16 NHS non-users of Palantir's platform in 25-plus FOI replies; NHS England lists at least one of them as live

16 of at least 25, against 235 organisations

The Guardian reported on 17 October 2026 that, in "more than two dozen" freedom of information responses it reviewed, 16 NHS trusts and health boards said they do not use the Federated Data Platform (FDP), the platform NHS England bought from a consortium led by Palantir. More than two dozen means 25 or more, so 16 is at most 64% of the replies it reviewed (derived). Against the 235 trusts and integrated care boards in England (199 trusts and 36 boards, derived from NHS England's organisation data), 25 replies are at least 10.6% of the organisations (derived), and 16 is 6.8% of 235 (derived). Those last two figures are arithmetic on a sample whose selection is not stated. They are not a rate for the service.

What that does not establish. It does not establish how the replies were chosen: the Guardian says the responses were gathered by Medact, a health campaign that opposes Palantir's role in the NHS, and posted to WhatDoTheyKnow, and does not say how it picked its set from that pool. It does not establish what "do not use" covers, because each reply is a body describing itself in answer to a question it was asked. It does not show that any of the 16 is required to use the platform: a ministerial letter of 21 August says "There is therefore no requirement to use the FDP". It does not measure what the platform does for waiting lists, which NHS England says it cannot do from its own before and after figures: "We cannot therefore draw conclusions about cause and effect". And it does not say when the government must decide about the contract, because two official sources give the end of the contract's initial term as 15 February 2027 and as March 2027.

The second checkable fact. NHS England's uptake page, updated on 25 September, counts 142 trusts and 35 integrated care boards as live, and 137 trusts as reporting benefits, as at the end of August. The University Hospitals of North Midlands NHS Trust, which the Guardian lists among the 16, is on the live list in bold, the page's mark for a trust "realising benefits". Its own reply, dated 24 July, says "FDP is not live. We do not intend to roll it out in the future." The two documents are 63 days apart (derived) and use "live" in different ways, which is the subject of the middle of this briefing.

Interests, in one sentence. Palantir Technologies UK Limited leads the consortium that holds the contract and so has a commercial interest in uptake, Medact campaigns against the contract, and NHS England is both the buyer and the publisher of the uptake figures.

What was read. The Guardian's report in full; the contract and its notice on Contracts Finder; NHS England's uptake, methods, contract, FAQ, privacy and data protection impact assessment pages and its programme board minutes; the letters from the Health and Social Care Committee, the National Data Guardian and the health minister; the Science, Innovation and Technology Committee report; and the replies themselves on WhatDoTheyKnow. Palantir's response is read only as the Guardian prints it: no statement published by Palantir was found. Everything is as read on 17 October 2026, and the NHS England lists change each quarter.

Who picked the replies, and from how many

The Guardian's wording is that the FOIs "were gathered by Medact" and "posted to a public transparency website, WhatDoTheyKnow". The replies it quotes can be found there. Seven of the eight bodies whose quoted replies were located sit in one WhatDoTheyKnow batch titled "Up to date information on Apps adopted by the trust as part of the Federated Data Platform rollout", sent to 203 authorities on 26 June 2026: Dorset HealthCare, University Hospitals of North Midlands, Humber Teaching, University Hospitals Birmingham, Cambridgeshire and Peterborough, West Suffolk, and Avon and Wiltshire Mental Health Partnership. The eighth, NHS Greater Manchester Integrated Care Board, answered a sibling request to integrated care boards. On 17 October the site marked 173 of the 203 requests in the batch successful, 22 long overdue, 4 awaiting internal review, 2 awaiting classification, 1 refused and 1 handled by post (counted from the batch page).

If the Guardian's set came from this batch, 25 replies is at least 14.5% of the 173 marked successful (derived). That is a floor: the Guardian does not give the exact count and does not say the set came from this batch. Medact's July report says its requests went to "every trust in England" in two rounds with a third under way, so the pool may be wider than one batch. A selection of 25 or more from 173 or more tells a reader what some bodies wrote. It cannot say how many of the rest would write the same, or something different.

The question defines its own term. The batch asks: "Is the federated data platform currently live at your trust (where live means having the platform available for the trust to use, known as a local instance)?" A body that answers "no" is saying it has no local instance. The Guardian does not say which question, or which test, produced its 16.

The Guardian's sample, stated against not stated. Read from the Guardian's report of 17 October 2026 and the WhatDoTheyKnow pages; counts of the batch are derived from the batch page.

