Digital interoperability and legal requirements

Interoperability means that systems can exchange information and the receiving service can use it with the intended meaning. For this wiki, the first question is which parts of that exchange an organisation is legally required to provide. The requirement may concern sending a message, making a record available, using specified content or codes, or meeting a deadline.

The requirements table identifies the particular obligation. This chapter explains how the technical parts fit together, so a board can understand the outcome being assured and specialists can inspect its implementation.

The whole exchange

For a discharge, a receiving team needs information matched to the correct person, with usable content, a reliable route and clear access and follow-up responsibilities. This reading model separates those parts:

This is an explanation of the exchange, not a statutory checklist. A particular source may prescribe some elements; others implement general accuracy, security and care duties. ^{171, 172, 102}

Different electronic actions create different obligations

An upload sends information into another service. Automated retrieval lets a service obtain information from its source. A configured viewer makes information available to authorised users. An electronic patient copy and a national dataset submission have their own recipients and triggers. These actions should be identified separately when specifying or assuring a system. ^{183, 195, 260, 193}

The SCR-equivalents example follows upload, retrieval and viewing. The blood-results example separates reporting, clinical receipt and patient access. The discharge example applies recipient-specific delivery requirements.

Binding method, content and scope

England's amended section 250/250A framework provides for information and IT standards. The actual standard, notice, addressees, dates and transitional rules determine its force. The 2025 saving regulations preserve the earlier regime for existing standards, including the distinction between a have-regard duty and an applicable duty to comply. ^{008, 009, 014, 192}

A contract can separately require digital delivery and conformance with applicable standards. Read the NHS Standard Contract clause with the standard's scope. The England account explains those routes for discharge and pathology reporting. ^{181, 182}

Wales, Scotland and NI have their own legislation, directions, contracts, standards and service-participation arrangements. The national comparison identifies the differences; the catalogue records whether the relevant legal route is established or remains unverified.

Who may use digitally available information?

A configured service still needs appropriate access decisions. The recipient's role, purpose, confidentiality justification and data-protection conditions determine the permitted use. Controller and processor responsibilities continue on a shared platform. ^{172, 006}

For a person receiving care, distinguish the care decision, the disclosure to another provider and access by a representative. The capacity and representation map shows why those decisions can have different legal bases.

Implementation consequences

Patient matching, error handling, provenance, corrections, acknowledgement, clinical review and continuity turn an interface into a dependable service. Establish which controls the applicable source prescribes and which are implementation measures for wider accuracy, security and care duties. That distinction keeps an assurance decision tied to the actual legal requirement. ^{171, 172, 102}

Continue to how to read a requirement for legal-force labels, or the public/private comparison for provider applicability.