UK health data access needs tighter identity governance, not just data sharing

At a glance

What this is: This is an analysis of how the UK Data (Use and Access) Bill changes health data governance, with the key finding that access control, not data availability, becomes the critical constraint.

Why it matters: It matters because NHS and healthcare IAM teams will need to align SSO, role-based access and record-level governance without weakening privacy, safety or compliance.

Context

The UK Data (Use and Access) Bill is reshaping how patient data will be collected, shared and managed across the NHS and community healthcare hubs. In practical terms, the problem is not whether data exists, but whether identity governance can ensure the right person gets the right record at the right moment.

This is an identity governance issue because the same environment must support care delivery, mobility across departments, and research access without flattening access rules into one broad entitlement model. The article frames the challenge around SSO, role-based access and information standards that suppliers will need to follow.

The pressure point is that connected care only works if governance keeps pace with the operational reality of shifting roles, changing tasks and expanding data reuse. That makes this less a data-sharing story than an access assurance story for healthcare programmes.

Key questions

Q: How should healthcare teams control access to a single patient record?

A: They should tie access to the current care task, not just the staff member’s role or department. The safest model uses role-based permissions, step-up checks for sensitive record views, and audit trails that show who accessed what and why. That keeps connected care usable without turning the single patient record into open-ended visibility.

Q: Why does simple role-based access control create risk in healthcare applications?

A: Simple RBAC creates risk because healthcare access is rarely uniform. A doctor may need different access for different patients, documents, dates, and treatment contexts. When teams rely only on broad roles, they tend to overgrant access or build brittle exceptions, which increases the chance of inappropriate disclosure and makes compliance harder to sustain.

Q: Why is SSO not enough for clinical systems?

A: Because authentication only proves who is signing in, not what they should be able to do in a specific care context. In a healthcare hub, the same person may need different access depending on task, department and device. SSO should therefore sit inside a broader authorisation model, not replace one.

Q: What should security teams do when patient data is reused for research?

A: They should separate operational care access from research access and make consent, anonymisation and purpose limitation explicit in the governance flow. Research use changes the risk profile because the data may be repurposed over time, even when it is not duplicated across systems. Identity controls still need to enforce who can approve and use it.

Technical breakdown

Single patient record governance and identity context

A single patient record changes the access model from isolated departmental systems to a shared record spanning multiple workflows. That means identity is no longer just about logging in, but about expressing clinical context, department, task and device trust at the point of access. In healthcare environments, the same person may need different record views across a shift, so access policy has to reflect task scope rather than job title alone. The technical challenge is to avoid turning federation and SSO into a blanket entitlement mechanism.

Practical implication: design access so the record stays shared while permissions remain task-scoped and auditable.

Role-based access control for clinical mobility

Role-based access control is a fit only when roles are precise enough to reflect real clinical work. The article’s nurse example shows why static roles often fail in practice: vaccinations, record updates and minor procedures do not carry the same data access requirement. That creates a need for role design that is narrower than ward-level access and more dynamic than simple user grouping. If access is too coarse, privacy and safety suffer; if it is too granular, staff workflow breaks down.

Practical implication: review clinical roles against actual tasks, not organisational titles or departments.

Information standards and supplier enforcement

The Bill gives new powers to define information standards that health and care services, including IT suppliers, must follow. That matters because interoperability is not just a data format problem, it is a governance problem that determines how access, sharing and management are implemented across systems. In a connected NHS model, suppliers become part of the control surface, since inconsistent interpretation of standards can fragment both access and oversight. The control objective is consistent handling of health data across the full service chain.

Practical implication: treat supplier conformance as part of identity governance, not a separate procurement checklist.

NHI Mgmt Group analysis

Health data sharing fails when governance stops at the record and ignores the identity. The article shows that a shared patient record is only safe if access conditions travel with the record across departments, devices and care settings. In healthcare, the access decision is the control point, not the storage layer. Practitioners should therefore treat identity governance as the operating model for connected care, not as an add-on.

Clinical mobility exposes the weakness of static role models. A nurse moving between tasks may need restricted record updates in one part of the day and fuller access later. That breaks role assumptions built around fixed job functions and departmental boundaries. The practical conclusion is that healthcare IAM must be designed around task, context and evidence of need, not around convenience-driven broad access.

Information standards turn suppliers into governance participants. When the Bill requires services and their IT suppliers to follow defined standards, access control becomes an ecosystem issue rather than an internal policy issue. That expands the accountability surface for NHS programmes and makes supplier alignment part of access assurance. The implication is that governance teams need a consistent model that works across every system touching the shared record.

Research use of patient data needs consent-aware identity governance, not just anonymisation. The article’s focus on Health Data Research Service and genomics shows that privacy risk does not end when data is repurposed for research. Access, consent and purpose limitation still matter because the data estate is being expanded and reused over time. The field should read this as a signal that research governance and operational IAM are converging.

From our research library:

• 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.

What this signals

Task-scoped healthcare access is becoming the operating requirement. As shared patient records spread across NHS hubs, broad access models will create more friction than value because clinical work changes by moment, not by job description. IAM leaders should expect pressure to move from static role assignment toward context-aware authorisation and clearer record-level governance.

Consent and purpose limitation will matter more as research use expands. Once patient data is reused for genomics and wider research, governance cannot stop at anonymisation. Identity, approval and access controls need to reflect who is using the data, for what purpose and under which safeguards, or trust erodes as usage scales.

For practitioners

• Tighten task-based access rules Map clinical tasks to record views so a user receives only the patient data needed for that activity, rather than a broad ward-level entitlement.
• Review SSO against context-aware access Keep single sign-on, but add task and role checks so authentication does not become a blanket authorisation decision across all care settings.
• Align supplier controls to information standards Require healthcare IT suppliers to implement the same data collection, sharing and management rules so governance stays consistent across systems.
• Separate care access from research access Define distinct approval paths for live care, anonymised research use and genomics programmes so purpose limitation remains explicit as datasets expand.

Key takeaways

• The main risk is not simply exposure of patient data, but access becoming too broad or too rigid for clinical reality.
• The article ties the issue to connected care, shared records and research reuse, which means identity governance now shapes both safety and compliance.
• NHS and supplier teams should align role design, task-based access and information standards before the shared record model expands further.

Key terms

• Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.
• Single patient record: A single patient record is a shared record model that allows information to follow the patient across services and organisations. It improves continuity, but it also makes access governance, attribution, and boundary control more important because the same data can be touched by more roles in more places.
• Information standards: Common rules for how health data must be collected, shared and managed across services and suppliers. They matter because interoperability fails when each system interprets access and data handling differently, so standards become a governance mechanism as much as a technical one.
• Role-Based Access Control: A model that grants permissions by assigning identities to predefined roles. It works well when jobs are stable and access patterns are predictable, but it becomes brittle when exceptions pile up. In practice, role design must stay small enough to audit and broad enough to avoid endless custom variants.

Deepen your knowledge

Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.