Question	Stated	Not stated
How many replies were reviewed	"More than two dozen FOI responses"; so 25 or more.	The exact number, and a list of them.
Who gathered them	Medact, a health campaign that opposes Palantir's role in the NHS; the replies are public on WhatDoTheyKnow.	How the Guardian chose its set from the pool, or whether any reply was left out.
How many do not use it	"16 trusts and health boards declared they do not use it".	The split between trusts and care boards, the names of all 16, and the date of each reply.
What the others said	Some said the platform made waiting lists easier to manage and improved surgery scheduling (the Guardian's summary).	How many; whether they are in the 25 or beyond it.
The test applied	The batch question defines live as having a local instance.	Whether the Guardian's 16 rests on that test, or on each body's own words.
The pool it came from	One batch of 203 requests, 173 marked successful; Medact says earlier rounds went to every trust.	Whether the Guardian's set is from this batch, an earlier round or both.

What NHS England counts, and against what

NHS England's uptake page says the platform "is available for all trusts and integrated care boards in England", that the numbers update every three months, and that the next update is December 2026. As printed on the 25 September update, with shares derived against two denominators: the government's own figure of 205 providers of secondary and tertiary care (Lords written answer HL14478, 24 February 2026) and the 199 NHS trust records in force for England on the NHS organisation data service (derived: 247 active records, less 45 with a legal end date and 3 Welsh trusts). The two denominators do not match and the record does not say why. The contract itself funds "up to 240 NHS organisations".

NHS England's published counts, as at end of August 2026 (page updated 25 September), with product counts as at end of June. Shares are derived.

NHS England's count, as printed	Share (derived)	Not stated
**Signed up:** 170 trusts and 35 ICBs. A trust or board that has "signed a Memorandum of Understanding (MOU) to join".	82.9% of 205 providers; 85.4% of 199 ODS trusts. ICBs: 35 of 36 (97.2%); NHS Greater Manchester is the one not signed up.	What the MOU requires of the signatory, and by when.
**Live:** 142 trusts and 35 ICBs. For a board, "live with an NHS Federated Data Platform tenant"; for a trust, "live on the NHS Federated Data Platform".	69.3% of 205; 71.4% of 199. 28 signed-up trusts are not live.	The test for a trust. The page gives a list of names, not a definition of live, and counts a body by name, not by use.
**Reporting benefits:** 137 trusts, "through the use of different types of products", some of which "relate to data analysis and submission tools" for back-office work.	66.8% of 205; 68.8% of 199. 5 live trusts are not reporting benefits.	How many of the 137 use a product that supports patient care.
**Patient-care products, end of June:** inpatient theatres module 40 trusts, inpatient waiting-list module 37, referral to treatment validation 31, OPTICA discharge planning 30, outpatient 16, Cancer 360 six using and five realising benefits.	The largest, 40 trusts, is 19.5% of 205.	Overlap between products; why product counts are end of June while the headline counts are end of August.

Three series, not one. The programme board's minutes of 6 November 2025 say "157 Trusts had formally signed up to implement the FDP. A total of 125 Trusts were live / in delivery." The Lords answer says that at the end of January 2026 "110 NHS trusts live or in delivery" and 167 signed up. On those printed figures signed-up trusts rose by 10 while "live or in delivery" fell by 15 (derived). By the end of August the page prints 170 signed up and 142 live. The three sources use three labels, and none says whether the same test was applied each time.

One more figure, not verified at source. Medact's July report cites a BMJ report of NHS England data released under FOI: only 85 of 139 live trusts recorded any user activity in the eight apps the data covered in the year to June 2026. The BMJ report and the release were not read for this briefing, so the figure is attributed here and not relied on. It is the kind of count the checklists below ask for.

Ten bodies against two NHS England lists

For the eight bodies the Guardian quotes whose replies could be located, and two more trusts whose replies sit in the same batch, a reply can be set beside NHS England's two lists. Replies are dated 29 June to 31 July 2026 (the Birmingham follow-up is 18 September); NHS England's data is as at the end of August. Wording is as printed in the replies.

Replies on WhatDoTheyKnow and a Greater Manchester disclosure log, set against NHS England's signed-up and live lists (page updated 25 September 2026). "Bold" is the live list's mark for a trust realising benefits.

