Health Identity and Interoperability Act 2026 (HII)

To establish a secure, proportionate and accessible framework for identifying patients, locating health information, verifying authorised health practitioners and facilities, and enabling safe interoperability across Links Land. This Act works in conjunction with the Linkslandic Health Service Act 2026, Data Protection Act 2026, Public Administration Efficiency Act 2025, Unity and Equality Act 2025, Health Information and Patient Privacy Act 2026, and Senior Dignity and Welfare Act 2025. It shall be read alongside those Acts and shall not displace their existing legal effect.

Section 1A - Purposes

(a) This Act establishes health-specific identification and information infrastructure while protecting privacy, equality, accessibility and continuity of care.

(b) The infrastructure shall support safe treatment, lawful administration, public accountability and interoperability without creating a general identity system.

Section 1B - Definitions

(a) Health ID means a random, non-descriptive identifier issued for lawful health and social-care purposes.

(b) Patient index means a limited record used to locate authorised sources of a person's health information and not to store diagnoses or full clinical records.

(c) Health provider means a person or facility lawfully authorised to provide health or social care in Links Land.

Section 2A - Issue of Health IDs

(a) A resident shall be issued a Health ID at birth registration or upon first contact with the Linkslandic Health Service.

(b) A visitor or migrant may receive a temporary Health ID sufficient to support treatment and lawful administration.

(c) The Health ID shall not encode a person's name, date of birth, sex, gender, county or other descriptive information.

Section 2B - Limits on Use

(a) A Health ID may be used only for purposes authorised by this Act or another specific health, social-care or public-health law.

(b) An employer, landlord or insurer shall not require a Health ID or use it to make an employment, housing or insurance decision.

(c) No person shall be refused urgent or necessary care because they lack, cannot produce or dispute a Health ID. Administrative verification may follow treatment.

Section 2C - Misuse

(a) Knowingly obtaining, disclosing or using a Health ID for an unauthorised non-health purpose is an offence, subject to the ordinary requirements of criminal procedure and proportionality.

(b) A person is not criminally liable for an accidental disclosure promptly reported and reasonably remedied, or for conduct authorised by law.

Section 3A - Limited Content

(a) The patient index may contain only the person's name, date of birth, address or service address where necessary, preferred language, contact preferences, access needs, Health ID and locations of authorised records.

(b) The patient index shall not contain diagnoses, treatment histories, genetic information or other clinical content except where strictly necessary for immediate safety and separately protected by law.

(c) Legal gender information shall not be included in the index or displayed by default. Where clinically necessary or authorised by the patient, it shall be handled as a restricted field in accordance with the Health Information and Patient Privacy Act 2026 and the Unity and Equality Act 2025.

Section 3B - Accuracy and Duplication

(a) The responsible authority shall provide an accessible procedure for correcting inaccurate index information within the applicable processing period.

(b) Potential duplicate entries may be linked or merged only after verification, with an audit record preserving the source, reason, date and responsible official.

(c) A person affected by a merger or refusal to correct information may complain to the independent Health Information Commissioner and seek review by a court or tribunal of competent jurisdiction.

Section 4A - Registers

(a) The Linkslandic Health Service shall maintain a register of authorised health practitioners and a register of authorised health and care facilities.

(b) The registers may show a practitioner's professional category, licence or registration number, authorised scope and current status, and a facility's name, type, location and authorisation status.

(c) The registers shall not publish private residential addresses, private contact details or other information unnecessary to verify authorisation.

Section 4B - Accuracy and Status

(a) Suspension, restriction, expiry or restoration of an authorisation shall be recorded without unreasonable delay and, where practicable, on the day the decision takes effect.

(b) A practitioner or facility may request correction or review of a register entry through a prompt and accessible process.

Section 4C - False Representation

(a) A person who knowingly represents themselves as an authorised health practitioner or facility when they are not so authorised commits an offence.

(b) The offence does not apply to a reasonable mistake corrected promptly, to a student or trainee acting under lawful supervision, or to conduct otherwise authorised by law.

(c) The maximum penalty shall be determined under the applicable criminal-procedure classification and shall not exceed five years' imprisonment.

Section 5A - Open Standards

(a) A health or care system designated by regulation shall exchange relevant information through published, documented and non-proprietary interfaces.

(b) Regulations may specify interoperable standards, including standards for clinical messages, diagnoses, clinical terms, laboratory results and medicines, provided that the standards are evidence-based and support safety, privacy and accessibility.

