NHS Pilot Adds GP Records to Palantir Data Platform

Five general practices in Cheshire and Merseyside have begun sharing patient records with a Palantir-built NHS data platform, extending the technology into primary care for the first time publicly documented at this scale. The FT report, published September 13, said the records feed a Strategic Commissioning Tool within the local version of the Federated Data Platform, or FDP. NHS Cheshire and Merseyside described the work as a limited pilot intended to test whether general-practice data can improve population-health planning.

The numerical footprint is small but the policy boundary is significant. The integrated care board serves about 2.7 million people through 337 GP practices, according to its local data, so five practices represent only a narrow slice of the region. Yet GP records can contain years of diagnoses, prescriptions, test results and contacts that are not available in hospital-only datasets. Bringing those records into a commissioning tool changes both the analytical value of the platform and the privacy questions surrounding it.

The pilot does not establish that GP records have entered the FDP’s national layer, and local officials say data-sharing agreements are in place with the participating practices. That distinction matters because a 2023 ministerial statement said GP data would not be part of the national platform. The immediate issue is therefore not a proven nationwide transfer but whether a locally governed expansion can deliver measurable planning benefits without weakening transparency, patient choice or confidence in the NHS’s wider data strategy.

What the Local Pilot Changes

The FDP is software that connects information already held by NHS organisations rather than a single new national database. NHS England’s programme update said trusts and integrated care systems can use local instances to link data for purposes such as care coordination when lawful agreements already exist. The same document drew a line around the national platform, stating that GP data would not be included there. Cheshire and Merseyside’s pilot relies on the local side of that architecture.

That design creates a governance problem that is technical and institutional at the same time. Data can remain under local control while being processed through software supplied under a national contract. The NHS decides which datasets and users are permitted, while Palantir provides the operating environment. On its healthcare page, the company describes itself as connecting information held in separate NHS databases and says customers control how the software is used. That processor role limits Palantir’s legal discretion, but it does not remove the NHS’s obligation to justify access and communicate the purpose to patients.

Public descriptions do not yet provide a complete inventory of the fields transferred by the five practices, the frequency of updates, how long data are retained or which staff roles can view identifiable records. Those details determine the practical risk. A tool using pseudonymised, minimised extracts for aggregate planning presents a different exposure from one allowing operational users to inspect named patient histories. The pilot’s value and its privacy profile cannot be assessed fully until those controls are described with comparable precision.

Why Primary-Care Records Matter

Primary care is the front door to the health system and the longest-running clinical record for many patients. GP data can show chronic conditions, vaccination status, repeat prescriptions and patterns of care that hospital episode data miss. For commissioners, linking those records to hospital activity can help estimate unmet need, identify variation between neighbourhoods and plan capacity. It can also reveal where poor access in the community is followed by avoidable emergency use, although an association in linked data does not prove what caused a patient’s outcome.

The analytical gain depends on coverage and data quality. A five-practice pilot can test pipelines, coding consistency, access controls and whether resulting dashboards answer useful questions. It cannot by itself describe the health of a region with hundreds of practices, especially if participating surgeries differ from nonparticipants. Analysts will need to document missingness, demographic representation and changes in coding before treating any result as a population estimate.

NHS England presents the FDP as a way to help staff deliver care and use resources more efficiently. Its benefits page reports improvements observed by organisations using platform tools, but it explicitly says other variables were not controlled and causal conclusions cannot be drawn. That caveat should govern the Cheshire and Merseyside pilot as well. Adoption, functioning data flows and a useful dashboard are outputs; they are not yet evidence of better access, lower costs or improved health.

Privacy Rules Depend on Purpose

Health information receives special protection under UK data law, but the applicable safeguards and patient choices depend on why it is used. An NHS privacy notice for another FDP product illustrates the model: NHS trusts are controllers, Palantir is a processor acting on their instructions, and identifiable data used for direct care are restricted to care teams and authorised support staff. A commissioning tool may have a different legal basis and user group, which should be stated in a pilot-specific notice.

The national data opt-out generally lets people prevent confidential information from being used beyond direct care for research and planning, subject to exemptions. The NHS’s public guidance stresses that patients can change the choice at any time. Whether and how that opt-out applies to each function of the Strategic Commissioning Tool is therefore not a minor technical detail. Population-health management can span direct-care coordination and broader planning, and the boundary needs to be visible to patients as well as data-protection officers.

Access management has already drawn scrutiny elsewhere in the programme. In May, Reuters reported that a small number of external administrators could receive broad access to identifiable data while building the National Data Integration Tenant. NHS England said those individuals require security clearance and director-level approval, and that access is audited. Palantir said processing outside NHS instructions would be illegal and technically blocked. Those controls are relevant context, but the local pilot still needs its own role-based access design and audit trail.

Trust Has Become an Operational Constraint

Public confidence now affects the usefulness of NHS data infrastructure. Earlier this month, health innovation minister James Frith said mistrust of Palantir could reduce willingness to share data with the NHS. A reported 60,000 additional people registered national data opt-outs between mid-May and mid-July, while the official opt-out dashboard provides the continuing measure. Opting out does not block use of records for direct care, but it can reduce data available for planning and research, making transparency an operational requirement rather than a communications afterthought.

Debate over effectiveness makes that trust problem harder. Palantir has pointed to more operations, shorter discharge delays for long-stay patients and faster cancer diagnoses among organisations using FDP tools. NHS England has published similar observations but warns against inferring cause and effect. In August, the Office for Statistics Regulation said the evidence presented to the public had produced a confused picture and required clearer caveats. The regulator noted that a Health Foundation analysis found no measurable discharge improvement across trusts using one FDP application, although the analyses examined different patient groups.

That disagreement does not show that the platform is ineffective, but it demonstrates why evaluation design matters. A credible assessment of the GP pilot should define the decisions the tool is meant to improve, establish baseline performance, compare participating practices with appropriate controls and measure both benefits and harms. Useful outcomes might include earlier identification of unmet need, more equitable service allocation, less manual data preparation and fewer avoidable delays. Each requires a method that separates the tool’s contribution from staffing changes, seasonal demand and other interventions.

The Next Decision Is About Scale

Before expansion, NHS Cheshire and Merseyside should be able to show which data elements entered the platform, whether records were identifiable or pseudonymised at each stage, who approved access, how opt-outs were applied and when information will be deleted. It should also publish the pilot’s evaluation criteria and explain how patients and practices can challenge inaccuracies. Those are ordinary controls for a sensitive data programme, but they carry extra weight because the original national assurance excluded GP data and because the supplier’s role is politically contested.

The five-practice experiment is therefore evidence of a new local use, not proof of a national policy reversal or a successful population-health intervention. The technology may help commissioners connect fragmented evidence and target services more intelligently. Its legitimacy will depend on whether local governance remains meaningful when software, standards and procurement are national, and whether benefits are demonstrated with more than adoption statistics. The next material development will be a transparent evaluation and a public decision on whether this limited pilot should remain local, change design or expand.