Key Takeaways
- Every privately insured patient is also an NHS patient — registered with an NHS GP, managed through NHS prescribing infrastructure. The crossing between these two constitutional domains was never designed to be governed.
- The NHS has two decades of governance infrastructure (DSPT, FHIR, MESH, PRSB standards). Private healthcare has none of it. The same patient in the same hospital has data governed by different rules depending on who is paying.
- The ‘dumping’ perception is sustained not by cherry-picking but by the absence of MVRT at the crossing: no declared sender, no verified acceptance, no structured handover.
- The prescribing wall is structural: GPs refuse shared care agreements with private providers because accepting prescribing responsibility without NHS support infrastructure exposes them to clinical and medicolegal risk.
- Paterson exploited precisely this gap — harming patients in both sectors because the two sectors did not share clinical data. Five years after the Inquiry, they still do not share it digitally.
This is the fourth article in a series examining boundary governance in private healthcare. The first three articles established that private healthcare governs individual organisations while leaving the crossings between them unaudited, that insurer provider networks govern financial flows at every boundary while leaving clinical flows ungoverned at all of them, and that the clinical-commercial boundary at pre-authorisation has no regulatory home. This article examines the boundary that every privately treated patient crosses at least twice: the interface between the NHS and the private sector.
Every patient who receives private healthcare in the United Kingdom is also an NHS patient. They are registered with an NHS GP. Their lifetime medical record sits in an NHS clinical system. Their medications are managed through NHS prescribing infrastructure. Their emergency care, their cancer screening, their vaccinations, their chronic disease management — all NHS. When they enter the private sector, they do not leave the NHS. They cross a boundary between two constitutional domains that were never designed to interoperate, and when their private treatment ends, they cross back.
This crossing is not an edge case. It is the structural norm. The Association of British Insurers reports approximately four million people in the UK holding private medical insurance. Every one of them has an NHS GP. Every one of them will, at some point, carry clinical information across the boundary between these two systems. The question is not whether the crossing happens. The question is whether anyone governs it.
Within the NHS, that governance is increasingly digital. GP Connect, MESH messaging, Transfer of Care FHIR, structured discharge summaries — two decades of infrastructure investment making inter-organisational clinical data flow progressively more structured, more auditable, more machine-readable. At the NHS-private boundary, the same transfer is analogue: letters, PDFs, faxes, phone calls. The two-speed problem is not that private healthcare lacks technology. It is that private healthcare lacks the shared governance infrastructure that makes technology safe. Ian Paterson exploited precisely this gap — harming patients in both sectors because the two sectors did not share clinical data. Five years after the Paterson Inquiry called for whole-practice visibility, they still do not share it digitally.
NHS → Private
Patient leaves NHS infrastructure
CROSSING
MECHANISM
Private → NHS
Patient attempts return
Two systems, two constitutional frameworks
The NHS operates within a defined constitutional infrastructure. General practices are governed by the GMS Contract, regulated by CQC, and subject to the standards of the NHS Constitution. Secondary care providers operate under the NHS Standard Contract, which mandates specific requirements for transfer of care, discharge communication, data sharing, and clinical governance. The Data Security and Protection Toolkit (DSPT) provides a mandatory framework for information governance — every organisation that accesses NHS patient data must demonstrate compliance. The NHS e-Referral Service provides a structured electronic pathway for referrals from primary to secondary care. Transfer of Care FHIR specifications define how clinical information should flow between organisations. MESH provides the transport layer.
This infrastructure has significant limitations. Implementation is variable. Discharge summaries remain inconsistent. Interoperability between different NHS systems is far from complete. But the constitutional framework exists: legislation, contracts, standards, regulatory expectations, shared technical infrastructure, and defined accountability for what happens at organisational boundaries.
Private healthcare operates within a different constitutional framework. Private hospitals are CQC-regulated — the same regulator, but a different regulatory relationship. CQC assesses the organisation's safety and quality. It does not require compliance with the NHS Standard Contract, the DSPT (unless the organisation holds an NHS contract), the Transfer of Care FHIR specifications, the PRSB discharge standards, or any of the shared infrastructure that governs information flow within the NHS. Private consultants are individually regulated by the GMC and hold practising privileges at private hospitals — a bilateral commercial arrangement, not an employment relationship governed by an NHS consultant contract.
