Health information and technology
The third term group covers health information and technology. The draft's definitions are not public.
What the public record carries
Not stated in the public record beyond the group title. The public abstract treats health software on one side and health IT systems on the other as related but separate, and names integrators, administrators and cloud providers as parties. The group title tells the reader that information and technology are treated together. The draft's definitions are not public.
Basis. The public preview carries the group title; the definitions are not public.
Why it matters in a health estate
The boundary of the system is the hardest fact to settle and the one most likely to be wrong. A clinical application that depends on an identity service, a network, a device and a cloud host is one system in use and several systems in contract. If the register's boundary follows the contract rather than the use, the evidence will cover the part the supplier controls and miss the part where incidents actually happen.
What to do now
Draw the system boundary from the clinical workflow backwards: the user, the device, the application, the interfaces, the identity and the hosting. Mark which parts the organisation controls, which it influences and which it only relies on. Use that drawing for the scope note and the supplier list.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Boundary drawing | The workflow, devices, applications, interfaces, identity and hosting, with control marked |
| Interface list | Every interface, its owner and the evidence that it was tested |
| Data map | The health information that crosses each boundary and where it rests |
| Supplier list | Each supplier against the part of the boundary it operates |
What a reviewer will ask
An auditor will ask where the system ends and who operates each part. A boundary that stops at the application leaves the dependencies unexamined.
Common gaps
- The boundary stops at the application and excludes identity, network and hosting
- An interface is assumed to work because it worked in a test environment
- Health information is mapped in one system and not in the copies that feed reporting
- A cloud provider is treated as a utility rather than as a party named by the abstract
Before the draft publishes
Redraw the boundary from the clinical workflow and compare it with the supplier list. Every part without a supplier is a gap.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The system owner, the data protection lead and the integration lead, because this group fixes what counts as the system, the information and the technology around it.