Britain is in the thick of a 30-year reorganisation of the state – what Tony Blair began in the 1990s, Prime Minister Sir Keir Starmer is now looking to continue – and Artificial Intelligence is merely the latest machinery of constitutional change.
The Prime Minister’s 10-year plan to integrate AI into the NHS and create a fully digital single patient record appears to be centralisation under the guise of digitisation, with a view to saving the flagship project of the post-War consensus otherwise falling apart in front of our eyes. Because the NHS remains the core element of any remaining consensus, the direction in which it’s being reformed can act as a weathervane for intuiting the direction of the state more broadly. This post considers both reforms relating to AI and broader efforts at centralisation in the NHS and asks what constitutional risks they pose.
Patient Data
The Government envisages creating a Single Patient Record, accessible via the NHS app by 2028, through which the NHS will aggregate all of a patient’s health data into a single controlled record. Patients will be able to read, share, and update their own care plans in-App, and it will allow doctors to access a person’s medical history across different locations. The Government are also planning to offer genome sequencing at birth to all parents with a view to turning the NHS from a disease-curing damage-response service into a preventative one.
Under this vision, the NHS will be tasked with collecting and managing the biological data of British subjects on behalf of the state – and it may significantly enrich private companies along the way. Current NHS plans foresee creating a fully digital single patient record, with the option of live data being streamed from wearables monitoring biomarkers of UK citizens at home instead of scheduling follow-up appointments, thus cutting waiting times for more urgent cases.
While this might be admirable in principle, too little thought has really been given to the profound change this would represent within the NHS. In practice, it likely means taking the NHS ever-further from the intended model of decentralised GP surgeries, in which every practitioner knows local residents, develops a personal relationship with them, and acts to calm fears, diagnose issues and treat ill health. The Government also seems to favour the slow phasing out of GPs running their own practices in favour of doctors with salaried roles run by Integrated Care Boards, whose stated focus is “reducing health inequalities”. Laudable as this goal may be, it has the air of a performance target, as compared with a GP-centric human approach.
There are problems, too, with the NHS, and ultimately the Government, acting as a data controller of this kind. GDPR compliance means that all personal data collected must be adequate, relevant, and limited to what is strictly necessary for the intended purpose. However, defining what is strictly necessary in terms of potential medical research is challenging and risks overreach – particularly when there are financial motivations for the NHS to share such data with the private sector in developing medicines.
In the meantime, questions of an individual’s right to decide what is done with their data remain crucial. In June 2025 doctors referred NHS England to the Information Commissioner’s Office over concerns that patient data gathered during the COVID-19 pandemic was being used to train the AI model Foresight without patient consent, and as of 24 March 2026, the British Medical Association is considering collective action around patient data sharing.
Looking to the future, the impact of wide data sharing could be stark. If the NHS is to begin a public-private partnership where patient data is shared with pharmaceutical companies for the purposes of research, adequate safeguards and oversight mechanisms are needed. Implementing a data access register which acts as a log to record who has accessed what data and why would assist with accountability. Ensuring proper data storage and security is tested and operational well ahead of any such move is essential.
In terms of cybersecurity, NHS genomic data must currently be encrypted at rest using AES-256, and in transit at TLS 1.2. The UK Information Commissioner’s Office recognises these as current industry standards, in which AES-256 creates a secret key to encrypt and decrypt information, and the TLS 1.2 handshake creates a secure tunnel, which uses asymmetric encryption to safely exchange a secret key, and then switches to symmetric encryption (such as AES) to secure the data being shared. While TLS 1.2 is still the industry standard, because it is supported by many of the older medical devices, security cameras, and accounting software used by the NHS, this technology was released in 2008, and has since overtaken by the much more advanced TLS 1.3 handshake, released in 2018. There’s a risk that the current ICO standards are becoming outdated, with compliance providing a false sense of security, and the hardware used by the NHS being a limiting factor. Given the highly personal nature of the data, we can’t afford to be complacent.