Private medical insurers sit in a third constitutional domain entirely. Regulated by the FCA under financial services legislation. Subject to the Consumer Duty, Solvency II, the Insurance Distribution Directive. Operating under a governance framework designed for financial products, not clinical pathways. The insurer is neither a healthcare provider (CQC does not regulate it) nor an NHS body (the NHS Standard Contract does not bind it). Yet, as the previous articles in this series have shown, the insurer makes decisions with direct clinical consequences: routing patients to specific consultants, defining which treatments are authorised, employing clinical teams that assess medical necessity.
Three constitutional domains. Three regulatory frameworks. One patient moving between them. And at the boundary where these domains meet — where clinical information, clinical responsibility, and clinical risk cross from one framework to another — no single authority governs the crossing.
Patient Choice: the governed entry that isn't
There is one scenario in which the NHS-private boundary has been deliberately designed: NHS Patient Choice. Under patient choice legislation, when a GP refers a patient for routine elective care, the patient has the right to choose which hospital provides their treatment — including private hospitals that hold NHS contracts. Spire Healthcare treats approximately 200,000 NHS patients annually across its 38 hospitals. Nuffield Health has offered NHS care under the Patient Choice framework since 2006. Circle, Ramsay, HCA — all the major independent sector groups hold NHS contracts and appear on the e-Referral Service.
This looks like a governed crossing. The GP refers through the e-Referral Service. The patient is booked into the private hospital as an NHS patient. The NHS Standard Contract applies. Transfer of Care requirements are mandated. The DSPT is required. The independent sector provider operates under NHS terms for this episode of care.
But examine the crossing more carefully. The patient's clinical record sits in the GP's NHS clinical system — EMIS, SystmOne, Vision. The private hospital operates its own clinical system, which is almost certainly not the same platform. The referral arrives through e-RS, but the clinical information accompanying it depends on what the GP included and what the e-RS pathway was configured to capture. The discharge summary is mandated — within 24 hours for inpatient care, clinic letter within seven calendar days for outpatient attendance — but the NHS Standard Contract interoperability guidance has been progressively tightening requirements for Transfer of Care FHIR structured messaging precisely because compliance with the spirit of these requirements remains inconsistent even within NHS trusts.
Now add the constitutional complexity. The patient is an NHS patient being treated in a private hospital. The consultant may be the same person who treats private patients in the same building on a different day. The hospital's clinical governance framework must satisfy both CQC and the NHS Standard Contract — but the two have different expectations, different reporting requirements, different accountability mechanisms. The DSPT applies to this provider for this episode — but does the provider's information governance framework genuinely distinguish between the data governance requirements of its NHS patients and its private patients, or does it apply a single framework that was designed primarily for one population?
And there is a harder question: what happens when the same patient is simultaneously an NHS patient and a private patient? Not for the same episode of care — that is prohibited. But for the same condition, sequentially. A patient on an NHS waiting list decides to pay privately for a diagnostic scan, then brings the results back to their NHS pathway. The scan was performed in a private facility, under private clinical governance, with private data governance. The results now enter the NHS pathway. The GP must decide whether to act on findings from a scan performed outside NHS governance. The consultant receiving the referral must decide whether to incorporate privately obtained results into their NHS clinical decision-making. Each of these decisions involves a crossing between constitutional domains — and no standard governs how it should happen.
The no-mixing rule: a boundary created by principle
UK health policy has long maintained that NHS and private care must remain separate within a single episode. The principle is foundational: NHS Kent and Medway's position statement is representative — co-funding, where both private and NHS funding are used for a single episode of care, is not permitted. The Department of Health guidance on NHS patients paying for additional private care sets out the principle clearly: the NHS should never subsidise private care with public money. A patient cannot pick and mix elements of NHS and private care within the same treatment episode.
