Copy article

Leaked NHS Briefing: Palantir staff granted "unlimited access" to identifiable patient data

ended 09. June 2026

A leaked NHS England internal briefing states that staff from Palantir and other external contractors are being granted "unlimited access" to identifiable patient data inside the Federated Data Platform (FDP). The document, reported by the Financial Times and written by a senior NHS England data official in April 2026, creates a new "admin" role giving non-NHS staff broad access to the National Data Integration Tenant (NDIT) - the part of the system holding patient records before they are pseudonymised.

Palantir is not a generic IT supplier. It is an AI and data integration company whose platforms are used across healthcare, defence, intelligence and government sectors. NHS England says Palantir is contractually barred from training AI on patient data or commercialising it.

Privacy is the headline story. The structural story is bigger. The NHS Federated Data Platform forms part of a wider trend towards public services becoming increasingly dependent on proprietary technology platforms maintained by external suppliers. The question is whether existing data protection and governance frameworks were designed to address an AI and data platform vendor operating inside that infrastructure, and what independent mechanisms exist to verify that contractual restrictions are being followed.

The Patients Association says patients were not consulted. The briefing itself acknowledges a "risk of loss of public confidence". MPs have described the move as "dangerous".

We'd like your views:

  • The NHS Federated Data Platform forms part of a wider trend towards public services depending on proprietary technology platforms maintained by external suppliers. What independent mechanisms should exist to audit, verify, or, if needed, replace those platforms over time?
  • NHS England says Palantir is barred from training AI on patient data. When a national healthcare system relies on an external AI and data platform provider, what independent mechanisms exist to verify that contractual restrictions are being followed?
  • The Patients Association says patients were not consulted on a significant change to who has access to their data. What does meaningful patient consent look like once a national platform is already live?
  • What safeguards should government require when awarding long-term AI and data infrastructure contracts that may become deeply embedded within public services?

Sources

  1. The Guardian — https://www.theguardian.com/society/2026/may/11/palantir-access-nhs-england-patient-data
  2. Reuters — https://www.reuters.com/world/uk/britains-nhs-grant-palantir-contractors-unlimited-access-patient-data-ft-reports-2026-05-11/
  3. Digital Health News — https://www.digitalhealth.net/2026/05/palantir-to-be-granted-unlimited-access-to-nhs-patient-data/
  4. The Register — https://www.theregister.com/databases/2026/05/12/nhs-england-confirms-palantir-staff-can-access-patient-data/
  5. Computing — https://www.computing.co.uk/news/2026/government/nhs-palantir-access-to-identifiable-patient-data
  6. Medact briefing (governance / FDP) — https://www.medact.org/2026/resources/briefings/briefing-palantir-fdp/
  7. NHS England (FDP overview) — https://www.england.nhs.uk/digitaltechnology/nhs-federated-data-platform/

2 responses from the Newspage community

Copy all

Star Quote
Copy

Editor
Katrina Young
Futurist | Chief Technology Officer CTO/CDO Ethical AI & Digital Transformation Strategist at KYC Digital
The leaked NHS England briefing confirms Palantir staff and other external contractors are being granted "unlimited access" to identifiable patient data inside the Federated Data Platform. NHS England says Palantir is contractually barred from training AI on the data or commercialising it.

That assurance may well hold. The structural question is whether anyone outside the contract can verify it. When a vendor builds, operates and updates the environment a national system's data sits inside, contractual restrictions are only as strong as the mechanisms that test them. UK GDPR and ICO oversight were not designed for this configuration. Internal audits do not independently verify what happens inside a proprietary platform.
Patients were not consulted because, under current frameworks, they did not need to be.

They are asked to trust the contract. The contract was never designed to be visible to them. That is the architectural failure, not the access change itself.
Copy

Colette Mason
AI Ethics Consultant at Clever Clogs AI
Palantir's co-founder Peter Thiel was asked in a now infamous June 2024 interview last year whether the human race should survive the advent of AI. He hesitated. That's whose company now has admin access to sixty-seven million NHS patient records.

Palantir doesn't sell software and leave. It embeds inside your infrastructure, operates inside your data before pseudonymisation, and the switching cost is the business model to drive their profits. The leak shows just how bitter the pill is to swallow.