Palantir and England’s hospitals: keeping the freedom to leave

England’s National Health Service is approaching its first renewal decision on the data platform supplied by a consortium led by Palantir. Public records show an acknowledged error over contractor access and benefits that remain difficult to attribute to the software. The contract also provides for an organised transition, while actual exit costs and operational migration tests remain undocumented in the material obtained.

Document-based investigation and economic analysis. Information cut-off: 9 November 2026. Scope: England. Programme statistics refer to the earlier periods specified in the text.

On 3 June 2026, England’s National Data Guardian disclosed that the description of access to part of the NHS data platform did not match its operation. The impact assessment she had reviewed restricted directly identifiable patient information to NHS staff. Some external contractors could also access it. NHS England subsequently acknowledged an error and apologised. The independent adviser said she could not herself verify the claimed technical necessity. ^S13

That episode deserves closer attention than an abstract argument about innovation and surveillance. To hold a contractor accountable, a public authority first needs an accurate account of what the contractor is allowed to do. A published safeguard can be sincere and legally significant while still getting an important operational detail wrong.

The Guardian reports lobbying over GP data. ^S01 Public documents allow the rights, pricing and renewal preparations to be examined. The original messages cited in that reporting were not obtained for this investigation.

The economic issue is already clear. Once software helps coordinate hospital work, renewing it may be a sound decision because it performs well. Renewal may also become the least disruptive option because a replacement was not prepared early enough. Telling those situations apart requires examining migration arrangements as closely as advertised results.

Software between the systems

Consider a team scheduling an operation. Theatre capacity, a patient’s records, preliminary tests and discharge arrangements may sit in separate applications. Bringing them together takes time; a missing update can leave a slot unused. This is an illustrative workflow, not a patient incident uncovered in this investigation.

The Federated Data Platform (FDP) is intended to connect that information. It combines infrastructure, operational applications and analytical tools. Participating NHS trusts, organisations providing hospital, community, mental health or ambulance care, and local commissioning bodies have their own environments, while NHS England operates national ones. The broad label “artificial intelligence”, or AI, can obscure these distinctions. Joining a waiting list to a theatre schedule is not, by itself, the training of a generative model. ^S25

There is a credible public-service need here. Consistent information can save re-keying and improve decisions. Its value nevertheless depends on the surrounding organisation: data quality, staffing, capacity outside hospital and procedures for resolving mistakes. Better information about an unavailable care placement does not create the placement.

The contract announced on 21 November 2023 went to a consortium led by Palantir, including Accenture, PwC, Carnall Farrar and NECS. NHS England describes a competitive procurement. A separate contract for privacy-enhancing technology went to IQVIA. Treating the whole programme as an uncompetitive award, or its headline budget as money paid exclusively to Palantir, would misrepresent the record. ^{S02 S03}

GP records: a boundary with two levels

A board paper dated 7 December 2023 makes a crucial distinction. GP data would be excluded from the national platform. Local versions of FDP could, however, be used for care coordination where local data-sharing agreements were in place. That possibility was part of the original published framework. ^S02

The relevant questions are therefore specific. Which information is involved? For what purpose? In which environment? Under whose control? An authorised local application, an additional purpose and a new national data flow require different decisions. Collapsing them into one category would manufacture a contractual breach before identifying the actual processing involved.

Local disclosures help illustrate the point. Norfolk and Suffolk describes a use involving aggregated information and says it is not currently sharing GP patient data with the platform. That local position cannot be extrapolated to the rest of England. ^S26

Scope also matters commercially. More organisations or uses can require more connections, development and support. Suppliers have an ordinary business interest in expansion. The public-policy task is to establish whether each extension meets an assessed need and follows the appropriate process, rather than presuming every sales proposal is improper.

Each significant addition should leave a documentary trail: justification, legal basis, responsibilities, access conditions, financial consequences and withdrawal arrangements. Without those records, words such as “access”, “sharing” and “anonymisation” can carry more weight than the underlying facts.

