Legislation – Data (Use and Access) Act 2025
Changes to legislation:
There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Schedule 15.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
Schedule 15Information standards for health and adult social care in England
1
Chapter 1 of Part 9 of the Health and Social Care Act 2012 (health and adult social care services: information standards) is amended as follows.
2
“Powers to publish standards”.
3
(1)
Section 250 (powers to publish information standards) is amended as follows.
(2)
In subsection (2), at the end insert “and includes, among other things, a standard relating to information technology or IT services used, or intended to be used, in connection with the processing of information (see section 250A)”
.
(3)
In subsection (2B)(c)—
(a)
after “provision” insert “in, or in relation to, England”
, and
(b)
omit “in England”.
(4)
“(e)
a relevant IT provider.”
(5)
In subsection (3)—
(a)
after “provision” insert “in, or in relation to, England”
, and
(b)
omit “in England”.
(6)
In subsection (7)—
(a)
in the opening words, for “section” substitute “Chapter”
,
(b)
““information technology” includes—
(a)
computers,
(b)
other devices whose uses include the processing of information by electronic means (“IT devices”),
(c)
parts, accessories and other equipment made or adapted for use in connection with computers or IT devices,
(d)
software and code made or adapted for use in connection with computers or IT devices, and
(e)
networks and other infrastructure (whether physical or virtual) used in connection with other information technology;
“IT service” means an information technology service, including any service (whether physical or virtual) which consists of, or is provided in connection with, the development, making available, operation or maintenance of information technology;”,
(c)
in the definition of “processing”, omit “and (14)”, and
(d)
““relevant IT provider” means a person involved in marketing, supplying, providing or otherwise making available—
(a)
information technology,
(b)
an IT service, or
(c)
a service which consists of processing information using information technology,
whether for payment or free of charge, but only so far as the technology or service is used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care.”
4
“250AStandards relating to information technology
(1)
An information standard relating to information technology or IT services may, among other things, make provision about—
(a)
the design, quality, capabilities or other characteristics of such technology or services;
(b)
contracts or other arrangements under which such technology or services are marketed, supplied, provided or otherwise made available.
(2)
An information standard may include technical provision about information technology or IT services, including provision about—
(a)
functionality;
(b)
connectivity;
(c)
interoperability;
(d)
portability;
(e)
storage of, and access to, information;
(f)
security of information.
(3)
An information standard may make provision by reference to open standards or proprietary standards.”
5
(1)
Section 251 (information standards: procedure etc) is amended as follows.
(2)
In the heading omit “Information standards:”.
(3)
“(3)
The power under section 250(1) may be exercised by—
(a)
adopting an information standard prepared or published by another person, including as it has effect from time to time, or
(b)
making provision by reference to an international agreement or another document, including as it has effect from time to time.”
6
“Compliance with standards”.
7
For the heading of section 251ZA (information standards: compliance) substitute “Monitoring compliance”
.
8
“251ZBNotice requesting compliance by relevant IT providers
(1)
If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may give the provider a written notice which—
(a)
identifies the standard in question,
(b)
sets out the Secretary of State’s grounds for suspecting that the provider is not complying with the standard,
(c)
asks the provider to comply with the standard within a period specified in the notice,
(d)
asks the provider, within a period specified in the notice, to provide evidence to the Secretary of State’s satisfaction that the provider is complying with the standard, and
(e)
if the Secretary of State considers it appropriate, sets out the steps that the Secretary of State considers the provider must take, within a period specified in the notice, in order to comply with the standard.
(2)
(3)
The Secretary of State may, by giving the relevant IT provider a further written notice, vary or revoke a notice given under subsection (1).
251ZCPublic censure of relevant IT providers
(1)
If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may publish a statement to that effect.
(2)
The statement may include the text of a notice given to the provider under section 251ZB.
(3)
Before publishing a statement under this section, the Secretary of State must give the relevant IT provider—
(a)
a copy of the terms of the proposed statement, and
(b)
an opportunity to make representations about the decision to publish a statement and the terms of the statement.
(4)
If, after considering any representations, the Secretary of State decides to publish the statement, the Secretary of State must inform the relevant IT provider before publishing it.
(5)
This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section).
(6)
In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).
251ZDExercise of functions of Secretary of State by other persons
(1)
The Secretary of State may—
(a)
direct a public body to exercise some or all of the functions listed in subsection (3), and
(b)
give the public body directions about the exercise of those functions, including directions about the processing of information that the body obtains in exercising those functions.
(2)
The Secretary of State may make arrangements for a person prescribed by regulations under this subsection to exercise some or all of the functions listed in subsection (3).
(3)
Those functions are—
(a)
the Secretary of State’s functions under section 251ZA, so far as they relate to relevant IT providers, and
(b)
the Secretary of State’s functions under section 251ZB.
(4)
Arrangements under subsection (2) may—
(a)
provide for the Secretary of State to make payments to the person, and
(b)
make provision as to the circumstances in which such payments are to be repaid to the Secretary of State.
(5)
Section 304(9) applies in relation to the power to make arrangements under subsection (2) as it applies to a power of the Secretary of State to give directions under this Act.
Accreditation
251ZEAccreditation of information technology etc
(1)
Regulations may make provision for the establishment and operation of a scheme for the accreditation of information technology and IT services so far as used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care.
(2)
The regulations may provide for the scheme to be established and operated by a person specified in the regulations (“the operator”).
(3)
The regulations may, among other things, confer power on the operator—
(a)
to establish the procedure for accreditation under the scheme,
(b)
to set the criteria for accreditation under the scheme (“the accreditation criteria”),
(c)
to keep an accreditation under the scheme under review, and
(d)
to charge a reasonable fee in respect of an application for accreditation.
(4)
The regulations may, among other things, make provision requiring the operator—
(a)
to set some or all of the accreditation criteria by reference to information standards,
(b)
to publish details of the scheme, including the accreditation criteria,
(c)
to provide for the review of a decision to refuse an application for accreditation, and
(d)
to provide advice to applicants for accreditation with a view to ensuring that the accreditation criteria are met.”