Health and Social Care Act 2012

CHAPTER 1 E+W Information standards

250 Powers to publish information standards E+W

(1) The Secretary of State or [F1 NHS England] may prepare and publish an information standard.

[F2 (2) For the purposes of this Part “an information standard” is a standard in relation to the processing of information.

(2A) An information standard must specify to whom it applies.

(2B) An information standard may apply to one or more persons falling within the following paragraphs—

(a) the Secretary of State;

(b) NHS England;

(c) a public body which exercises functions in connection with the provision of health care or of adult social care in England;

(d) any person, other than a public body, who is required to be registered under Chapter 2 of Part 1 of the Health and Social Care Act 2008 in respect of the carrying on of a regulated activity (within the meaning of Part 1 of that Act).]

(3) The Secretary of State may exercise the power under subsection (1) only in relation to information concerning, or connected with, the provision of health [F3 care] or of adult social care in England.

(4) [F4 NHS England] may exercise the power under subsection (1) only in relation to information concerning, or connected with, the provision of NHS services.

F5 (5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F6 (6) The Secretary of State must—

(a) have regard to any information standard published by NHS England that applies to the Secretary of State, and

(b) comply with any information standard published by the Secretary of State that applies to the Secretary of State.

(6A) Any other person to whom an information standard published under this section applies must comply with the information standard, except in so far as the requirement to comply is waived (see subsection (6B)).

(6B) Regulations may confer on a person who publishes an information standard the power to waive a person’s requirement to comply with the information standard (in whole or in part and generally or for a specific period).

(6C) The regulations may include provision—

(a) limiting the circumstances in which waivers may be granted;

(b) setting out the procedure to be followed in connection with waivers;

(c) requiring an information standard to include specified information about waivers.

(6D) For enforcement of information standards against persons other than public bodies, see section 277E.]

(d) any person (other than a public body) who provides health services, or adult social care in England, pursuant to arrangements made with a public body exercising functions in connection with the provision of such services or care.

(7) In this section—

• “adult social care”—

  (a)

  includes all forms of personal care and other practical assistance provided for individuals who, by reason of age, illness, disability, pregnancy, childbirth, dependence on alcohol or drugs, or any other similar circumstances, are in need of such care or other assistance, but

  (b)

  does not include anything provided by an establishment or agency for which Her Majesty's Chief Inspector of Education, Children's Services and Skills is the registration authority under section 5 of the Care Standards Act 2000;

• [F7 “health care” includes all forms of health care whether relating to physical or mental health and also includes procedures that are similar to forms of medical or surgical care but are not provided in connection with a medical condition;]

• F8 ...

• [F9 “NHS services” means services the provision of which is arranged by NHS England or an integrated care board (including services the provision of which is arranged by it in the exercise of functions of another person by virtue of any provision of the National Health Service Act 2006);]

• [F10 “processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);]

• “public body” means a body or other person whose functions—

  (a)

  are of a public nature, or

  (b)

  include functions of that nature,

  but in the latter case, the body or person is a public body to the extent only of those functions.

Textual Amendments

F1 Words in s. 250(1) substituted (1.7.2022) by Health and Care Act 2022 (c. 31), s. 186(6), Sch. 1 para. 19; S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

F2 S. 250(2)-(2B) substituted for s. 250(2) (7.7.2025) by Health and Care Act 2022 (c. 31), ss. 95(2)(a), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

F3 Word in s. 250(3) substituted (7.7.2025) by Health and Care Act 2022 (c. 31), ss. 95(2)(b), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

F4 Words in s. 250(4) substituted (1.7.2022) by Health and Care Act 2022 (c. 31), s. 186(6), Sch. 1 para. 1(1)(2); S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

F5 S. 250(5) omitted (7.7.2025) by virtue of Health and Care Act 2022 (c. 31), ss. 95(2)(c), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

F6 S. 250(6)-(6D) substituted for s. 250(6) (7.7.2025) by Health and Care Act 2022 (c. 31), ss. 95(2)(d), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

F7 Words in s. 250(7) inserted (7.7.2025) by Health and Care Act 2022 (c. 31), ss. 95(2)(e)(i), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

F8 Words in s. 250(7) omitted (7.7.2025) by virtue of Health and Care Act 2022 (c. 31), ss. 95(2)(e)(ii), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

F9 Words in s. 250(7) substituted (1.7.2022) by Health and Care Act 2022 (c. 31), s. 186(6), Sch. 9 para. 22; S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

F10 Words in s. 250(7) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 172 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

Commencement Information

I1 S. 250 in force at 1.4.2013 by S.I. 2013/160, art. 2(2) (with arts. 7-9)

[F11 251 Information standards: procedure etc E+W

(1) Regulations—

(a) must make provision about the procedure to be followed in connection with the preparation and publication of information standards under section 250;

(b) may require an information standard published under section 250 to be reviewed periodically in accordance with the regulations.

