Concerns voiced as Palantir wins £330m NHS data contract

NHS England has awarded US IT group Palantir the contract to create a new federated data platform (FDP) designed to bring together existing NHS data into a single framework, reigniting debate about patient privacy and the security of medical records.

Palantir has been charged with leading the roll-out of new software next spring to deliver “better joined-up care for millions of patients, help tackle waiting lists, and reduce hospital discharge delays,” said NHS England in a statement. Accenture, PwC, NECS, and Carnall Farrar will also support the project, which could be worth “up to £330 million” over the next seven years.

Media attention has focused on Palantir – chaired by Donald Trump ally and PayPal co-founder Peter Thiel, who has said publicly he believes the NHS should be privatised – and concerns about handing over detailed patient data to a private, overseas company that some claim has a chequered ethical record.

Amnesty International said Palantir was a “very troubling choice”, given “human rights controversies” surrounding the company, alluding to its involvement in the controversial data-driven deportation programme implemented by the Trump administration, which is alleged to have separated children from families, and the provision of tech used by governments to carry out surveillance on citizens.

For now, the FDP contract seems to stop short of providing access to patient-level data, focusing instead on vacancy data and planning, according to Professor James Davenport, an IT specialist at the University of Bath.

“The main threat here is what the military call ‘mission creep’, as Palantir, etc., say ‘we could do a better job if we had access to a bit more data’,” he said.

NHS England said the FDP will cover real-time data, such as the number of beds in a hospital, the size of elective waiting lists, staff rosters, the availability of medical supplies and social care places, and will help efficient use of resources, It stressed that GP data will not be fed into the system, and it will not be accessible for research purposes.

“No company involved in the Federated Data Platform can access health and care data without the explicit permission of the NHS,” it asserted. “All data within the platform is under the control of the NHS and will only be used for direct care and planning.”

Amnesty International’s business and human rights director, Peter Frankental, said the public needs “assurance that their personal information won’t be harvested by Palantir for purposes that have little to do with their health”, adding that the tech firm “should be required to give cast-iron guarantees that they won’t monetise health data collected from the NHS.”

There were also concerns voiced in the build-up to the contract being awarded that the procurement process has been flawed, secretive, and uncompetitive, with a poorly defined scope that raised the risk of uncontrolled and spiralling costs.

One other outstanding issue is patient consent, something which has scuppered other NHS projects, such as the GP data-sharing initiative. An earlier YouGov poll suggested that 48% of UK adults who have not yet opted out are likely to do so if the FDP is run by a private company.

While patient-level data isn’t in scope at the moment, Professor Andrew Morris, director of Health Data UK (HDR UK), the National Institute for Health Data Science, said they "are worried that concerns about the platform may lead people to use opt-outs that will have no impact on the federated data platform, but will harm important medical research.” 

“Public confidence and demonstrating trustworthiness is crucial,” he added. “If people have questions about the FDP that they feel aren’t being answered, or there are some that want to protest the move, the National Opt-out Scheme is likely to be used as a route to express this. But NHS England states that opt-outs would not apply to the FDP.”

The British Medical Association also criticised the decision, stating that their "fears about how patient information may be used and handled going forwards" have not diminished.”

Finally, some commentators have questioned whether the FDP is needed at all. Professor Jon Crowcroft, Marconi professor of communications systems at the University of Cambridge, said the UK already has “federated processing across all the main centres for health research, and doing it for patient services operationally is much easier.”

He added that the Data and Analytics Research Environments (DARE UK) project “addresses ethical, legal, and policy challenges and fixed all of them and now has technology out there. It’s a UK-funded programme and only uses UK-funded people – why give money to a sketchy overseas outfit with known behaviour that is not aligned with NHS ethos?”