Using patient data for research: Challenges and policy developments

Approximate read time: 11 minutes

The House of Lords is scheduled to consider the following question for short debate on 10 September 2026:

Lord Patel (Crossbench) to ask His Majesty’s Government what assessment they have made of the use of patient data for research.

1. Key points

• Patient data research has helped improve diagnosis, treatment and understanding of diseases. NHS data, in particular, includes medical histories of a large, diverse population going back decades.
• Researchers can access anonymised health data through secure databases, but often face delays and challenges with data quality, governance and fragmented systems.
• Protecting privacy, preventing data breaches and maintaining public trust remain concerns for stakeholders.
• The government is launching the Health Data Research Service to make health data simpler for approved researchers to access. It is expected to launch its first elements by the end of 2026.

2. Patient data overview

Large-scale patient datasets have supported research into understanding diseases and drivers of ill-health, as well as improving diagnosis and treatment.^[1] NHS data, particularly, has been described as “exceptional and globally important”, holding medical histories of a large, diverse population going back decades.^[2]

Researchers can apply to access patient data held in national databases.^[3] If the researcher and their project are approved, they can only access data relevant to their project. Any information which might identify specific patients is removed.

NHS England runs a secure national database, known as a secure data environment (or SDE), which contains secondary care data (such as hospital records), prescription data and mortality data. There are also ten regional SDEs which contain health data including imaging (such as X-rays and scans) and genomic data.^[4]

Some GP practices provide patient records to national data platforms for research. Patients can opt out of their data being used for research and planning.^[5] As of July 2026, the opt-out rate was 5.69%.^[6]

There are also databases run by health charities which include patient records from people with specific health conditions who have given their consent. For example, the UK Cystic Fibrosis registry, managed by the Cystic Fibrosis Trust, includes data from over 99% of UK cystic fibrosis patients.^[7]

As well as data collected about patients during treatment, some projects collect data specifically for research.

The UK Biobank includes data from 500,000 volunteers and Our Future Health aims to recruit 5 million volunteers.^[8] Both projects collect lifestyle, environmental and health data, making long-term health information about the volunteers available for research.

Other large-scale projects include Genomics England’s research environment: one of the largest genomic datasets linked to clinical data.^[9] The data is intended to enable research into personalised medicine for rare conditions and cancer.

3. Challenges and risks

Researchers have reported barriers and delays in accessing data necessary for research.^[10] There are a range of potential technical, governance, security and quality challenges.

• Quality: The primary purpose of collecting data in NHS settings is patient care. The data is often a combination of qualitative notes, letters, test results and images which means it is not straightforward to collate or analyse for research.^[11] Around 80% of patient data is not organised in a standard format.
• Technical: Data is often stored across multiple systems, making it challenging to access and piece together. There have also been issues with digital systems and IT infrastructure in the NHS: maintaining and upgrading data systems requires expertise and investment. In Lord Darzi’s independent investigation of the NHS in England, he noted “chronic capital underinvestment” in technology and struggles with data sharing.^[12]
• Governance: Data controllers, including GP practices and NHS trusts, decide how data is used. They must ensure compliance with the UK General Data Protection Regulation (GDPR) and the common law duty of confidentiality, and that required safeguards are in place and consent has been given.^[13] Evidence suggests data controllers can tend to be risk-averse about data sharing due to complex governance processes.^[14]
• Security: While safeguards are a feature of the databases designed to hold patient data, the potential for data breaches is a key concern for public trust in data sharing.^[15] A recent example saw UK Biobank data downloaded by approved researchers and offered for sale online in April 2026.^[16] UK Biobank has set out actions to strengthen data protection subsequently.^[17]
• Public trust: Evidence suggests that the majority of the public are supportive of their patient data being used to improve healthcare outcomes, in principle. NHS England research in 2024 showed trust in the NHS itself handling data was highest, followed by medical research charities and universities and research institutions, with private sector pharmaceutical and tech companies least trusted.^[18] However, researchers have found people remained concerned about data handling and the motivations of private companies who may use the data.^[19] Previously in the UK, projects such as Care.data and General Practice Data for Planning and Research were suspended following public concerns.^[20]

