<!-- Derived Markdown alternate of topics/public-private.md; canonical repository sources and registered evidence retain authority. -->


# Publicly funded and private healthcare

**A provider's digital duties depend on the service, function, funding and applicable contract.** An independent organisation can be bound when delivering commissioned NHS care and have a different position for its self-pay services. Data protection, confidentiality and relevant professional responsibilities continue in both settings. [SRC-001](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-001), [SRC-002](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-002), [SRC-006](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-006), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181)

The practical question for a board is which obligations apply to each service it delivers or commissions. Use the [requirements table](https://uk-digital-healthcare-legal-requirements.pages.dev/digital-requirements/index.md) to identify the exact provider and contract scope, then read the relevant national chapter for its legal basis.

## Digital requirements and provider boundaries

UK GDPR electronic-copy and qualifying portability duties can apply to public and private controllers. Public-task processing is excluded from the Article 20 portability right. NHS Standard Contract and prescribed GP terms have their own service and contractor boundaries. They are not a universal contract for every private clinic. [SRC-260](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-260), [SRC-261](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-261), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-183](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-183), [SRC-195](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-195)

A published national contract establishes its terms. The actual local contract, service schedules and variations remain necessary to determine a particular organisation’s position. The table labels those dependencies explicitly.

## One organisation can have more than one position

The English NHS Standard Contract illustrates the distinction. Its discharge clause binds covered services under the actual adopted agreement. The same applicability check is needed for a public provider and an independent provider delivering those NHS-funded services. A wholly private service needs its own applicable rules and terms. [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181)

| Service being considered | How to read the obligation |
|---|---|
| A public provider's covered NHS service | Identify the body's legal functions and the applicable contract/service clauses. |
| An independent provider's covered NHS-commissioned service | Check the adopted public-service contract and the statutory provider/function definitions. Ownership alone does not settle the answer. |
| A service provided wholly outside the NHS arrangement | Establish its own regulatory and contractual duties, alongside patient-data rights, confidentiality and professional responsibilities. |

The [hospital-discharge example](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/hospital-discharge/index.md) applies the recipient and delivery rules. The national report examples add their own [private-provider boundaries](https://uk-digital-healthcare-legal-requirements.pages.dev/national-service-reports/index.md).

## Shared duties towards the patient

Private care does not remove data protection or confidentiality. Each controller needs lawful processing, an applicable health-data condition and safeguards. Professional responsibilities continue to apply to the relevant clinicians. The patient's move between public and private services does not remove those requirements. [SRC-001](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-001), [SRC-002](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-002), [SRC-006](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-006), [SRC-175](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-175), [SRC-176](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-176)

A private provider's own lawful basis may differ from a statutory NHS body's. Article 9(2)(h) can cover qualifying health and social care processing in either setting, subject to its conditions. It remains additional to the Article 6 basis and the confidentiality justification. [SRC-002](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-002), [SRC-003](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-003), [SRC-025](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-025)

## Public funding can change a duty's reach

A provider may deliver publicly arranged care and self-pay care in the same organisation. England's section 251B uses defined relevant persons and care functions; its associated definitions matter to independent providers. CQC registration alone should not be used to assume every private service has the same sharing duty. The [England chapter](https://uk-digital-healthcare-legal-requirements.pages.dev/nations/england/index.md) explains that boundary. [SRC-010](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-010)

Other national laws can reach contracted providers in different ways. The [national comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/comparison/index.md) explains the separate foundations. A public contract can add sharing, records, security or system-participation requirements, within its terms. It does not displace confidentiality or data protection. [SRC-005](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-005)

## Requirements compared

| Requirement | Statutory public healthcare body | Independent provider delivering publicly arranged care | Wholly private care |
|---|---|---|---|
| Care function and sharing duty | Its constituting law, assigned functions and applicable sharing provisions. | Defined provider/function scope and public-service arrangements matter. | No automatic assumption that public-body functions or duties apply. |
| Data protection and confidentiality | Its own lawful basis, health-data condition and justified disclosure. | Its own role and grounds, alongside any commissioned-care duties. | Its own role and grounds; professional and confidentiality responsibilities remain. |
| Digital standards | Applicable statutory instruments, directions, notices and contracts. | Direct requirements may apply; commissioning and participation terms can add obligations. | Applicable regulation, standards scope and contracts determine requirements. |
| Records and accountability | Healthcare governance plus applicable public-law duties. | Provider regulation, care duties and contract terms; public-function duties where legally applicable. | Independent-care regulation and patient rights within their scope. |

The table is a synthesis, not a statutory classification. National law determines each boundary. [SRC-004](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-004), [SRC-008](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-008), [SRC-018](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-018), [SRC-050](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-050), [SRC-088](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-088)

## Suppliers support sharing under defined roles

A supplier may host records as a processor, determine a separate processing purpose as a controller, or have another role. Processor terms must reflect the legal requirements of Article 28. The organisation remains accountable for its own arrangements. Hosting a care record does not itself authorise reuse for a supplier's separate purpose. [SRC-172](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-172), [SRC-005](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-005)

Continue to the [national comparison](https://uk-digital-healthcare-legal-requirements.pages.dev/comparison/index.md), [digital exchange account](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/interoperability/index.md) or [care-sharing examples](https://uk-digital-healthcare-legal-requirements.pages.dev/decision-workflow/index.md).