The access discrepancy is an established fact

The National Data Integration Tenant, or NDIT, is a distinct environment. NHS England uses it to collect certain identifiable datasets, prepare them and remove identifying elements for use elsewhere in the national platform. That upstream stage means it is inaccurate to describe every national component as entirely anonymous. ^{S11 S12}

Possible access must still be distinguished from observed use. NHS England describes technical permissions limited by role, purpose and duration, under its instructions. It reports monthly checks of activity logs and quarterly revalidation of external administrative access. We did not obtain those logs, audit results or individual authorisations. ^S11

A government response published on 22 October provides a dated breakdown: three Palantir engineers have administrative access to NDIT; another 33 engineers have more limited project access. Twelve of those 33 work for Palantir. The remainder work for Mastek, Capgemini, IBM, Kainos and Qualitest. The project-access count relates to 15 June 2026, not the publication month. ^S14

It would be misleading to turn these 36 people into 36 Palantir employees with unrestricted access to every NHS record. Employer and permission boundaries are part of the finding. They do not remove the central question: why did the impact assessment reviewed by independent advisers describe a different access arrangement?

An authority can correct a documentation error. Assessing its seriousness requires the dates when access was granted, when the discrepancy was discovered, who was informed, and how the documents changed. The public record establishes an acknowledged inconsistency. It does not establish intentional concealment, data theft or unlawful commercial exploitation.

There is a further technical distinction. Removing a name does not guarantee that a person cannot be identified again. Persistent identifiers, combinations of attributes, separately held keys and the people allowed to use them all matter. An honest explanation shows processing stages and controls, rather than a single reassuring box labelled “anonymisation”.

Contract values and actual spending

The contract notice published on 21 March 2024 gives a value of £182,242,760. It expressly says the amount is not committed expenditure: services are paid for as consumed under an agreed pricing schedule. It also gives a possible forecast value of £330 million, likewise not committed. ^S06

These figures describe a procurement arrangement, not verified receipts. They cannot establish Palantir’s profit, the distribution of revenue within the consortium or the NHS’s full cost. The health service may also devote its own staff to implementation, training and changes to existing systems. Those resources belong in a full economic evaluation even when they do not appear on a supplier’s invoice.

The business incentive is straightforward. A software company can earn revenue from its products, support and wider adoption without selling medical records. NHS England says the contract prohibits commercialising NHS data and using it to develop the supplier’s own products, including by training AI models. ^S04

A renewal decision should compare the future costs of available options. Keeping the system, replacing it or moving selected functions elsewhere would involve different combinations of licensing, integration, training, parallel operation and service risk. Sunk expenditure is not, by itself, a reason to carry on. An expensive migration is not, by itself, evidence of misconduct.

Wider adoption raises the stakes

The Commons Library’s 29 October briefing puts operational adoption at 142 of 202 trusts in August 2026. 170 had signed a memorandum to join; 35 of 36 integrated care boards, the bodies coordinating care in their local areas, were operational users. A trust counted as live need not use every application, and a signature does not measure intensity of use. ^S08

Central funding of licences and support, described in the NHS service offer, shapes these decisions. For a local team, an already funded product with implementation assistance lowers the hurdle to starting. The cost still exists for the system as a whole. The local adoption decision and the national budget decision are simply made in different places. ^S25

The economic implication is that an integration, a training programme or an adapted workflow may improve current productivity while increasing the work needed to switch technology later. Both effects can coexist. Adoption is therefore evidence of presence, not automatically proof of either effectiveness or lock-in.

A more informative measure would track what is demonstrably portable: applications redeployed elsewhere, internal capabilities retained, open interfaces and components that do not require the incumbent’s software. A documented partial migration would reveal more about practical choice than the legal ability to export files alone.

Measuring activity before and after adoption

For the historical cumulative period ending March 2026, NHS England reported 111,589 additional patients undergoing theatre procedures relative to activity before adoption. On our 9 November visit, the former uptake and methodology addresses led to the general FDP impact page, without that table. We use the historical indexed material with its reporting period and limitations; we have not established when or why the pages changed. ^{S09 S10}

For each trust, the calculation compares actual post-adoption activity with a projection based on its earlier weekly average. The differences are added together. This describes a change, but does not separate the software’s contribution from recruitment, operating hours, funding or other changes occurring at the same time. The NHS methodology recognises that limitation. ^S10

Consider a hypothetical hospital that adopts a tool while opening an additional theatre. Attributing the entire increase in procedures to the software would credit one decision with the result of two changes. Conversely, stable activity could conceal a genuine software benefit if resources had been cut. Evaluation needs an estimate of what would otherwise have happened under comparable circumstances.

