NHS Expands Palantir Access To Identifiable Patient Data 

NHS England (NHSE) is set to grant staff from Palantir and other external consultancies “admin” roles providing broad access to identifiable patient data. This shift, reported bythe Financial Times, involves the National Data Integration Tenant (NDIT), a repository where data is held before being pseudonymized for wider system use. 

Shift in Data Access Policy 

Previously, individuals working with the NDIT were required to apply for specific data access approvals on a case-by-case basis. The new policy introduces an “admin” role that grantsexternal staff “unlimited access” to these identifiable records. Internal briefing notes indicate that external workers requested these enhanced permissions because the existing process ofapplying for individual approvals was deemed “too inconvenient”. 

Oversight and Security Protocols 

NHSE maintains that rigorous safeguards remain in effect. According to an NHS spokesperson: 

• External staff must possess government security clearance. 

• Access must be approved by an NHSE staff member at the director level or above. 

• Regular audits and monitoring of engineer activities are conducted to ensure compliance. 

Palantir, which signed a £330 million contract in 2023 to provide the Federated Data Platform (FDP), emphasized its role as a “data processor”. The company stated that its software can only process data according to precise customer instructions, and that granular access controls overseen by the NHS make unauthorized use “technically impossible”. 

Public Trust and Cybersecurity Risks 

Despite these assurances, the policy change has raised internal and external alarms. A senior NHS data official’s briefing acknowledged a potential “risk of loss of publicconfidence” regarding data safeguarding. Cybersecurity experts warn that granting broad admin access increases the risk of a significant data breach, noting that a single compromised account could lead to an unprecedented exposure of UK patient records. To mitigate these risks, the internal note recommends capping the number of external admins andi mplementing time-limited access reviews. 

Filed in General. Read more about Privacy.