The policy intent is sound. It preserves the principle of care free at the point of delivery and prevents a two-tier system where ability to pay determines the quality of a single treatment episode. But the practical consequence of the no-mixing rule is that it creates a hard boundary between two episodes of care — one NHS, one private — that the patient experiences as a single illness journey.
Consider the cataract example used in official guidance: a patient having NHS cataract surgery cannot pay privately for a premium lens implant during the same procedure. They must choose: NHS surgery with the standard lens, or private surgery with the premium lens. If they choose private surgery for the lens, they are a private patient for that episode. When they return to NHS care for post-operative follow-up, they cross the boundary.
The no-mixing rule forces the creation of a boundary crossing. It mandates that what the patient experiences as continuous care must be administratively separated into discrete episodes under different governance frameworks. Each transition between episodes is a crossing between constitutional domains — and the rule that creates these crossings contains no provision for how clinical information, clinical responsibility, or clinical risk should be governed as they cross.
Derby and Derbyshire ICB's guidance on defining the boundaries between NHS and private healthcare illustrates the complexity. A patient who begins medication following a private consultation can transfer to NHS care — but will be subject to the same waiting times as a newly referred patient. During the wait, their treatment continues privately. The NHS provider cannot fund the treatment until they have reviewed the patient. The clinical responsibility sits with the private consultant until the NHS consultant accepts the transfer. Between the private consultant's discharge and the NHS consultant's acceptance, the patient occupies a governance no-man's-land — clinically managed under one framework, administratively transitioning to another, with the GP caught in the middle.
The “dumping” perception vs. the handover reality
The most politically charged accusation at the NHS-private boundary is “dumping” — the claim that private hospitals cherry-pick straightforward elective cases and transfer complications back to NHS A&E departments, which absorb the cost and clinical risk. The accusation is common in NHS trusts that sit geographically close to major private facilities. It is raised in parliamentary debates. It shapes institutional attitudes to the independent sector.
The governance reframe matters. This is not primarily a question of intent. Many private hospitals lack Level 3 intensive care facilities. When a patient deteriorates post-operatively and requires critical care beyond what the private facility can provide, transfer to an NHS trust is the clinically correct decision — it is a necessary safety protocol, not an act of convenience. The problem is not the transfer. The problem is how the transfer is governed.
Map the emergency transfer against Alert & Responsibility (Flow #5) and the governance gaps become visible. Is there a structured handover using SBAR or an equivalent protocol? Does the private consultant retain clinical responsibility until the NHS consultant explicitly accepts it? Or is the patient physically moved — via 999 ambulance — with a phone call and a promise that notes will follow? In too many cases, the “dumping” perception is sustained not by cherry-picking but by the absence of MVRT at the crossing: no declared sender, no verified acceptance, no defined scope of what is being transferred, no recorded state at the moment of handover.
The distinction matters for governance infrastructure. If “dumping” is framed as a moral failure, the response is political — restrict private sector access, impose penalties, name and shame. If it is framed as a Service Routing and responsibility transfer failure, the response is structural — build governed crossing mechanisms for emergency transfers, define MVRT conditions for private-to-NHS critical care handover, require structured clinical information to accompany the patient rather than follow days later. The infrastructure exists within the NHS for inter-trust transfers. It does not exist at the private-to-NHS boundary.
How governed are your NHS-Private crossings? Inference Clinical's Boundary Risk Score assesses your hybrid pathway governance — entry crossings, WLI handovers, emergency transfers, prescribing boundaries, and data governance asymmetry.
Check Your Boundary Risk ScoreWaiting List Initiatives: outsourcing activity, retaining risk
NHS trusts outsource thousands of patients to private providers annually through Waiting List Initiative (WLI) contracts. The objective is clear: reduce the elective backlog by using private sector capacity. The contractual arrangement is typically straightforward: the NHS trust pays the private provider a tariff per procedure, the patient is treated, the patient returns to NHS care.
The governance reality is more complex. The NHS trust retains clinical liability for the patient — they commissioned the care, they selected the provider, and the patient remains on the trust's pathway. But the private provider holds the patient. The clinical decisions are made by the private provider's consultants. The clinical system is the private provider's system, not the NHS trust's. The clinical information about what happened during the procedure sits in the private provider's records.