The Office for Statistics Regulation records that an explicit causality caveat was added on 6 June 2026. Its July intervention secured commitments to clearer communication and more detailed data. Within its limited review, it received assurances about the independence of NHS statisticians; it did not rule on the wider culture of the programme. Its findings should not be recast as proof of organised manipulation. ^S19

The Health Foundation supplies an important counterpoint. In a letter published by OSR, it says a comparison of OPTICA users with non-users found no measurable improvement in discharge performance. It leaves open the possibility of other benefits. Some underlying information had been provided in confidence, and we could not reproduce the detailed analysis. ^S20

Administrative actions also require careful interpretation. Removing a duplicate from a waiting list may improve its accuracy without representing new treatment. Adding requested list removals, reviewed records and extra procedures would produce a total without a coherent unit. The published methods allow those categories to be kept separate. ^S10

Rebuilding the service beyond its files

NHS England says it retains rights over its data and commissioned materials, including its common data model. Palantir retains rights over Foundry, its pre-existing software. That division is not unusual in a software service. It does mean the buyer must identify exactly what would continue to work in another environment. ^S04

An export returns values. An operational service also includes relationships between them, quality rules, permissions, transformations, alerts, interfaces and learned working practices. Owning a table of patient information does not automatically recreate the workflow that makes it useful. Reversibility concerns the whole chain; data portability covers one part of it.

A practical test could take a bounded use case, using synthetic or appropriately protected data, and ask an independent team to reproduce it elsewhere. The exercise would record elapsed time, reusable components, lost functionality and the cost of running both systems during transition. It need not assume failure. It would turn a broad promise into an observable result.

Nor does the presence of multiple application suppliers necessarily establish portability. Several companies can develop products on the same technical foundation and remain dependent on it. Conversely, stable interfaces, complete documentation and in-house expertise can substantially lower switching costs. The public record describes safeguards of that kind. It does not provide the results of a complete replacement exercise reviewed in this investigation.

The conditions and costs of transition

Schedule 8.5, Exit Management, provides for assistance lasting up to 24 months after the relevant services cease, with a further six-month option requiring notice at least 20 working days before the planned end. An initial plan is due within three months; final-plan deadlines differ between expiry and termination. Transition services are charged under the approved plan and its capped estimate. With less than six months’ notice, an extension can attract up to 120% of the specified rate; more than six months preserves the rate. Those two subclauses do not specify the exact six-month boundary. Exercising the rights requires operational and budget preparation. ^S07

That changes the question for government. Service continuity is a real constraint. But before accepting an argument that renewal is necessary because no replacement is immediately ready, the public should know how the transition rights were prepared, costed and, where appropriate, invoked.

We did not obtain the approved exit plan, its capped estimate, the application inventory, test results or notices exchanged between the parties. Their absence from our evidence does not establish that they do not exist. It does prevent an honest calculation of the cost of leaving, a confident promise that replacement would be simple, or a conclusion that renewal is unavoidable.

The comparison must concern the service delivered during transition. An incumbent could continue some functions while others move. Success would depend on sequencing, security responsibilities and the replacement team’s capacity. Changing the name on the contract solves none of those problems by itself.

A precedent from another department

The National Audit Office documented a related mechanism in Homes for Ukraine, a different contract. After a six-month free trial, the department awarded Palantir £4.5 million excluding VAT in September 2022, then extended the arrangement for £5.5 million in September 2023. It cited migration difficulties and risks. The Government Chief Commercial Officer had warned about free offers undermining competition. None of this establishes an irregularity in the NHS award. ^S21

It does suggest a testable hypothesis. A low-cost trial can change the later choice. At entry, the buyer compares promises; at renewal, it compares an integrated service with a migration project. The incumbent enjoys practical knowledge and a continuity advantage even when rivals offer credible products.

