A few days ago, I wrote a short piece on Palantir and the serious concerns over the governance of NHS data.
I kept seeing it in the news and wanted to understand it better. Writing about it sent me down something of a rabbit hole, and it reminded me of the scandal surrounding TPP.
Specifically, I remembered the racist comments made by its founder, Frank Hester, about MP Diane Abbott in 2024. That memory sent me back online to look more closely at TPP’s history. And then I did the same for EMIS, which led me to Pharmacy 2U.
If you work in or around primary care, you will know who TPP and EMIS are. TPP and EMIS are the two companies whose clinical systems hold the electronic patient records for the vast majority of NHS GP practices. SystmOne is TPP’s product. EMIS Web belongs to EMIS.
What I found when I looked more closely at these companies reminded me that Palantir is not an anomaly. It is part of a pattern that is much older than the current controversy concerning data security.
The pattern is this: a scandal emerges, or serious questions are raised, statements are made, trade bodies respond, and then quietly, the contracts continue, and the data and its commercial value remain in the same hands.
Palantir
In November 2023, NHS England signed a contract with Palantir Technologies worth up to £330 million to build the Federated Data Platform.
The company, co-founded by Peter Thiel, has a well-documented history of working with US defence and intelligence agencies.
- Multiple NHS trusts declined to join the platform
- Campaigners raised conflicts of interest
- The contract proceeded
The data being fed into this platform includes patient records, referral pathways, and waiting list data. The stated purpose is efficiency. The concern is who else that data could serve, under what future commercial arrangements, and whether patients understand what they have consented to.
The controversy generated significant media coverage. The contract continues.
TPP
The Phoenix Partnership may not be household name outside of primary care. But SystmOne holds records for 50 million NHS patients, and over 260,000 staff across health and social care rely on it daily.
- In 2023, TPP received a contract with the UK Health Security Agency without a competitive tender process. In the same period, its founder, Frank Hester, had made a significant political donation to the Conservative Party.
- In March 2024, The Guardian reported that Hester had made racist and misogynistic comments about MP Diane Abbott
- The BMA voted to say he had contravened NHS England’s fit and proper person test
- NHS trusts were asked to consider their positions. They awarded new contracts anyway
There is also a data history that predates all of this.
Between 2015 and 2018, SystmOne shared the records of 150,000 patients who had explicitly opted out of data sharing.
EMIS and Pharmacy 2U
In 2015, Pharmacy2U, an NHS-approved online pharmacy that was 20% owned by EMIS and whose board included the EMIS chief executive as a non-executive director, sold the personal data of over 21,000 NHS patients to third-party marketers. The data was sold at £130 per 1,000 records, which works out at thirteen pence per patient.
The buyers included:
- An Australian lottery company was under criminal investigation by Trading Standards for fraud and money laundering, which specifically targeted elderly men aged 70 and over with chronic health conditions
- A Jersey-based health supplements company that was cautioned for misleading advertising and unauthorised health claims
The ICO fined Pharmacy2U £130,000 and described it as a serious contravention of the Data Protection Act. EMIS said the decision had been made without its knowledge. The BMA called for custodial sentences.
Eight years later, in October 2023, EMIS was acquired by Optum, a subsidiary of UnitedHealth Group, for £1.2 billion.
- UnitedHealth is the largest private health insurer in the United States
- The CMA ran a full Phase 2 investigation, identified initial competition concerns, and ultimately cleared the deal
- The electronic patient records of the majority of NHS GPs are now owned by a US health insurance giant whose business model in America is built on data-driven decisions, including AI-assisted treatment denials
The CMA concluded the NHS retains sufficient oversight to prevent data misuse. That may be true. But it is worth being honest about what oversight of a £1.2 billion acquisition by a foreign insurer actually looks like in practice, when the same regulator cleared the deal.
As of early 2025, press reports suggested UnitedHealth was seeking to sell Optum UK, including EMIS, to private equity. The GP records infrastructure that has taken decades to build may be about to change hands again, this time to a buyout firm with no history in healthcare delivery.
The Pattern
4 companies. 4 sets of controversies. 4 rounds of statements, investigations, and calls for change. And in each case, the contracts continued.
This is not a coincidence. It is the structural logic of a system that has made itself dependent on a small number of technology providers in ways that are almost impossible to unwind without genuine risk to patient safety and operational continuity.
The commercial value of NHS data is enormous. Fifty million patient records. Longitudinal health histories. Population-level insight that no private dataset in the world can replicate.
What Needs to Change
I am not a policy expert, but what I do understand is that companies are making millions, in some cases billions, from NHS data and continue to face consequences that amount to little more than a small fine and a press statement.
At the very minimum, there needs to be harsher, more meaningful accountability for the companies profiting from data that belongs to patients.
