Health Bill: The introduction of the Single Patient Record

The Health Bill, introduced in the House of Commons on 14 May 2026, will abolish NHS England and transfer the bulk of its functions to the Secretary of State for Health and Social Care (the "Secretary of State") and to integrated care boards ("ICBs"). 

We previously covered the background to the Bill and what this means for Patient Choice in our article here. In this update, we look specifically at the introduction of the Single Patient Record (“SPR”).

Further updates will follow as we look at the other proposals in the new Bill.

The need for a Single Patient Record

The government’s proposal to introduce one single digital database for all NHS patient data responds to the longstanding fragmentation of health data across primary, secondary and social care.

The SPR is intended to create a unified health and care record for each patient in England, bringing together information from across different care settings into a single, reliable data source. The ambition is for patients to access their SPR via the NHS App, while health and social care professionals will have secure access to the information needed to deliver coordinated care and treatment. The SPR will be developed in phases and over time, data will be added from a range of systems and care pathways based on prioritised use cases.

The SPR is positioned as a central element of the government’s wider 10 Year Health Plan for England, underpinning ambitions to create a more co-ordinated and efficient healthcare system and supporting a shift towards more personalised care.

The proposed changes & scope

The Health Bill proposes to insert sections 250E and 250F into the NHS Act 2006, conferring far‑reaching powers onto the Secretary of State to design and operate the SPR. Crucially, the Secretary of State will achieve this by introducing secondary legislation in the form of new regulations to establish the framework and govern how the SPR will operate in practice. These regulations will be subject to consultation.

Section 250E(1) empowers the Secretary of State to establish a system for making patient information readily available to all NHS patients, as well as “people involved in the provision to patients of health care or social care in England” to the extent necessary to undertake their role. The explanatory notes to the Health Bill confirm that the SPR will be available to all professionals involved in the direct care of patients even where that care is delivered by independent providers, whether independent sector providers are treating NHS or private patients.  

Regulations may make provision requiring or authorising the disclosure or other processing of patient information, or information held in connection with it, for the purpose of making it available via the SPR.[1] The explanatory note to the Health Bill states:

“This provision [section 250E(2)(b)] does not limit who can be asked, or required, by the regulations to provide information as long as it is patient information, or information held in relation to the patient information […], and will be used for the purpose of establishing and operating the Single Patient Record. This could include NHS and private providers of health and care services […] and IT suppliers etc.”[2] (Emphasis added)

It therefore appears that the SPR will collate patient information from a wide-range of sources, requiring both NHS and independent healthcare providers to contribute. Implementing regulations and the issuing of guidance will be critical for setting out how this information will be collected. 

Interestingly, the Health Bill further enables the Secretary of State to establish enforcement powers. The Secretary of State, Care Quality Commission or a Special Health Authority may be able to impose financial penalties for non‑compliance with SPR requirements. Section 250F sets out an enforcement framework for those penalties, although the exact amount or method of determining the financial penalties will be introduced by further regulations.

Our thoughts

The sharing and pooling of sensitive patient data poses a risk to data security, and clear, robust data security measures are paramount to ensuring patient data is protected and this will be at the forefront of developing the SPR.

The SPR impact statement acknowledges the risk of losing public trust in the system if there is a failure to implement data security measures that comply with all relevant regulations and best practices, including clear parameters for data processing and an appropriate legal basis. To support maintaining and improving public trust and confidence in the SPR will require clear communications about how patient data is used and who can access it. The Health Bill proposes at section 250E(4) the Secretary of State must “ensure that adequate safeguards are in place to prevent the improper use of information”. Healthcare professionals will access the SPR via a “secure interface”, so they can give appropriate, safe and more coordinated care. However, what the secure interface and protective measures will look like in practice remains to be seen.

The NHS is accustomed to working with a large number of well-established independent healthcare providers, who will likely need to demonstrate on an ongoing basis that their information governance procedures are legally robust and secure if they wish to secure NHS contracts. It may also become common for KPIs to be included in contracts between NHS Commissioners and independent sector providers in relation to SPR compliance. The next step will be to review and consider the secondary legislation and respond to consultations in due course.

If you would like to discuss this article or if you have any other questions, please contact Patrick Parkin, Amanda Leiu, Lisa Mulholland, Lizzy Marke or another member of the Burges Salmon team.

This article was written by Alex Bones, Lisa Mulholland and Amanda Leiu.