The NHS Standard Contract requires data sharing between trust and provider. A clinical safety assessment under DCB 0129 should cover the risks arising at this crossing — but in practice, no such assessment exists for most WLI arrangements. And “data sharing” in practice often means the referral letter: a single document, prepared once, carrying the clinical context that must sustain the entire episode. The NHS trust's EPR (Cerner, Epic, Meditech) does not interoperate with the private provider's clinical system. The referral letter is a single point of failure. If it is incomplete — if it omits a relevant allergy, a concurrent medication, a relevant comorbidity — the private provider may not discover the omission until it becomes a clinical incident.
After treatment, the reverse crossing carries the same risk. The WLI discharge summary must reach the NHS trust and the GP. The private provider sends it — but in what format? Structured FHIR? PDF attachment? Posted letter? The NHS Standard Contract mandates sharing, but the technical infrastructure for that sharing depends on what the trust and provider have agreed, which varies from contract to contract, trust to trust, provider to provider.
The prescribing wall
The second article in this series documented GP practices that explicitly refuse shared care agreements with private providers. The evidence from current practice policies is more extensive and more structurally significant than a few individual refusals suggest.
The BMA's current guidance advises GPs not to enter shared care agreements with private providers. The reasoning is clinical, not obstructive: a shared care agreement requires the GP to accept clinical responsibility for prescribing and monitoring a medication initiated by someone else. Within the NHS, shared care agreements are backed by local formularies, agreed protocols, defined escalation pathways, and the ability to refer back to the NHS specialist if problems arise. With a private provider, none of this infrastructure exists. The GP has no guaranteed access to urgent specialist advice. The private consultant may not be available if the GP encounters a prescribing problem. If the patient stops paying for private consultations, the shared care arrangement collapses and the GP is left holding clinical responsibility for a medication they did not initiate, in a therapeutic area that may be outside their competence, with no specialist support.
NHS prescribing operates within a tiered formulary system. Green medications are safe for GPs to prescribe independently. Amber medications must be started and monitored by a hospital specialist — typically under a formal shared care agreement. Red medications should only be prescribed by specialists. When a private consultant initiates an amber medication and asks the GP to continue prescribing, they are asking the GP to accept responsibility for a medication that the NHS formulary system says requires specialist oversight — without the shared care infrastructure that makes specialist oversight possible.
The problem is now acute in specific clinical areas. ADHD medication is the most visible example. Multiple Local Medical Committees and Primary Care Networks have advised GPs to stop accepting new ADHD shared care agreements because of workload and governance concerns. Patients diagnosed through private or Right to Choose providers find themselves with a valid diagnosis, a medication that works, and no GP willing to prescribe it. The prescribing boundary becomes a clinical wall: the patient's condition is managed, but only as long as they can afford to keep paying privately for prescriptions that cost significantly more than the NHS prescription charge.
This is not a failure of individual GP practices. It is a structural consequence of two constitutional domains meeting at a boundary neither was designed to govern. The private consultant operates under GMC professional standards and commercial contract terms. The GP operates under the GMS Contract, local formulary guidance, ICB prescribing policies, and the practical reality that accepting prescribing responsibility without adequate support infrastructure exposes them to clinical and medicolegal risk. Both are behaving rationally within their own constitutional domain. The patient falls into the gap between them.
The data governance asymmetry
Within the NHS, clinical data flows through a defined — if imperfect — governance infrastructure. The DSPT provides a mandatory baseline. All organisations accessing NHS patient data must demonstrate compliance with the National Data Guardian's ten data security standards or, for larger organisations, the NCSC Cyber Assessment Framework. GP Connect enables authorised access to GP records across organisations. Shared Care Records provide integrated views of patient data across NHS providers within an Integrated Care System footprint. The Transfer of Care FHIR specifications define how discharge information should be structured, coded, and transmitted. MESH provides secure messaging. SNOMED CT and dm+d provide clinical terminology and medication coding standards.
