Information Governance in a Connected NHS

If you’ve been following the digital transformation journey of the NHS, you’ll know that two themes keep coming up again and again: interoperability and patient data access. Whether we’re talking about FHIR APIs, openEHR clinical repositories, or the NHS App, the goal is the same—get data flowing safely across systems so that patients and clinicians can make better decisions.

But here’s the thing: none of that matters unless we get one big piece of the puzzle right—information governance.

You can build the most advanced FHIR-based APIs, the smartest AI decision-support tools, or the sleekest patient app. But if the governance of that data isn’t rock solid—if patients don’t trust how their data is handled, if clinicians worry about liability, or if regulators think you’re cutting corners—then the whole digital health vision falls apart.

So, let’s break down what information governance in a connected NHS really means, why it’s so challenging, and how the principles of FHIR, interoperability, and UK data protection frameworks come together to make it work in practice.

Why Information Governance is So Critical in the NHS

Think about your last interaction with healthcare. Maybe you booked a GP appointment through the NHS App, had a hospital scan, or ordered a repeat prescription. Each of those actions generated sensitive data about you—your demographics, clinical notes, test results, and sometimes even mental health details.

This isn’t just “any” data. It’s special category data under UK GDPR. In other words, the most sensitive type of personal information, requiring the highest level of protection.

Now layer on top the NHS’s ambition to create a connected, data-driven healthcare system. That means your GP data linking to hospital records, flowing through to community services, and maybe even being used for research or public health. Suddenly, your data isn’t just sitting in one system—it’s moving between many, often via FHIR APIs or openEHR repositories.

Without proper information governance, that’s a recipe for risk: data breaches, loss of trust, and even harm to patients if the wrong data gets shared.

That’s why governance is the backbone of a connected NHS. It’s not about slowing things down with red tape. It’s about creating the guardrails that let innovation flourish safely.

What Do We Mean by Information Governance?

At its core, information governance (IG) is about how health and care organisations collect, store, share, and use information in a way that’s:

Lawful (complies with UK GDPR, Data Protection Act 2018, and NHS rules)
Secure (protected from breaches and misuse)
Ethical (respects patient expectations and confidentiality)
Transparent (patients understand how their data is used)
Accountable (organisations can prove they’re following the rules)

In practice, IG in the NHS covers:

Data sharing agreements between GP practices, hospitals, and third-party vendors.
Role-based access controls so only the right people see the right data.
Audit trails so every access and change to patient records is logged.
Patient consent models, from implied consent for direct care to explicit opt-in for research.
Information governance training for all staff handling health data.

And increasingly, it also means making sure digital innovations like FHIR-based Patient Access APIs, AI algorithms, and cloud-hosted platforms fit into this governance framework.

The Connected NHS: Where FHIR Fits In

You can’t talk about a connected NHS without mentioning FHIR (Fast Healthcare Interoperability Resources). It’s the standard the NHS has adopted for data exchange. From GP Connect to the NHS App, FHIR is already at the heart of how data flows across the system.

But here’s the twist: while FHIR is fantastic for interoperability, it also raises new information governance questions. For example:

If a patient uses a third-party diabetes app connected to their GP record via a FHIR API, who is responsible for safeguarding that data once it leaves the GP system?
How do we make sure apps connecting via FHIR APIs go through proper assurance so they don’t mishandle sensitive information?
What role does the patient’s NHS Login authentication play in ensuring only the right individual can access their record?

This is where NHS Digital’s API assurance framework comes in, ensuring that any app using FHIR UK Core APIs has been tested not just for technical compliance, but also for governance and security.

So, while FHIR gives us the pipes to connect systems, information governance gives us the rules for how water should flow through those pipes safely.

UK Frameworks for Information Governance

In the UK, information governance in healthcare is shaped by a mix of law, regulation, and NHS-specific frameworks. Let’s run through the key ones you’ll hear about:

UK GDPR & Data Protection Act 2018
These set out the legal basis for processing patient data. Healthcare data usually falls under “special category data,” which requires additional safeguards.
Caldicott Principles
A set of rules developed back in the 1990s, still central today. They stress that patient data should only be shared on a “need-to-know basis” and that patient confidentiality is paramount.
NHS Data Security and Protection Toolkit (DSPT)
All organisations that process NHS data must complete this self-assessment annually to prove they meet governance and security standards.
NHS Information Governance Policy Framework
This provides detailed guidance for NHS organisations on records management, data sharing, confidentiality, and patient rights.
NHSX / NHS England Interoperability Strategy
This promotes open standards like FHIR UK Core and openEHR, while ensuring IG considerations are baked into every national digital programme.