Body and reply date	What its own reply says	NHS England's lists
University Hospitals of North Midlands NHS Trust, 24 July (named by the Guardian)	"FDP is not live. We do not intend to roll it out in the future." Main reason: "it does not appear to provide functionality over and above what we have already". It trialled two products "for a few weeks".	Signed up. Live, in bold.
Royal Cornwall Hospitals NHS Trust, 23 July (not named by the Guardian)	Not live: "has not implemented a local instance of the FDP although are compliant with the four key data flows". Plans to re-appraise after a new patient record goes live in April 2027.	Signed up. Live, in bold.
Gateshead Health NHS Foundation Trust, 31 July (not named by the Guardian)	Live: "onboarded ... with select functionality in use"; three products implemented; "no active users for CCS or OPTICA", because "Lack of integration with other Trusts systems led to increased workloads for operational teams".	Signed up. Live, in bold.
Humber Teaching NHS Foundation Trust, 23 July and 3 August	"the FDP is not live in our Trust, and we have no plans to use it." On review: its own platform and NHS-owned products "already exceed the functionality currently provided by the FDP".	Signed up. Not on the live list.
Cambridgeshire and Peterborough NHS Foundation Trust, 29 June	Not live. "Plans for FDP rollout within this Financial Year", OPTICA first; "FDP to date has not offered significant improvements on local systems". Of a crisis tool it considered: "No trial has happened, only a review of the product demonstration".	Signed up. Not on the live list.
West Suffolk NHS Foundation Trust, 6 July	"WSFT does not use FDP, and no rollout dates have been agreed." Reason: "We have other systems that currently supersede the functionality on offer from the FDP."	Signed up. Not on the live list.
Avon and Wiltshire Mental Health Partnership NHS Trust, 2 July	"No, we are not live." In discussion with NHS England, "active and will continue during 2026-27"; no app yet offers "significantly more than our local reporting / EPR capabilities".	Not on either list.
Dorset HealthCare University NHS Foundation Trust, 23 July	"has not adopted the FDP and will not be adopting or going live with the FDP"; uses an in-house service that gives "more local relevant data".	Not on either list.
University Hospitals Birmingham NHS Foundation Trust, July and 18 September	"currently not live"; the barrier is "limited expected benefit over existing solutions". A request for detail was withheld under section 24(1), national security.	Not on either list.
NHS Greater Manchester Integrated Care Board, 3 July	"deferred adoption"; "no plans to roll FDP out". Five factors: public trust, professional support, no peer-reviewed evaluation, no cost estimate, and an offer that is "duplicative" and "a retrograde step".	Not among the 35 boards signed up or live.

Counted from the table (derived). Of the eight bodies the Guardian quotes, 4 are on NHS England's signed-up list, 1 is on its live list and 4 are on neither. The Guardian writes only "from Gateshead to Truro", so the two further trusts, Royal Cornwall Hospitals and Gateshead Health, are matched by place and by reply text, not by the Guardian's wording; each is listed live in bold, while its own reply says it has no local instance, or no active users of two of its three products.

Three readings, each an inference. One: the sources define "live" differently, since the batch asks about a local instance and NHS England's trust count has no stated test. Two: NHS England's count may include trusts that send national data flows through the platform; Royal Cornwall's reply says it is "compliant with the four key data flows" without a local instance. Three: the list lags, since it is a quarterly snapshot, though a trust saying in July that it does not intend to roll the platform out is unlikely to have gone live by the end of August. Neither NHS England nor the trusts say which reading holds.

Two places where the Guardian's description and the located reply differ or are missing. The Guardian says Cambridgeshire and Peterborough "has used the system"; the 29 June reply read here says that no trial of the one product it considered has happened and that a roll-out is planned this financial year. The Guardian may have read another reply, which was not found. And "not live" is not "rejected": one reply says discussions with NHS England continue, another that roll-out is planned.

Is use required?

The Guardian's headline says trusts "rejected" the platform. Whether a trust may reject it depends on whether use is required, and the documents use different words for that, including one trust's own word, "mandated".

What NHS England, the programme board, the department and the Health and Social Care Committee say about requirement. Wording as printed.