Private healthcare has no equivalent shared infrastructure. Each private hospital operates its own clinical system. There is no mandated interoperability standard between private providers. There is no private sector equivalent of GP Connect. There is no shared care record spanning private organisations. When clinical information crosses from a private hospital to an NHS GP, the transmission mechanism is typically a PDF letter — sometimes sent electronically via NHS Mail if the private provider has access, often posted physically, occasionally faxed.
A PDF is not governance. When a private discharge summary arrives as a PDF attachment, the GP practice files it in Docman or an equivalent document management system. It sits there as an image of text — unreadable by the clinical decision support algorithms that check for drug interactions, invisible to the medications reconciliation tools that flag discrepancies, excluded from the coded problem list that drives clinical alerts. The information exists, but it is not computationally accessible. The GP must read the letter, manually extract the relevant clinical data, and enter it into the patient record as coded entries. In a practice managing thousands of incoming letters, the gap between receiving information and acting on it can be days or weeks. Private providers need FHIR and MESH connectivity — not as an aspiration, but as the minimum infrastructure for safe crossing back into the NHS domain.
The asymmetry is structural, not just operational. Within the NHS, a discharge summary that fails to arrive is a system failure with defined accountability — the NHS Standard Contract creates a contractual obligation, the DSPT creates a data governance obligation, the Transfer of Care FHIR specifications create a technical standard. When a private hospital's discharge summary fails to reach the GP, there is no equivalent contractual mechanism. The private hospital has a CQC obligation to maintain proper discharge processes, but CQC does not mandate the content, format, or transmission standard for private-to-NHS discharge communication. The NHS Standard Contract applies to independent sector providers treating NHS patients — but not to the same providers treating private patients in the same building.
This means the data governance framework that applies to a patient's clinical information depends not on who the patient is, but on who is paying for their treatment at that moment. The same patient, in the same hospital, treated by the same consultant, will have their data governed by different rules depending on whether they are an NHS patient or a private patient. The crossing between these two governance regimes happens every time a patient moves between NHS and private care — and neither regime includes provisions for how the crossing should be governed.
The return crossing: coming back to the NHS
A patient who has received private treatment is entitled to return to NHS care. This right is absolute — the NHS cannot refuse to treat a patient because they previously sought private care, and private treatment should not affect the patient's position on any NHS waiting list. But the mechanism for return is governed by assumption rather than infrastructure.
The official guidance says the private consultant should arrange the transfer directly — writing to the NHS hospital department, or sending a letter to the GP to initiate re-referral. GP practice policies are characteristically clear about the practical reality: please allow up to seven days for the GP to receive and review consultant correspondence before contacting the practice.
But map this crossing against the Seven Flows that arise at every organisational boundary, and the governance gaps become visible.
Identity. The private provider knows the patient by their registration details — name, date of birth, possibly an NHS number, possibly not. The NHS GP knows the patient by their NHS number, linked to their lifetime clinical record. Is the reconciliation between these two identity assertions automatic, or does it depend on someone correctly matching a name on a letter to a patient in a clinical system? For NHS-to-NHS transfers, the NHS number is the definitive identifier. For private-to-NHS transfers, its use is not mandated.
Consent. The patient consented to treatment by the private provider. They consented — or are assumed to have consented through policy terms and conditions — to the insurer processing their clinical data for claims purposes. But what was the patient told about how their clinical data would be shared when they returned to NHS care? Did they understand that the discharge summary would go to their GP, who might share it with other NHS clinicians? Did they consent to their private treatment history being incorporated into their NHS clinical record, where it becomes visible to every NHS clinician who subsequently accesses that record? The consent architecture for the private-to-NHS data transfer is, in most cases, assumed rather than explicit.
Provenance. The clinical information in the private consultant's letter carries the provenance of the private episode. But when that information enters the NHS clinical record, does the record preserve the provenance — marking it as originating from a private episode, under different governance, with different clinical accountability? Or is it simply filed as incoming correspondence, losing the governance context that should accompany it?