Preparing alternatives before they are needed is therefore a useful public capability. An exit option that is kept operational can strengthen negotiation even if it is never exercised. Maintaining that option has value, just as maintaining the current service does.

Waiting changes the economics

The NHS’s current explanation places the initial period’s end in March 2027, with options for two years, one year and another year. The 2024 notice, however, lists 15 February 2027. We preserve that documentary discrepancy. Without the applicable amendments and notices, it would be unwise to manufacture a definitive legal deadline from two summaries. ^{S04 S06}

At the 16 June hearing, NHS officials said they needed to notify the supplier by December, under the timetable presented and intended to act sooner. The independent evaluation commissioned from Imperial was expected to be published after the renewal decision, according to the timetable presented to MPs. That exposes the buyer to deciding before the publication is available. The records establish the timing gap; its reasons remain to be documented. ^S15

On 4 November, Yvette Cooper told MPs that the contract review was continuing and said plans covered the possible outcomes, including exit. That ministerial assurance complements the published clauses; an inspectable plan and a migration test would allow its feasibility to be assessed. ^S28

The mechanism is simple. A later decision leaves less time to examine competing offers, secure a transition and verify costs. An exit option can lose practical value before the contractual right disappears.

Early-November press reporting points to a possible extension. We have not obtained a signed amendment. An anticipated outcome must not be entered in the chronology as an accomplished decision. ^S24

Lobbying needs to be traced into decisions

An official record exists separately from the latest press reporting. In a parliamentary answer on 27 October, the government confirmed a letter sent by Lord Watson on 18 September on Palantir’s behalf. It said no reply had yet been sent. The correspondence establishes an approach, not that the supplier secured a contractual change. ^S23

Further investigation would compare requests to ministers with decision papers, scope changes and renewal terms. Dates are necessary but insufficient. A request followed by a favourable decision might reflect a persuasive argument, an operational constraint or preferential treatment. The evidence lies in the process, alternatives considered and reasons recorded.

In October, the National Data Guardian urged government to give real weight to public trust, evidence of benefits and interoperability. She supported better use of health information without recommending a particular contractual outcome. ^S18 That is a useful distinction: the confidence of patients and clinicians is part of the operating conditions of health infrastructure.

Lost trust can carry economic costs. Explaining unclear arrangements, renegotiating data-sharing agreements and rebuilding procedures all consume resources. We do not have an estimate that would support assigning a monetary value to those costs in FDP. They should nevertheless enter evaluation through observable indicators rather than invented figures.

The evidence needed before renewal

The public record supports a more precise demand than simply “trust the system” or “switch it off”. One necessary document is a publishable transition plan separating data, applications, skills and continuity. It should distinguish charges from the outgoing supplier, costs at the replacement provider and public-sector staff requirements, supported by actual tests.

Another is an evaluation of clinical and administrative uses that discloses comparisons, implementation dates and competing influences. Some applications may be useful without delivering the particular clinical improvement highlighted in publicity. Keeping them for that utility requires defining it and valuing it properly.

Each significant scope extension should also have a readable decision record: objective, required access, responsibilities, cost and withdrawal conditions. Audit summaries and a history of corrected documentation could test whether safeguards match practice without exposing patient information or sensitive technical details.

The evidence reviewed establishes an acknowledged access-description error, performance measures that cannot alone support causal attribution, and a contractual route to transition assistance. It establishes neither corruption, sale of patient records nor an inability to change supplier. The taxpayer’s question is more concrete: when the state decides to continue, will it be able to show that it had a prepared alternative and a complete comparison?

Method and limitations

This investigation combines NHS publications, parliamentary records, programme statistics, oversight bodies and reporting. The original contract was obtained; PDF pages 43, 44, 48 and 49 of its fourth volume were rendered and visually checked for the exit clauses. NAO PDF page 42 was also inspected. The August adoption figures repeat NHS data in a parliamentary synthesis; the cumulative benefits to March 2026 and their method come from historical indexed material.

The original freedom-of-information messages, operational exit plan, expenditure ledger, access logs and confidential evaluation data remain outside the material obtained. No requests for comment were sent by l0g. Interested parties’ published statements are attributed and distinguished from independent checks. The opening illustration is a symbolic composition created with a generative image tool.

