World news and discussion on TalkFuse.
NHS England rapped over inaccurate Palantir patient data disclosure
NHS England has admitted that a data protection document wrongly described who could access patient information, failing to disclose that staff from US contractor Palantir could view identifiable data within part of its Federated Data Platform. The admission followed a request for clarification from the National Data Guardian (NDG), an independent body that advises on health data confidentiality, and has renewed concerns about transparency and oversight of Palantir's expanding role within the NHS.
The error concerned the platform's National Data Integration Tenant, where Palantir staff can access identifiable patient data for specific technical purposes, a fact not accurately reflected in the Data Protection Impact Assessment. Palantir won a £330 million contract for the platform in 2023, having previously secured £60 million in uncompeted COVID-era NHS contracts. NHS England said it was correcting the error and apologised, while NDG Nicola Byrne warned that public trust erodes quickly when data access comes as a surprise, noting continued political sensitivity around Palantir's involvement. Campaign group medConfidential was more critical, calling the mistake a symptom of a "culture of fear" around the programme rather than a simple typo.
In short
- NHS England wrongly omitted Palantir's access to identifiable patient data in official filing
- National Data Guardian prompted correction, warns trust erodes without transparency
- Critics say error reflects deeper governance issues in £330m NHS-Palantir contract
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Privacy advocates argue that patients and the public have a fundamental right to know precisely who can access sensitive medical records, and that transparency about supplier involvement is not a bureaucratic nicety but the bedrock of informed consent. When disclosures about a company such as Palantir's access turn out to be inaccurate, trust in the entire data-sharing system is undermined, potentially deterring people from seeking care or being honest with clinicians. They contend that robust, accurate reporting requirements are essential safeguards against scope creep, commercial exploitation of health data, and erosion of the doctor-patient relationship.
The case against
NHS England and its defenders could reasonably argue that building large-scale data infrastructure, especially amid urgent operational pressures, involves complex technical arrangements that are difficult to communicate with perfect precision at every stage, and that an honest administrative error should not be conflated with bad faith or secrecy. They would emphasise that platforms like the one Palantir supports are intended to improve patient outcomes through better data integration, and that excessively rigid disclosure demands risk slowing beneficial innovation, diverting resources from care delivery, or discouraging necessary partnerships with technology suppliers who can help modernise an overstretched health service.
Explained simply
Palantir is a US technology company hired by the NHS to help manage patient health data. In 2023 it won a major £330 million contract for an NHS system called the Federated Data Platform, and had previously secured £60 million in contracts during the COVID-19 pandemic.
NHS England admitted that its official data protection documents were inaccurate about who could access patient information on the platform. The documents failed to disclose that Palantir's own staff could view identifiable patient data—information that could be traced back to individuals—for technical work on the system.
This matters because patient information is highly sensitive and personal, and public trust depends on transparency about who can access it. The admission has raised questions about oversight of how international technology contractors access confidential health data within the NHS.