Beyond cybersecurity questions, where this specific category of extremely personal data is concerned, a question may rightly be posed as to whether the data aggregator should be the entity to profit from its sale, as opposed to the individual. The digitisation of the British state is framed in terms of empowering the people – by allowing easy access to digital records or recording health markers using wearables – but if data is aggregated centrally and then potentially sold on to private companies, how empowering can it really be? Such sales may well help to fund the NHS, but might they not more justly be used to fund the individual, and help mitigate against growing inequality by instituting a new form of digital property ownership over one’s own biological data instead? One gets the impression such concerns are far from the minds of legislators, but they shouldn’t be. The digital revolution in the UK should mirror the constitutional trajectory of the nation, protecting the rights and property of the individual from arbitrary authority.
Centralisation
Alongside data collection and AI training, the Government has taken several steps to centralise NHS governance since it came into office. In March of last year, for example, the Prime Minister announced that NHS England would be abolished as a standalone body, with direct control over its functions being assumed by the Department of Health and Social Care. Part of the rationale for this was to increase ministerial oversight of (and accountability for) the NHS. While accountability is generally positive, it’s worth reflecting on a couple of important specifics.
In particular, Section 95 of the Health and Care Act 2022 had already expanded the Secretary of State’s oversight of data by amending the Health and Social Care Act 2012, introducing a statutory duty for public and private health providers to comply with information standards published by the Secretary of State. The 2022 Act also inserted a new section, 251ZA, which allows the Secretary of State to require both public and private providers to share documents, records, or other information to monitor compliance with data protection standards. Safeguards are necessary, and centralising power in the hands of an elected minister does increase democratic accountability in some sense, as compared with an unelected committee – but aggregating data protection powers in the hands of a minister with political considerations may also carry risks. A further potential issue is that reorganisation may be in part a smokescreen for significant cost cutting. In the case of NHS England, the Government has promised significant redundancies, and this likely precedes the delivery of a full-service digital state (complete with Digital ID) to assist with the further cutting of administrative costs associated with human oversight.
Elsewhere, the re-introduction of the “Earned Autonomy” model from the 2000s under the new 10-year plan means that Integrated Care Boards and NHS Trusts which are identified as failing will be subject to more oversight from the centre, too. Only the highest-performing trusts will be granted autonomy as “Advanced Foundation Trusts”. The risk of the Earned Autonomy approach is that the NHS in poorer or more remote regions of the country may paradoxically end up being run by exactly the type of Whitehall specialists least equipped to understand the problems on the ground – effectively replicating the issues with quangos which the Government is trying to resolve.
This next phase of digital centralisation comes on the heels of the merger of arm’s-length bodies into NHS England in May 2024, which included centralised digital procurement. Plans for April 2026 onwards include the abolition of 12 existing Integrated Care Boards and the creation of 6 new, larger ICBs, with a view to cost reduction. While it probably is true that centralisation will streamline duplicated work and cut costs, removing friction in human oversight means that any potential mistakes may become larger and more costly down the line.
Conclusion
The above reforms to the NHS are, of course, part of a broader picture of the UK state. The Institute for Government confirmed the current government’s overall trend towards centralisation in March 2026, stating that the Prime Minister’s push for moving civil service functions away from Whitehall was not proving successful, and that by the end of this Parliament public services would be more, not less centralised.
While a renewed focus on ministerial oversight may improve both accountability and efficiency, the full breadth of opportunity for reform offered by digitisation has not yet been fully grasped by the Government. Replacing a series of unelected quangos with a series of unelected data analytics companies is not likely to fundamentally improve the British subject’s constitutional relationship to the state, vis-à-vis their biological data. It merely creates more data, and an entity to aggregate it, layered within a system in which people already feel like they are being squeezed out. If the Government is looking to renew the social contract on health for a generation, it might do better to focus on strengthening individual rights to help us navigate a market in which our attention, behaviour patterns, and social relationships are already being monetised for the profit of others.
Anna Richards.
Anna Richards has worked at the Ministry of Defence and House of Commons, and as a Judicial Assistant at the High Court. She writes for the Spectator, the Critic, and UnHerd, and is currently researching ECHR reform as part of a Pamela Thomas Research Award with the Society of Conservative Lawyers.
The Constitution Society is committed to the promotion of informed debate and is politically impartial. Any views expressed in this article are the personal views of the author and not those of The Constitution Society.