To ask the Minister of Health to detail (i) who owns the data held by encompass; (ii) how the data is stored; (iii) whether the data is accessible and searchable by the Health and Social Care Trusts; and (iv) whether the data can be accessed for clinical research purposes.

HSC organisations, as data controllers, are responsible for safeguarding the data they contribute to the EPIC supplied Electronic Patient Record (EPR), used by the encompass programme. The system operates under robust legal safeguards to protect NI citizens’ privacy and to ensure that any use of patient data is for individual care or wider public health.

Data is stored within the EPIC EPR, a secure, integrated digital health and care record platform used globally.

Role-Based Access Control (RBAC) methods are used to ensure staff can only access data relevant to their roles. RBAC profiles are applied after staff have completed the training appropriate for their job, as identified by HR. All HSC staff are contractually obligated to ensure that personal data is treated with the highest levels of confidentiality and staff adhere to the HSC Code of Practice on Protecting the Confidentiality of Service User Information, GDPR legislation, and the common law Duty of Confidentiality. A full audit trail of accesses is maintained within the system.

Data within the encompass system may be made available for research in accordance with the wider HSCNI Data Strategy (2022-2030) and in conjunction with the HSC Data Institute and the Northern Ireland Trusted Research Environment (NITRE). These bodies will enable the best practice exploitation of information held by the HSCNI to support collaborative research whilst ensuring appropriate safeguards are in place.