting Care successor programme provide a separate implementation context. DHCW's March 2026 report describes programme transition, record-sharing aims and local procurement. The existing reference-data and access standards have their own scope; they do not establish that every protection report must pass through WCCIS, or that one automatic feed is required nationwide. England's CP-IS contract clause is not a general Welsh mandate. [SRC-325](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-325), [SRC-202](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-202), [SRC-200](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-200) Use the [protection-sharing account](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/protection-and-safeguarding/index.md) and [worked example](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/protection-sharing/index.md) for the report, recipients, digital route and cross-agency conditions. ## Standards: content, coding and transport Welsh Health Circular WHC/2023/018 introduces FHIR as the foundational interoperability standard for NHS Wales IT and digital systems/services from June 2023. It supports staged maturity and treats stable FHIR R4 as the suggested default; alternatives need Welsh Technical Standards Board approval. The circular does not identify itself as a statutory direction. Its administrative mandate and any actual adopting contract must remain distinct from legislation. [SRC-196](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-196) WHC/2024/042 requires Local Health Boards, trusts and Special Health Authorities to use the dictionary of medicines and devices (dm+d) at the appropriate structural level when a digital system records medication information and transfers it to another system. Receiving systems must handle relevant codes. The requirement took immediate effect; medical devices are excluded from its compliance scope. [SRC-197](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-197) The amended May 2025 notice DSCN2022/76 joins Welsh FHIR profiles, dm+d and SNOMED CT clinical terminology for medicines, allergies and intolerances. It addresses procurement, supplier contract clauses and affected legacy systems. Its scope includes relevant NHS-contracted private and social-care settings; an unseen executed contract remains unverified. A past implementation date is not proof of completed implementation. [SRC-198](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-198) Core Reference Data Standards and the NHS Number Operational Standard add scoped harmonisation requirements, with named systems and phases. They do not themselves require an unrelated disclosure. The 2015 SNOMED circular expects use in relevant programmes and projects, while acknowledging that there was then no acute/community implementation programme. [SRC-202](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-202), [SRC-203](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-203), [SRC-204](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-204), [SRC-201](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-201) ## National reporting, research and public health Regulation 23 of the Welsh GMS Regulations prescribes appointment mapping, current categories, server availability for authorised extraction and review of submitted data at least monthly. It supports service management. The operational account separately describes daily Audit+ extraction and Digital Health and Care Wales (DHCW) processing on the tenth of the month. Those dates are not additional statutory practice-upload deadlines. The [national reporting example](https://uk-digital-healthcare-legal-requirements.pages.dev/national-service-reports/index.md#wales-gp-appointment-activity) explains the distinction. [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195), [SRC-294](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-294) WHC/2026/031 requires Welsh Emergency Care Data Set implementation by 31 March 2027, replacing 1 April 2026. Local Health Boards must provide daily unvalidated information and monthly validated information by the tenth calendar day. Major emergency departments and minor injury units operated or hosted by the board are in scope; same-day emergency care is excluded in this phase. This is an administrative reporting mandate, not evidence that rollout is complete. [SRC-048](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-048) Welsh laboratory notification rules provide a separate statutory example. Regulations 4 and 7 of the 2010 Notification Regulations require writing and specified timing for generic causative-agent notifications, with urgent oral reporting. Electronic communication is permitted under the recipient-consent/address conditions. Special notification provisions need their own scope analysis. Planning, research and public-health uses also need their own purpose, legal basis and permitted recipients. [SRC-205](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-205), [SRC-043](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-043) ## Access, confidentiality and private-provider boundaries The current Welsh Control Standard is version 5.0; version 4 is historical. Its front approval/review dates are 4 August 2025/4 August 2027, while footers give 28 July 2025 as the effective date. Organisations seeking national-system access must adopt the applicable standard and govern purposes, roles, individual credentials and audit. Those access controls do not establish a universal upload duty. [SRC-200](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-200), [SRC-046](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-046) DHCW's infrastructure functions are assigned through the 2021 Directions, which preserve other legal disclosure prohibitions. The Welsh health-service framework and assigned Local Health Board functions remain relevant to the participant's actual purpose and use. [SRC-041](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-041), [SRC-042](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-042), [SRC-149](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-149) At the health/social-care boundary, Social Services and Well-being Act sections 162, 164 and 165 address cooperation, qualifying information requests and integration. Section 164 responds to a qualifying local-authority request, with incompatibility/adverse-function exceptions and written-refusal requirements. It does not prescribe a digital interface. [SRC-044](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-044), [SRC-147](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-147), [SRC-148](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-148) Confidentiality and UK GDPR still apply. Implied consent for care disclosure differs from a data-protection lawful basis. The Wales Accord on the Sharing of Personal Information (WASPI) can document arrangements but cannot supply missing legal authority. [SRC-001](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-001), [SRC-002](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-002), [SRC-045](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-045), [SRC-174](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-174) Independent healthcare regulation requires records, security and retention while permitting paper or electronic records. Healthcare Inspectorate Wales registration does not establish a duty to join every national system. NHS contracts, applicable notices and participation terms can add requirements; wholly self-pay services need their own assessment. [SRC-050](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-050), [SRC-051](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-051), [SRC-049](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-049) [Requirements catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/digital-requirements/index.md) · [Four-nation comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/comparison/index.md) · [Worked exchanges](https://uk-digital-healthcare-legal-requirements.pages.dev/decision-workflow/index.md) · [Public and private providers](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/public-private/index.md)