Clinical Intent. The private consultant's letter should communicate what was done, what was found, what treatment was given, and what follow-up is needed. But the content of that letter depends entirely on the individual consultant's practice. There is no private sector equivalent of the PRSB eDischarge Summary Standard with its eighteen defined sections. The GP may receive a comprehensive clinical narrative, or a two-paragraph letter that omits medication doses, fails to specify who is responsible for follow-up blood tests, and does not identify the urgency of any recommended actions.
Responsibility. This is the critical gap. When does clinical responsibility transfer from the private consultant to the NHS GP or NHS specialist? The private consultant's letter may say "please continue monitoring." The GP practice policy may say "we do not accept monitoring responsibilities from private providers." The patient is caught between two clinicians, neither of whom has explicitly accepted responsibility for the ongoing clinical actions the other considers necessary. There is no standard — contractual, regulatory, or professional — that defines the moment of responsibility transfer at the private-to-NHS boundary, or the conditions that must be met for that transfer to be safe.
Service Routing. If the patient needs ongoing specialist care within the NHS, who initiates the referral? The GP practice guidance from Hope Family Medical Centre is direct: the private consultant can refer directly to an NHS hospital without needing a further GP letter. The BMA and NHS England agree. Yet multiple practices report that private providers routinely ask the GP to make the onward NHS referral — passing administrative burden back across the boundary. The routing infrastructure that should govern this crossing is available (e-RS), but the private sector has no systematic mechanism for accessing it directly for the purpose of transferring care back to the NHS.
Outcome. Does the private provider know what happened after the patient returned to NHS care? Did the NHS specialist agree with the private consultant's diagnosis and treatment plan? Were there complications that the private provider should know about for their own clinical governance? The outcome loop — the feedback that closes the clinical cycle — almost never crosses the private-to-NHS boundary. The private provider discharges the patient into a governance black hole and has no structured mechanism for learning whether their treatment delivered a good outcome in the longer term.
The independent sector treating NHS patients: a boundary within the boundary
There is a further complexity that deserves examination. The major independent sector groups — Spire, Nuffield, Circle, Ramsay, HCA — treat both NHS patients and private patients, often in the same facilities, sometimes by the same consultants, sometimes on the same day. When they treat NHS patients, they operate under the NHS Standard Contract. When they treat private patients, they do not.
This creates a boundary within the organisation itself. The independent sector provider must maintain two governance frameworks: one for its NHS-contracted activity, subject to the NHS Standard Contract, DSPT, Transfer of Care requirements, and commissioner oversight; and one for its private activity, subject to CQC regulation, insurer contractual terms, and its own clinical governance policies. The clinical governance for NHS patients must meet NHS standards. The clinical governance for private patients must meet CQC standards. These two frameworks overlap significantly — but they are not identical, and the boundary between them runs through the middle of the organisation.
A consultant who sees an NHS patient in the morning and a private patient in the afternoon operates under different governance frameworks for each encounter. The discharge summary for the NHS patient must comply with Transfer of Care specifications. The discharge summary for the private patient must comply with whatever the hospital's own policy requires. The data governance for the NHS patient's information is governed by the DSPT. The data governance for the private patient's information is governed by UK GDPR and the hospital's own information governance framework — which may or may not align with the DSPT.
The question is whether the independent sector provider maintains these two frameworks as genuinely separate governance regimes, or whether it applies its NHS-compliant framework to all patients — effectively gold-plating its private governance. The answer varies. Where the provider applies NHS standards universally, the private patient benefits from infrastructure designed for a different constitutional domain. Where the provider maintains separate frameworks, the private patient's care is governed by a less demanding standard than the NHS patient in the adjacent bed.
What this means for boundary governance
The NHS-private interface is not a single boundary. It is a system of crossings between constitutional domains — occurring in both directions, at multiple points in the patient pathway, governed by different rules depending on the direction of travel and the funding source at the moment of crossing.
The entry crossing — from NHS to private — strips the patient from the NHS infrastructure that governs their care. Their GP's clinical record, their NHS referral pathway, their Transfer of Care standards, their DSPT-governed data protection — all of this stops applying at the moment they become a private patient. The information they carry across may be comprehensive (if the GP wrote a detailed referral letter) or fragmentary (if the patient self-referred without GP involvement).