Source and date	Wording	Leaves open
NHS England FAQ, quoting its Medium Term Planning Framework 2026/27 to 2028/29	"sets out the expectation that all providers and integrated care boards onboard to the NHS Federated Data Platform and start making use of core products ... by 2028/29".	Whether a body with a local alternative must still onboard; what follows if it does not; what onboard means.
Programme board minutes, 6 November 2025	The framework "encourages local organisations to adopt FDP as their primary platform, particularly when renewing product licences or procuring new solutions".	Primary for what, and who checks.
NHS England FAQ	"Each NHS trust and ICB is the data controller for their instance ... They can choose which national solutions and products to use."	Choice of products, or of whether to have an instance at all.
Overarching data protection impact assessment, issued 5 July 2024	"Local FDP User Organisations decide whether to use FDP, what Products to use, what data to commit to FDP and how to use it".	Whether that still holds after the 2025 framework.
Health and Social Care Committee letter, 8 July 2026	Welcomes "your clarification that you would not mandate the use of the FDP where better tools exist", citing the minister's oral evidence.	The oral evidence was not read.
Leicestershire Partnership NHS Trust, reply of 8 July 2026 (on neither NHS England list)	"The use of Palantir has been mandated to all NHS organisations and, although the trust has not yet commenced work to transfer to the new provider, we expect to do so."	Whether NHS England told the trust so; the trust is counted by neither list.
Minister's reply to the committee, 21 August 2026	"There is therefore no requirement to use the FDP. NHS England has never mandated its use or forced any ICB or NHS Trust to use it."	Whether an "expectation" with a 2028/29 date counts.

Read together, the documents describe an expectation, an encouragement, a choice, a mandate and no requirement. None says what happens to a body that has not onboarded by 2028/29. The same letter says NHS Greater Manchester has "not signed up", while "all the NHS Trusts in Greater Manchester have". So a board can decline while its trusts sign, which is one more reason a count of "trusts and health boards" mixes two kinds of body.

The contract, as published: dates, exit and measures

The contract sits on Contracts Finder: a notice published on 22 December 2023, replaced on 21 March 2024, with the agreement in four redacted parts. The parts read in full for this section are clauses 4, 7, 33 and 34 and the definitions, Schedule 2.2 on performance levels and Schedule 7.2 on payments on termination. Prices and the key performance targets are redacted under section 43 of the Freedom of Information Act, commercial interests.

The contract, stated against not stated. Contracts Finder notice of 21 March 2024 and the published agreement, NHS England's contract explainer, the Science, Innovation and Technology Committee report of 3 June 2026 and ministers' statements.

Item	Stated	Not stated
Value	Notice value £182,242,760, "not a committed amount"; it "could increase to a forecasted amount of £330m. This figure is also not a committed amount." Minister, 16 April: "up to £330 million over a maximum of the seven-year term. So far, £210 million has been invested". Schedule 7.1: service charges are "scalable by the metrics set out in Annex 2", payable quarterly for services "consumed".	What the metrics are; what the £210 million covers; a price per trust. The Annex 2 charging tables are redacted.
Start	Agreement "made on 22 November 2023". NHS England: "formally began in March 2024"; its uptake page says roll-out to trusts began in April 2024.	The contract's Go Live Date as a calendar date in the text read.
End of the initial term	Contracts Finder end date 15 February 2027; the committee: "The initial three-year commitment ends on 15 February 2027". NHS England: "The initial three year term comes up in March 2027." The contract: three years "from and including the Go Live Date".	Why the two dates differ by about a month.
Extension	Clause 4.1: the agreement ends "at the end of the Initial Term" unless the Authority "elects to extend" by "at least 90 days' notice". One extension of 2 years, then two of 12 months; NHS England gives a potential end of March 2031.	Who signs the notice and what the review must find.
Exit	Clause 33.1(a): the Authority may terminate "for convenience at any time" and pay a Termination Payment: unpaid charges plus an "Unavoidable Fixed Price Loss Amount", capped at the fixed-price charges that would have been payable.	The amount; the loss amount's definition is redacted.
"Break clause"	Used by the committee ("the February 2027 break clause"), by ministers and by the Guardian.	The word "break" does not appear in the four published parts as extracted.
Measures	Schedule 2.2 sets availability, system response time, service-request response and fix time, with service credits as the Authority's usual financial remedy for a failure.	The KPI targets table (redacted). No uptake or adoption measure appears in the unredacted text read.
Decision	Minister, 16 April: "We will decide later this year whether to extend it." Letter, 21 August: review "expected to complete in the Autumn"; a successor contract is "unlikely" to be in place "by March".	The date of the decision, and what evidence will be published.

The dates, as arithmetic (all derived). The Guardian's report came 1,060 days after the agreement was made and 121 days before 15 February 2027. If 15 February is the last day of the initial term, 90 days before it is 17 November 2026, 31 days after the Guardian's report. If the term instead ends in March 2027, as NHS England's page says, the same count falls between 1 and 31 December 2026. The published text gives no calendar Go Live Date, so the record does not settle which.

