When you buy through affiliate links in our content, we may earn a commission at no extra cost to you. Learn 
Questions around patient privacy, governance, and the influence of private technology firms inside public healthcare systems have resurfaced after reports claimed a small number of employees at Palantir Technologies were granted access to identifiable patient information within part of the NHS’s central data infrastructure.
The controversy emerged after the Financial Times reported that engineers working for Palantir had been assigned what internal technical documents described as “unlimited” permissions within the NHS’s National Data Integration Tenant (NDIT), a platform used to monitor operational performance across the health service.
While NHS officials and Palantir both insist the access was tightly controlled, temporary, and limited in scope, the revelations have reignited concerns over how much visibility private contractors should have into Britain’s healthcare systems, and whether the public fully understands where the boundaries around their medical data actually lie.
Critics were quick to respond.
Among them was Labour MP Chi Onwurah, who shared concerns online alongside previous comments made by Palantir UK executive Louis Mosley about safeguards surrounding NHS patient information.
For privacy campaigners, the issue draws attention to the question of how much trust patients can have in these complex partnerships. There’s a fundamental mismatch between the expectations we have of public healthcare institutions and the secrecy enjoyed by powerful technology companies whose systems operate behind closed doors.
NHS England Says Palantir Access Was “Strictly Controlled”
In a statement shared with Techopedia, NHS England said the arrangement affected only a small number of personnel working specifically on the National Data Integration Tenant and did not represent unrestricted access to wider NHS systems.
“This only affects a small number of people working on the new central data collection platform, used to monitor NHS performance – the National Data Integration Tenant,” an NHS England spokesperson said.
According to the NHS, multiple layers of oversight remain in place: “The NHS has strict policies in place for managing access to patient data and carries out regular audits to ensure compliance – including monitoring the work of engineers helping to set up the central data collection platform that will track NHS performance and help improve care for patients.”
The spokesperson added: “Anyone external requiring access must have government security clearance and be approved by a member of NHS England staff at director level or above.”
While those assurances may satisfy some operational concerns, privacy advocates, such as those at the Good Law Project, argue that technical governance often becomes difficult for the public to independently verify once large-scale digital systems grow increasingly interconnected.
Palantir Pushes Back Against “Unlimited Access” To NHS Data Narrative
Palantir strongly rejected claims that its employees had broad or unrestricted visibility into NHS patient records.
In a detailed response shared by a Palantir spokesperson and posted on X, Mosley said the leaked documentation referred specifically to a staging environment tied to the National Data Integration Tenant.
According to the company, fewer than five UK-based Palantir employees were involved, with all personnel vetted and approved by NHS engineering leadership.
Mosley said the arrangement was governed by multiple technical and procedural safeguards, arguing that access was limited to the NDIT staging environment and granted only for specific engineering fixes. He added that all activity was automatically audited by NHS security teams, that data could not be exported outside the environment, and that the permissions themselves were temporary and could be revoked at any time.
Palantir also argued that critics were conflating infrastructure-level engineering access with unrestricted access to patient medical histories.
Campaign groups will keep looking for breaches where there are none, for Palantir operating outside the NHS’s instructions where it isn’t, and for shadows that don’t exist.
Mosley maintained that the company’s role remains focused on improving NHS efficiency, reducing waiting lists, and supporting operational coordination while preserving privacy protections.
But even carefully worded explanations have done little to quiet concerns around how modern healthcare systems increasingly depend on private infrastructure providers. In practice, engineers still often need some level of privileged access to maintain, troubleshoot, or improve the platforms running behind the scenes.
The Real Debate Is About Visibility, Not Just Access
For years, healthcare modernization projects have promised faster services, better coordination, and more efficient patient care by connecting fragmented systems across hospitals and agencies through centralized digital platforms. Last year, the Crown Commercial Service doubled the number of suppliers on its Digital Capability for Health procurement framework.
Supporters of the NHS Federated Data Platform say the technology could help improve resource allocation and reduce administrative bottlenecks inside an already overstretched health service.
Critics see a different risk. The more centralized sensitive healthcare data becomes, the greater the potential fallout when governance fails, whether through technical mistakes, procedural gaps, or political decisions.
In 2025, an NHS software provider was fined £3 million ($4 million) by the Information Commissioner’s Office after a breach exposed the personal information of 79,404 people. Hackers gained access to patients’ phone numbers and medical records, along with details explaining how to enter the homes of 890 people receiving care at home.
Palantir’s involvement has also now amplified concerns because of the company’s longstanding work with defense, intelligence, and law enforcement agencies in the United States.
Even when no breach occurs, the perception of private firms operating close to sensitive health information can become politically combustible, particularly when technical terminology such as “unlimited access” enters public debate.
Mosley argued that the leaked document itself actually demonstrated governance functioning correctly.
“The technical design document leaked to the FT was drafted by an NHS England architect — as part of their own governance procedures — to propose options for internal scrutiny and approval.”
He also described the NDIT environment as “plumbing, not a patient record system,” stating that the platform was designed to manage operational workflows rather than serve as a direct clinical records database.
Trust Remains the NHS’s Most Sensitive Dataset
The NHS has spent years trying to modernize how its data systems work while also convincing patients that their private information remains protected.
But incidents like the 2022 data breach, combined with concerns around Palantir Technologies, show how the debate tends to be less about technical definitions of “limited access” and more about whether the public trusts the organizations handling sensitive health data in the first place.
That leaves the NHS facing a challenge that many institutions run into during digital transformation. That is, better efficiency may rely on deeper data integration, but public trust still depends on transparency.