The exit crossing — from private to NHS — attempts to reinsert the patient into a governance infrastructure that has no structured mechanism for receiving them. The discharge information is not standardised. The responsibility transfer is not defined. The prescribing continuity is not assured. The GP may actively refuse to continue the treatment the private consultant initiated.
Between the entry and exit crossings, the patient exists in a governance domain that was built for financial services regulation (FCA) and healthcare quality assessment (CQC), but not for the kind of inter-organisational clinical governance that the NHS has spent two decades building — imperfectly, incompletely, but systematically. This is the infrastructure gap that governance-preserving interoperability is designed to close.
The consequence is not theoretical. A patient receiving private ADHD treatment cannot get their GP to continue prescribing. A patient who had a private diagnostic scan cannot get the results seamlessly into their NHS record. A patient discharged from a private hospital waits weeks for their GP to receive a letter that may not contain the information the GP needs to manage their ongoing care safely. A patient who needs to transfer from a private pathway to an NHS pathway for a condition the private sector cannot treat effectively starts the NHS journey from scratch.
These are not failures of individual organisations. They are structural consequences of a boundary between two constitutional domains that was never designed to be crossed — and is now crossed millions of times every year by patients who do not know they are stepping between governance frameworks, and whose clinicians have no shared infrastructure for governing the crossing.
The Paterson Inquiry made the requirement explicit: whole-practice visibility. A consultant's complete clinical activity — NHS and private — must be visible to the governance systems responsible for spotting patterns of harm. The Medical Practitioners Assurance Framework (MPAF) requires this in principle. But the technology infrastructure to deliver it — cross-sector outcome data sharing, linked clinical records across constitutional boundaries, governance-preserving interoperability between NHS and private systems — does not exist. The MPAF strengthens the node; the infrastructure gap leaves the edges ungoverned. Until private providers share structured outcome data with the NHS, and the NHS reciprocates, the Paterson requirement remains a recommendation without a delivery mechanism.
The audit question
Can your organisation answer the following questions about the NHS-private boundaries your patients cross?
When a patient enters your private pathway from NHS care: does their full clinical history arrive in structured form, or does it depend on what the GP chose to include in a referral letter? Is there a defined process for confirming that the clinical information is sufficient for safe decision-making? Is the patient's NHS number used as the definitive identifier, or does the reconciliation between NHS and private identity records depend on manual matching?
When a patient exits your private pathway back to NHS care: does the discharge communication comply with the PRSB eDischarge Summary Standard, even though it is not mandated for private episodes? Is there a defined process for confirming that the GP has received the information and is able to continue the care safely? Is there a mechanism for the GP to signal that the information is insufficient, or that they cannot continue a prescribed medication?
When your organisation treats both NHS and private patients: is there a single clinical governance framework that applies to both, or are there separate frameworks? If separate, is the standard for private patients equivalent to the NHS Standard Contract requirements, or lower? Can your organisation demonstrate, for any given patient, which governance framework applied to their care and why?
If the answers are uncertain — and for most organisations operating at the NHS-private interface, they will be — then the boundary is crossed millions of times a year without the governance infrastructure that either constitutional domain considers necessary for safe care.
Next in the series: The digital front door — how virtual GP services, online triage platforms, and insurer-integrated pathways create the very first boundary crossing in a private healthcare episode, and why the data governance, consent, and routing decisions made at that crossing determine the safety of everything that follows.
Private Healthcare Governance Series
- #1 Practising Privileges and the Governance Gap
- #2 The Provider Network as Ungoverned Constellation
- #3 The Clinical-Commercial Boundary
- #4 The NHS-Private Interface (this article)
- #5 The Digital Front Door
- #6 Clinical Safety at Boundaries
- #7 The Seven Flows Applied to Insured Pathways
- #8 The Regulatory Convergence
Related: Architecting Neighbourhood Health
The same boundary governance methodology applied to NHS multi-organisation networks — including the constitutional complexity of co-locating five independent organisations in a single building.