Palantir Gained Access to NHS Patients' Personal Data, and Parliament Is Pushing Back

NHS England granted US company Palantir full access to patients' personal data while the company built an AI platform for healthcare analytics and improvement. The most troubling part: the data was shared before it had been anonymized, complete with names, addresses, and medical histories. The arrangement has drawn sharp criticism in Parliament and raised privacy concerns for millions of Britons.

How it happened

NHS England signed a data access agreement with Palantir and other contractors as part of the Federated Data Platform, a unified system for healthcare analytics. According to the Financial Times, Palantir received "unrestricted access" to certain categories of patient data earlier than it should have.

People inside the NHS understood the danger. Documents obtained by journalists show that staff worried about a "risk of loss of public trust" and other reputational problems. Access was granted anyway, apparently to speed up development of the platform.

Well-designed systems typically either fully anonymize data, stripping out anything that points to a specific person, or tightly limit who can see it. Here, the worst of both happened: a US company got access to UK citizens' personal data before that data was protected.

Criticism from Parliament

MPs called the approach "dangerous" and said it would "fuel public concerns about data privacy." Their criticism focuses on several points:

• Palantir is a foreign company, and its access to healthcare data raises geopolitical questions
• Identifiable data was exposed without adequate protection (before anonymization)
• The NHS itself knew about the risk but acted in a rush
• There is no transparent explanation of why the data couldn't have been de-identified first
• Patient privacy is being sacrificed for development speed

MPs are demanding a full explanation and stricter policies for future projects.

Why it matters

The Federated Data Platform is a genuinely needed project. A unified data system could help the NHS spot disease patterns, optimize treatment, and save lives. AI in healthcare is not the enemy. The enemy is deploying these technologies without proper privacy protections.

"Risk of loss of public trust" — a phrase from internal NHS documents

What stands out is that the NHS knew. It saw the risk. But it moved in a hurry anyway, apparently under pressure from deadlines and budgets.

What it means

This case is a textbook example of the tension between deploying new technology quickly and protecting citizens' rights. When companies (especially foreign ones) and governments rush to roll out AI, they often ignore privacy. That's a mistake: losing public trust can cost far more than a few extra months spent properly protecting data.

For businesses and IT companies, the lesson is simple: security first, development speed second.