So when we say information governance in a connected NHS, it’s really about weaving all these frameworks together to enable safe, lawful, and trusted data sharing.

Real-World Scenarios: Governance in Action

Let’s make this less abstract. Here are a few practical examples where information governance meets interoperability:

Patient Access APIs (FHIR)
When patients use the NHS App to view their GP record, governance ensures they authenticate via NHS Login, the data is encrypted in transit, and access is logged.
Research and Secondary Use of Data
Anonymised data may flow from NHS Trusts into research databases. Governance here means making sure the data is properly de-identified, patients’ opt-outs are respected, and access is tightly controlled.
Shared Care Records
Integrated Care Systems (ICSs) across England are building shared care records, often using a mix of FHIR APIs and openEHR repositories. IG ensures that only authorised clinicians can view sensitive patient data across organisational boundaries.
Third-Party Health Apps
If a startup builds an app that connects to GP data via FHIR, IG requires that the app passes NHS assurance checks, protects patient privacy, and makes clear how data will be used.

Each of these examples shows how governance isn’t an afterthought—it’s built into the design of connected health services.

Challenges in a Connected NHS

Of course, getting governance right in practice is easier said than done. Some of the big challenges include:

Balancing access with privacy: Patients want their clinicians to have full access to their record, but they may not want all their information shared with all providers. Fine-grained consent models are still tricky to implement.
Managing third-party apps: As FHIR APIs open up NHS data, more third-party apps will want to connect. Ensuring they meet security and governance standards is a huge task.
Legacy systems: Many NHS organisations still rely on old EHR systems that weren’t built for interoperability or modern governance controls. Retrofitting IG into these systems is challenging.
Public trust: High-profile controversies—like concerns over NHS data being shared with tech companies—have made patients wary. Transparent communication is essential to maintain trust.
Workforce understanding: Not every clinician or admin staff member is an IG expert. Training and culture change are as important as technical safeguards.

Opportunities Ahead

Despite the challenges, the opportunities of strong IG in a connected NHS are enormous:

Empowered patients: With the right governance, patients can safely use apps to view and manage their records, reducing admin burden on the NHS.
Improved care coordination: Shared care records become possible when governance frameworks ensure safe data flows across GP, hospital, and community systems.
Research and innovation: Properly governed data sets can power breakthroughs in life sciences, AI, and personalised medicine.
International leadership: By combining FHIR, openEHR, and strong IG, the UK can position itself as a global leader in digital health.

In other words, information governance isn’t just a compliance exercise. It’s the enabler of everything the NHS wants to achieve with digital transformation.

Looking to the Future

If we imagine the NHS five to ten years from now, it’s easy to see where things are heading. Patients will expect to access all their health data through the NHS App or their chosen app, powered by FHIR APIs. Clinicians will expect seamless access to longitudinal patient records stored in openEHR repositories. Researchers will expect access to large, high-quality, de-identified data sets for population health.

All of that only works if information governance keeps pace. That means:

Embedding IG into every digital project from day one.
Updating the Caldicott principles for the age of FHIR APIs and AI.
Ensuring that security, privacy, and transparency are not optional extras, but core design principles.
Building public trust through clear communication and patient involvement.

The connected NHS of the future won’t just be about technology—it will be about trust. And trust is built through strong information governance.

Final Thoughts

So, when we talk about information governance in a connected NHS, we’re really talking about the glue that holds the whole digital transformation together. FHIR gives us interoperability. openEHR gives us structured data storage. But governance ensures it’s all safe, lawful, and trusted.

For patients, that means confidence their data is secure and used appropriately. For clinicians, it means better access without fear of crossing legal lines. And for the NHS, it means unlocking the full potential of data-driven care without sacrificing trust.

The journey isn’t simple. But one thing is clear: without robust information governance, the vision of a connected, digital NHS simply won’t work. With it, the NHS can finally deliver on the promise of seamless, patient-centred, data-driven healthcare.