NHS England admits Palantir staff can see patient data

NHS England admitted its data protection assessment wrongly said only health staff could see identifiable patient data. Palantir and other supplier staff can too, per PublicTechnology.

That assessment exists to tell patients who touches their records. Getting the access list wrong undercuts the point of filing it at all.

It says it's fixing the mistake. "We are correcting that error, and we apologise for any confusion this has caused," it said, per PublicTechnology.

National Data Guardian Dr Nicola Byrne wrote to NHS England demanding clarity on contractor access. The failure, she said, "has shown how quickly confidence erodes if the no surprises Principle is not upheld."

The story drew 119 points on Hacker News, with The Register and HSJ running their own corroborating coverage, per PublicTechnology.

Byrne's letter turns a paperwork error into a disclosure problem. Expect NHS England to end up naming every supplier with access to identifiable patient data, not just Palantir. Watch whether that comes voluntarily or only after another prompt from Byrne's office.

Both the correction and Byrne's letter surfaced on August 3.