The action that needs a date is the extension, not a break. By clause 4.1 the agreement ends at the end of the initial term unless the Authority gives notice to extend. Separately it may terminate for convenience at any time, at a cost. "Break clause" is the label committees and the press use for the decision at the end of the initial term. That label, a friendly name, makes the choice sound like an act of exit; the text makes it a choice to continue.

Ceilings are not payments. At the ceiling, £330 million over seven years is £47.1 million a year and £1.375 million for each of 240 funded organisations (derived). The notice value of £182,242,760 over the 3.23 years to 15 February 2027 is £56.4 million a year (derived). The notice says the Authority "pays for data platform services as they are consumed", so neither is a price per trust, and the minister's £210 million is 63.6% of the ceiling (derived) without a statement of what it covers.

The words doing the work

Each of these words appears in the coverage or in NHS England's own pages, and each does work that a count cannot. The third column says what the word hides.

Labels read in the Guardian's report, NHS England's pages, the contract and the replies, with what each hides.

Word	Where it appears	What it hides
"rejected", "declined"	Guardian headline and standfirst	Replies from "will not be adopting" to "in discussion with NHS England" and "plans for roll-out within this financial year". A body that has not adopted may be late, in talks or committed.
"mandated"	One trust's reply (Leicestershire Partnership); the minister says "no requirement"	A body that believes use is required answers "not yet" where another answers "no". Both are "not live" in a count.
"do not use it"	Guardian: 16 "trusts and health boards"	Two kinds of body, and two tests: no local instance, or no product in use. The record does not give the split.
"trial", "reverted"	Guardian	A trial of "a few weeks" at one trust; "no trial" at another; "no active users" at a third.
"signed up", "onboarded"	NHS England (a memorandum of understanding); minutes ("formally signed up to implement")	A signature. The uptake page does not say what the MOU commits a trust to do, or by when.
"live"	NHS England list; the FOI question; the programme board ("live / in delivery")	At least two tests: a name on a list, and a local instance. Trusts answer "not live" while listed live.
"reporting benefits"	NHS England; Guardian quoting NHS England	Back-office analysis tools count alongside patient-care products, and the benefit figures are before and after comparisons with no controls.
"duplicative"	NHS Greater Manchester ICB reply	One of five stated factors, the others being public trust, professional support, no peer-reviewed evaluation and no cost estimate. The department's reply calls the board's system an analytics platform that cannot "enact specific actions related to direct patient care".
"federated"	The platform's name	Each trust and board runs its own instance and is its own controller, on the same software under one national contract. Federation here means data can be shared across instances where agreed, not that buyers choose the supplier.
"platform"	Everywhere	National instances, local instances, products, privacy-enhancing technology and national data flows are counted under one word.
"break clause"	Committee, ministers, Guardian	The published text has an end of the initial term, an extension notice and a termination for convenience, and no clause with that name.

What each party says, as attributed

Statements are given as printed and attributed. A company's account of itself is a claim, and a public body describing its own use is a description.

Responses to the Guardian's report and the nearest primary statements, read 17 October 2026.

Party and source	Says	Not stated or not found
Palantir, a spokesperson quoted by the Guardian	Accused Medact of "slanted analysis" and of "misleading the public"; "The FDP is, objectively, a successful programme"; its purpose, in the Guardian's paraphrase, is to give trusts tools to draw on depending on their existing capabilities and needs. It points to 117,000 additional operations and a 14.3% fall in discharge delays for long-stay patients, which match NHS England's 117,539 and 14.34% (before and after comparisons).	A statement published by Palantir (none found); a reply to any named trust.
NHS England, a spokesperson quoted by the Guardian	"137 NHS trusts have now reported benefits from the wide range of tools available on the platform".	Whether any of the 16 is among the 137, and how "reported" is tested.
The health minister, letter of 21 August 2026	There is "no requirement" to use it; Greater Manchester's own system "cannot enact specific actions related to direct patient care" and scaling it nationally "is unproven"; a successor contract by March is "unlikely".	The evidence for "unproven"; the decision.
The National Data Guardian, letter of 9 October 2026	"There is evidence that a significant number of local organisations" are "reluctant to actively adopt", citing "concerns about the supplier, the overhead costs of managing local objections, and a preference for other solutions"; the "trust factor" should have "substantial weight"; the benefits evidence is "a mixed picture".	How many organisations; the independent evaluations "will not conclude in time to inform current decisions".
Office for Statistics Regulation, 22 July 2026	NHS England added its cause-and-effect caveat on 6 June and agreed to caveat the uptake page, publish a schedule for trust-level benefit data and say that case studies are written by the organisations using the platform.	Anything on the uptake counts: the statement concerns benefit metrics.
Imperial College London, draft evaluation strategy	A "final report will be shared at the end of the project, in April 2029".	Interim findings, before the contract decision.

