The National Health Service in England has confirmed it is allowing staff from Palantir access to patient data following a change in policy. The US spy-tech firm provides the technology for the Federated Data Platform (FDP), under a £330 million ($446 million) contract it won in 2023. The system is designed to improve data sharing across the NHS in England and help the state healthcare provider recover from the pandemic backlog. Under previously agreed rules, Palantir staff working on the FDP could only access the National Data Integration Tenant (NDIT), a data repository for patient data before it is transferred to the "pseudonymized" analytics system, if they apply to access for specific data sets. A document released by NHS England says that Palantir staff can get a new "admin" role and access the NDIT and its identifiable patient data. Other consultants working on the FDP will get similar access. The briefing document, seen by the FT and confirmed by The Register, said granting access to the data to Palantir staff and others could "risk of loss of public confidence" in its assurances about "safeguarding patient data and ensuring appropriate use and access to it." The Register understands the change is designed apply to a small number of people working on the new central data collection platform, used to monitor NHS performance using the NDIT. An NHS England spokesperson said: "The NHS has strict policies in place for managing access to patient data and carries out regular audits to ensure compliance - including monitoring the work of engineers helping to set up the central data collection platform that will track NHS performance and help improve care for patients. “Anyone external requiring access must have government security clearance and be approved by a member of NHS England staff at director level or above.” Sam Smith, coordinator at health privacy campaign group medConfidential, said Palantir and other consultants have already been able to access patient data - albeit pseudonymized in some cases - in other tenants of the FDP. But NHS England became unstuck because of its lack of clarity, he said, adding: "It's the equivalent of telling a civil servant, 'Only you can read your email' and then going, 'Oh, but freedom of information exists'. It is just a lack of transparency that we got through a leak, rather than saying 'We're going to do this thing, here's what it will mean'." NHS England is the quango which runs the NHS in England under the Department for Health and Social Care. The incumbent Labour government is disbanding NHS England and plans to run the service directly from the Whitehall department. In March, the Health Service Journal reported that nearly a third of NHS trusts connected to the FDP in 2025 were not meeting data security standards. An NHSE spokesperson told the publication: "The Federated Data Platform has data protection and cyber security at its core, which is why the NHS has worked with local organizations to ensure they meet the required standards and have introduced strengthened measures where appropriate." The minister responsible for the FDP, Zubir Ahmed, told MPs last month that NHS England and NHS organizations would "retain full control as data controllers, including over decisions about how data is used, who can access it and which products are deployed." He said: "Palantir does not own the data, the products or the intellectual property, nor can it use the NHS data for its own purposes." He said: "Palantir operates strictly within a UK-regulated contract where the NHS controls all data, access is tightly governed, and information can be used only for agreed purposes that benefit patients." When it launched the FDP contract, the NHS said patient data would be protected through "clear regulations, security measures, retained within the UK region, with access fully audited and NHS cyber security monitoring and protection." Palantir was awarded the FDP contract after winning a succession of pandemic-era deals, worth a combined £60 million, without competition. ®