Further reading

Our Leaving Microsoft series examines the data, identities, permissions and applications involved in public-sector migration. The analysis of remote maintenance and contractor access follows technical rights and their operational consequences.

Sources and scope

1. S01 · The Guardian · Accessed : 2026-11-09GP-data lobbying
   Passages and scope

   2026-11-09

   Original freedom-of-information messages were not obtained.

2. S02 · NHS England · Accessed : 2026-11-09Federated Data Platform update, note au conseil
   Passages and scope

   2023-12-07

   Board paper, paragraph 4: GP data excluded nationally; local use possible under local data-sharing agreements. Published policy is distinct from observed flows.

3. S03 · NHS England · Accessed : 2026-11-09New NHS software to improve care for millions of patients
   Passages and scope

   2023-11-21

   NHS announcement of 21 November 2023: competitive procurement and the consortium. Buyer/promoter statements are attributed.

4. S04 · NHS England · Accessed : 2026-11-09Contract explainer
   Passages and scope

   Publication date not established

   Current NHS contract explainer: March 2024 start, March 2027 initial expiry and 2+1+1 options; NHS data rights and Palantir’s pre-existing software rights. Full page read in a browser; not an operational migration test.

5. S05 · Contracts Finder / NHS England · Accessed : 2026-11-09Federated Data Platform and Associated Services, avis remplacé
   Passages and scope

   2023-12-22

   Superseded procurement notice of 22 December 2023; use S06 for the later notice. Official structured publication also read.

6. S06 · Contracts Finder / NHS England · Accessed : 2026-11-09Federated Data Platform and Associated Services, avis du 21 mars 2024
   Passages and scope

   2024-03-21

   Notice published 21 March 2024: £182,242,760 and £330m forecast are non-committed; usage-based pricing. Its 15 February 2027 end date differs from the current NHS summary.

7. S07 · NHS England / Palantir · Accessed : 2026-11-09FDP-AS Contract, partie 4 sur 4, annexe 8.5 Exit Management
   Passages and scope

   2024-03-21

   Schedule 8.5: plans, notices, up to 24 months of assistance, a conditional further six-month option and charging rules. Original PDF obtained and pages 43,44,48,49 visually inspected. Operational plans, notices and actual approved costs were not obtained.

8. S08 · House of Commons Library · Accessed : 2026-11-09What’s happening with the NHS Federated Data Platform?
   Passages and scope

   2026-10-29

   Commons Library synthesis of 29 October 2026. Adoption figures refer to August and repeat NHS data, rather than provide an independent second measure.

9. S09 · NHS England · Accessed : 2026-11-09NHS Federated Data Platform uptake and benefits
   Passages and scope

   Publication date not established

   Historical cumulative benefits to the end of March 2026 from indexed primary material. On 9 November the URL led to the general impact page without that table. Update date, timing and reason for the change unestablished; no causal effect or latest total inferred.

10. S10 · NHS England · Accessed : 2026-11-09Methods for the published uptake and benefits information
    Passages and scope

    Publication date not established

    Historical before-and-after method from indexed primary material. Current URL led to the general impact page on 9 November. Hospital microdata absent; no independent reconstruction.

11. S11 · NHS England · Accessed : 2026-11-09Response to the National Data Guardian’s request for clarification
    Passages and scope

    Publication date not established

    NHS response acknowledging the impact-assessment error and describing access controls. Controls are the organisation’s statements; individual logs and authorisations were not audited.

12. S12 · NHS England · Accessed : 2026-11-09NDIT Federated Data Platform product privacy notice
    Passages and scope

    2026-06-16

    NDIT privacy notice updated 16 June 2026: identifiable information processed before preparation and removal of identifiers for specified downstream use. Product-specific scope.

13. S13 · National Data Guardian · Accessed : 2026-11-09Statement on NHS FDP data access
    Passages and scope

    2026-06-03

    Independent adviser’s statement of 3 June, updated 28 July 2026: inaccurate impact assessment, NHS acknowledgement and apology; technical necessity not independently verified by the adviser.