UK health-data governance: what each instrument decides, and where it stops

None of the instruments below decides whether a trust uses the platform. They decide who is accountable if it does. Under UK GDPR a controller "determines the purposes and means of the processing" and a processor acts "on behalf of the controller", and a controller "shall use only processors providing sufficient guarantees" under a binding contract. NHS England's privacy notice says each trust or board is controller for its local instance, NHS England for the national instances and jointly for some aspects, and that Palantir (the data platform) and IQVIA (privacy-enhancing technology) are processors acting on written instructions "for each Product that a User Organisation chooses to use". The ICO's controller and processor guidance is marked as under review after the Data (Use and Access) Act. Two earlier briefings are relevant: the ICO's finding of no impact assessment where a police force uploaded people's details to a supplier's platform, and Denmark's account of one company's lawful access reaching most of a national register.

What each instrument decides about uptake, and where it stops. Read 17 October 2026 from the pages named in the sources.

Instrument	What it decides about uptake	Where it stops
UK GDPR articles 4 and 28; NHS England privacy notice	Who is controller and who processor; that a processor needs a written contract and instructions per product. The notice says a trust "makes decisions about how to use the FDP, which Products it wants to use".	It does not say whether to use the platform, or compare it with a local system.
UK GDPR article 35; the overarching DPIA	A DPIA before high-risk processing. The [overarching DPIA](https://www.england.nhs.uk/wp-content/uploads/2024/08/PRN01442ii-overarching-dpia-for-the-federated-data-platform.pdf) (version issued 5 July 2024) says "Local FDP User Organisations decide whether to use FDP"; the minister's letter says the DPIA for the national tenant described supplier access wrongly and is corrected.	It assesses the risk of processing that happens. A body that does not use a product has no product DPIA, and a DPIA does not compare alternatives.
National Data Guardian (advice of 9 October 2026; the Caldicott Principles)	Advice: "Public and professional trust should be given substantial weight when evaluating any supplier of a system involving people's health and care data." The Caldicott Principles set eight tests for using confidential information.	Advice, not a decision. The National Data Guardian says some factors are "outside my remit" and the independent evaluations will come too late for the current decision.
Data Security and Protection Toolkit	A self-assessment against the National Data Guardian's 10 data security standards, which every organisation with access to NHS patient data and systems must use.	It assures how a body secures data it holds. It does not rank platforms or require adoption.
NCSC supply chain security guidance and the Cyber Assessment Framework (principle A4, supply chain)	Twelve principles for understanding supplier risk, establishing control, checking arrangements and improving.	Guidance. It says nothing about this platform and decides no purchase.
Freedom of Information Act 2000, sections 1, 10 and 16	A right to information a body holds, a reply within 20 working days, and a duty to give advice and assistance. Exemptions seen here: section 24(1) (Birmingham) and section 43 (the contract's redactions).	A reply is a self-description. The Act does not oblige a body to create information, so a count is only as comparable as the question.

Where each stops, in one line. The law makes the controller the owner of the decision to use and of the risk if it does. The National Data Guardian advises on trust. The toolkit and the NCSC guidance assure the security of whatever is chosen. No instrument tells a board which of two tools to buy, so the choice sits with the trust, subject to the national framework's expectation and the department's statement that there is no requirement. The independent evaluation by Imperial College London reports in April 2029, and the National Audit Office has a study in progress on patient data integration; the National Data Guardian understands that the independent assessments "will not conclude in time to inform current decisions".

What to do, in order

The question that exposes the gap

A trust can be listed as live and realising benefits by NHS England and say "not live" to its own FOI request in the same quarter. The contract's initial term ends on 15 February 2027 or in March 2027, and notice to extend must be given at least 90 days before: by 17 November 2026 on the February reading, 31 days after the Guardian's report. So which document will the decision rest on, the list of 142 or the replies of the 16, and has anyone asked the 142 to answer the 16's question in the 16's words?

Key facts