4. Patient data policy developments

4.1 Sudlow review and the Health Data Research Service

In 2024, an independent review, ‘Uniting the UK’s health data: A huge opportunity for society’, also known as the Sudlow review, made recommendations about health data and research. It said:

• leading government health and research bodies should establish a national health data service for England with accountable senior leadership
• major national public bodies with responsibility for, or interest in, health data should agree a joint strategy to make England’s health data a critical national infrastructure
• the Department for Health and Social Care (DHSC) should oversee and commission a strategy for ongoing, coordinated engagement with patients, public, health professionals, policymakers and politicians
• the health and social care departments in the four UK nations should set a UK-wide approach for data access processes and proportionate data governance
• national organisations in the four UK nations should develop a UK-wide system for standards and accreditation of SDEs holding data from the health and care system

Following the review’s recommendations, in April 2025 the government announced the creation of the Health Data Research Service (HDRS), alongside £500mn of government funding and £100mn from UK research charity Wellcome. Launching the HDRS is one of the six main actions in the Starmer government’s 2025 ‘life sciences sector plan’. The plan said HDRS would be:

[…] the world’s most advanced, secure, and AI-ready health data platform. It will unite genomic, diagnostic, and clinical data at population scale, turning NHS and wider healthcare data into a magnet for global trials and AI investment.

The HDRS is intended to provide a single route for approved researchers to securely access and analyse national health data. Its six goals are to provide:^[21]

• secure access to linked primary care, hospital, prescribing and mortality data at national scale, so researchers can see “a complete picture of patients’ journeys through the health system”
• “research-ready” datasets, building on large cohort studies and biobank data
• access to advanced diagnostics data, including images, laboratory results and genomic data
• integration of health data with the platforms researchers use to help conduct clinical trials
• a single entry point to various secure research environments, with standardised agreements and approval processes
• the ability to link health data with information from other sectors, such as environmental or social data

The HDRS is expected to launch some elements of its service by the end of 2026, with more rolled out as they are developed. Baroness Blackwood of North Oxford (Conservative) was appointed chair of the service in November 2025. Baroness Blackwood is chair of Oxford University Innovation and Genomics England and serves on boards in the biotechnology sector.^[22] In evidence to the House of Lords Science and Technology Committee in June 2026, Baroness Blackwood said with the HDRS’s work, the UK “will become a better place to do clinical trials but it will also improve the health and life expectancy that we see in the public”.^[23]

While stakeholders are broadly in favour of the aims of the HDRS, careful development, robust data security, consultation, and public trust have been highlighted as key areas of focus in its development.^[24]

4.2 Other NHS data initiatives

There are two other key recent developments in NHS data:

• The federated data platform (FDP) connects health information across NHS systems to support planning and delivery. It includes data analysis tools to address challenges such as waiting list management and discharge planning.^[25]
• The single patient record (SPR) is intended to allow patients and healthcare professionals to see all of the patient’s records in one place.^[26] Currently, for example, GP and hospital records are usually kept separately where care is received.

These initiatives are separate from the HDRS. The SPR and FDP are designed for patient care, rather than research. However, the SPR could support research where there is a legal basis.

The single patient record is being legislated for in the Health Bill, which is currently in the House of Commons.^[27] As currently drafted, Clause 47 would allow the SPR to be used for secondary purposes, such as planning and research, where there is already existing legislation that authorises this. Details of the delivery of the SPR are currently unconfirmed as the bill progresses.

Some stakeholders have criticised the FDP over the procurement of data analytics firm Palantir to deliver the platform. NHS England has awarded a contract for a “robust, independent evaluation” of the FDP to Imperial College London this year: the university’s final report is expected in 2029.^[28]

The use of international third-party providers to process NHS data has been a topic of concern for some MPs and peers.^[29] For example, the House of Commons Science, Innovation and Technology Committee has raised concerns around vendor lock-in (when a provider is deeply embedded in an organisation’s systems, making it difficult to switch), data security, public trust and exposure to foreign and ideological influence.^[30]

5. Read more

• Parliamentary Office of Science and Technology, ‘Accessing national health data for research’, 16 July 2026

---

Cover image by ar130405 from Pixabay.