14. S14 · Science and Technology Committee / gouvernement · Accessed : 2026-11-09Rewiring the state: Government response
    Passages and scope

    2026-10-22

    Government response published 22 October, received 7 September. Thirty-three project engineers, including twelve at Palantir, are dated 15 June; three administrative engineers are separately described.

15. S15 · Health and Social Care Committee · Accessed : 2026-11-09Oral evidence, 16 June 2026
    Passages and scope

    2026-06-16

    Oral evidence of 16 June 2026: notification timetable, planned Imperial evaluation and continuity. Witness statements and planned studies are distinct from published evaluation results.

16. S16 · Health and Social Care Committee · Accessed : 2026-11-09MPs call for an alternative to the FDP supplier
    Passages and scope

    2026-07-09

    Committee recommendation of 9 July 2026 to seek an alternative. A political recommendation, not a termination decision or judgment.

17. S18 · National Data Guardian · Accessed : 2026-11-09Advice on public and professional trust in the FDP
    Passages and scope

    2026-10-12

    Independent advice dated 9 October, published 12 October. Presentation and PDF text read; chart not visually inspected. No specific contractual outcome prescribed.

18. S19 · Office for Statistics Regulation · Accessed : 2026-11-09FDP: presentation and communication of performance metrics
    Passages and scope

    2026-07-22

    Statistical regulator’s 22 July statement: causal caveat added 6 June, transparency commitments and a limited review of statisticians’ independence. No general finding of deliberate manipulation.

19. S20 · Health Foundation / OSR · Accessed : 2026-11-09Jennifer Dixon to Ed Humpherson: OPTICA analysis
    Passages and scope

    2026-08-10

    Health Foundation letter published 10 August; drafting date unconfirmed. No measurable discharge improvement found in the described OPTICA comparison; other benefits left open. Confidential inputs and detailed analysis not replicated.

20. S21 · National Audit Office · Accessed : 2026-11-09Investigation into the Homes for Ukraine scheme
    Passages and scope

    2023-10-17

    NAO report, paragraphs 3.10–3.13, PDF page42 visually checked: six months free, then £4.5m and £5.5m, both excluding VAT. A separate department and contract, not evidence of NHS procurement misconduct.

21. S22 · Financial Times · Accessed : 2026-11-09GP pilot reporting, September 2026
    Passages and scope

    2026-09-13

    Reporting on a local GP pilot; full FT article and underlying documents not obtained. Context only, not evidence of national GP-data use.

22. S23 · UK Parliament / DHSC · Accessed : 2026-11-09Written question 31148, ministerial meetings and correspondence
    Passages and scope

    2026-10-27

    Written question31148: government response of 27 October confirms a letter sent on18 September for Palantir, then unanswered. No ministerial direction or contract change inferred.

23. S24 · Financial Times · Accessed : 2026-11-09Reporting on a possible FDP contract extension
    Passages and scope

    2026-11-05

    FT reporting on a possible extension. Only headline/subscription boundary accessible in this check; no signed amendment obtained. Prefer S28 for the public review status.

24. S25 · NHS England Digital · Accessed : 2026-11-09Federated Data Platform service description
    Passages and scope

    2025-09-16

    Official service description, last edition shown16 September2025: infrastructure, products, central funding and FDP-first policy. Not a current adoption count.

25. S26 · NHS Norfolk and Suffolk ICB · Accessed : 2026-11-09GP patient data and the NHS Federated Data Platform
    Passages and scope

    Publication date not established

    Local NHS Norfolk and Suffolk description of aggregate information and GP-data position. Specific to that local system; not extrapolated across England.

26. S27 · NHS England · Accessed : 2026-11-09Privacy and confidentiality protections
    Passages and scope

    Publication date not established

    NHS buyer’s published privacy and confidentiality safeguards. A stated policy, not an independent technical audit.

27. S28 · Health and Social Care Committee · Accessed : 2026-11-09Oral evidence: The Work of the Department for Health and Social Care, HC 236
    Passages and scope

    2026-11-04

    4 November2026 hearing, Q235–248: review ongoing and plans for different outcomes, according to witnesses. Statements are distinct from a public exit plan or a completed migration test.