(2) Before laying a draft of regulations under subsection (1) before either House of Parliament, the Secretary of State must consult such persons as the Secretary of State considers appropriate.

(3) For the purposes of section 250 the Secretary of State or NHS England may adopt an information standard prepared or published by another person.]

Textual Amendments

F11 Ss. 251, 251ZA substituted for s. 251 (7.7.2025) by Health and Care Act 2022 (c. 31), ss. 95(3), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

[F11 251ZA Information standards: compliance E+W

(1) The Secretary of State may require a person to provide the Secretary of State with documents, records or other information for the purposes of monitoring the person’s compliance with information standards published under section 250.

(2) A requirement under subsection (1) may specify—

(a) the form and manner in which information is to be provided, and

(b) when information is to be provided.

(3) A requirement under subsection (1) must be in writing.

(4) For enforcement of requirements under subsection (1) against persons other than public bodies, see section 277E.]

Textual Amendments

F11 Ss. 251, 251ZA substituted for s. 251 (7.7.2025) by Health and Care Act 2022 (c. 31), ss. 95(3), 186(6); S.I. 2025/807, reg. 2 (with reg. 3)

[F12 Compliance with standards] E+W

Textual Amendments

F12 S 251ZA cross-heading inserted (19.6.2025 for specified purposes) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 15 para. 6

[F13 251ZB Notice requesting compliance by relevant IT providers E+W

(1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may give the provider a written notice which—

(a) identifies the standard in question,

(b) sets out the Secretary of State’s grounds for suspecting that the provider is not complying with the standard,

(c) asks the provider to comply with the standard within a period specified in the notice,

(d) asks the provider, within a period specified in the notice, to provide evidence to the Secretary of State’s satisfaction that the provider is complying with the standard, and

(e) if the Secretary of State considers it appropriate, sets out the steps that the Secretary of State considers the provider must take, within a period specified in the notice, in order to comply with the standard.

(2) A period specified for the purposes of subsection (1)(c), (d) or (e) must be a period of at least 28 days beginning with the day on which the notice is given.

(3) The Secretary of State may, by giving the relevant IT provider a further written notice, vary or revoke a notice given under subsection (1).

Textual Amendments

F13 Ss. 251ZB-251ZE and cross-heading inserted (19.6.2025 for specified purposes) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 15 para. 8

251ZC Public censure of relevant IT providers E+W

(1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may publish a statement to that effect.

(2) The statement may include the text of a notice given to the provider under section 251ZB.

(3) Before publishing a statement under this section, the Secretary of State must give the relevant IT provider—

(a) a copy of the terms of the proposed statement, and

(b) an opportunity to make representations about the decision to publish a statement and the terms of the statement.

(4) If, after considering any representations, the Secretary of State decides to publish the statement, the Secretary of State must inform the relevant IT provider before publishing it.

(5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section).

(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Textual Amendments

F13 Ss. 251ZB-251ZE and cross-heading inserted (19.6.2025 for specified purposes) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 15 para. 8

251ZD Exercise of functions of Secretary of State by other persons E+W

(1) The Secretary of State may—

(a) direct a public body to exercise some or all of the functions listed in subsection (3), and

(b) give the public body directions about the exercise of those functions, including directions about the processing of information that the body obtains in exercising those functions.

(2) The Secretary of State may make arrangements for a person prescribed by regulations under this subsection to exercise some or all of the functions listed in subsection (3).

(3) Those functions are—

(a) the Secretary of State’s functions under section 251ZA, so far as they relate to relevant IT providers, and

(b) the Secretary of State’s functions under section 251ZB.

(4) Arrangements under subsection (2) may—

(a) provide for the Secretary of State to make payments to the person, and

(b) make provision as to the circumstances in which such payments are to be repaid to the Secretary of State.

(5) Section 304(9) applies in relation to the power to make arrangements under subsection (2) as it applies to a power of the Secretary of State to give directions under this Act.

Textual Amendments

F13 Ss. 251ZB-251ZE and cross-heading inserted (19.6.2025 for specified purposes) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 15 para. 8

Accreditation E+W

251ZE Accreditation of information technology etc E+W

(1) Regulations may make provision for the establishment and operation of a scheme for the accreditation of information technology and IT services so far as used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care.

(2) The regulations may provide for the scheme to be established and operated by a person specified in the regulations (“the operator”).

(3) The regulations may, among other things, confer power on the operator—

(a) to establish the procedure for accreditation under the scheme,

(b) to set the criteria for accreditation under the scheme (“the accreditation criteria”),

(c) to keep an accreditation under the scheme under review, and

(d) to charge a reasonable fee in respect of an application for accreditation.

(4) The regulations may, among other things, make provision requiring the operator—

(a) to set some or all of the accreditation criteria by reference to information standards,

(b) to publish details of the scheme, including the accreditation criteria,

(c) to provide for the review of a decision to refuse an application for accreditation, and

(d) to provide advice to applicants for accreditation with a view to ensuring that the accreditation criteria are met.]