(c) No regulation shall require a provider to purchase or use a particular commercial supplier's product.

Section 5B - Certification and Small Providers

(a) The Linkslandic Health Service may operate a certification scheme for conformance, security and accessibility.

(b) A proportionate grant or technical-support scheme shall be available to small and rural providers where connection costs would materially threaten service continuity.

(c) A provider shall not be penalised for a temporary failure caused by a security incident, infrastructure failure or approved transition plan where it has taken reasonable continuity measures.

Section 5C - Consultation and Change

(a) Before prescribing or materially changing a standard, the responsible authority shall consult providers, patients, disabled persons' organisations, privacy experts, practitioners and software suppliers.

(b) The authority shall publish the evidence, security assessment and accessibility assessment supporting the change.

Section 6A - Single Point of Access

(a) The health service shall provide access through the Unified Digital Portal required by the Public Administration Efficiency Act 2025 and shall not establish a conflicting general-purpose identity portal.

(b) Nothing in this section prevents a person from receiving care or using a health service through a clinic, telephone, paper or in-person route.

Section 6B - Language and Disability Access

(a) Digital and non-digital services shall meet applicable accessibility requirements and the translation obligations of the Unity and Equality Act 2025.

(b) A patient-facing service shall provide reasonable support for people unable to use digital authentication, including because of disability, age, language, lack of connectivity or temporary incapacity.

Section 6C - Offline Operation

(a) Designated clinics shall maintain an offline procedure for recording essential information and restoring or reconciling it securely when connectivity returns.

(b) Offline records shall be minimised, protected against unauthorised access and reconciled under an auditable process.

Section 7A - Children and Young People

(a) A parent or lawful carer may manage a child's account to the extent permitted by law and the child's welfare.

(b) When a young person is competent to manage their own information, access shall be adjusted in accordance with the competence test in the Health Information and Patient Privacy Act 2026.

Section 7B - Guardians

(a) A court-appointed guardian may act only within the limits of the appointment and applicable law.

(b) Every representative action shall be logged, and a senior person shall be able to inspect the log unless a narrowly defined safeguarding reason prevents disclosure.

Section 7C - Safeguards

(a) A representative's access shall be limited to what is necessary for the authorised purpose and may be suspended where misuse or conflict of interest is suspected.

(b) A patient or representative shall have an accessible route to challenge an access decision.

Section 8A - Access Logs and Patient Rights

(a) Every access to a patient index entry shall be logged with the identity or system of the accessor, the time, the purpose and the information accessed.

(b) A patient shall be able to inspect the access log and request correction of an inaccurate entry, subject to a narrowly defined safeguarding exception recorded with reasons.

Section 8B - Security

(a) The responsible authority shall apply encryption, authentication, least-privilege access, segregation of duties, breach detection, recovery testing and independent penetration testing appropriate to the risk.

(b) A significant security incident shall be reported to the applicable data-protection authority and Health Information Commissioner without unreasonable delay, and affected persons shall be informed where required by law.

Section 8C - Independent Commissioner

(a) An independent Health Information Commissioner shall audit this Act, investigate complaints, issue compliance guidance and report annually to Parliament.

(b) The Commissioner shall have appropriate powers of inspection and enforcement subject to judicial safeguards, confidentiality obligations and the Data Protection Act 2026.

Section 9A - Processing Periods

(a) Applications for a Health ID, practitioner registration or correction of an index entry shall ordinarily be processed within the period applicable to citizen requests under the Public Administration Efficiency Act 2025.

(b) Urgent clinical care shall not be delayed by an administrative processing period.

Section 9B - Staged Commencement

(a) The responsible authority may bring provisions into force in stages by published order after completing the assessments required by this Act.

(b) The stages shall prioritise safe Health ID issuance and registers, then tested interoperability, and finally connection requirements for private providers.

(c) An order shall state the affected services, commencement date, readiness evidence, support available to providers and any temporary exemption.

Section 9C- Funding and Parliamentary Review

(a) The government shall publish the expected implementation, operating, training, security and grant costs before each stage begins and identify the funding source.

(b) Parliament shall review the operation, rights impact, security performance, provider burden and value for money of this Act at least every three years.

Section C1 - Rights and Legal Alignment

(a) This Act shall be interpreted consistently with the Constitution, including the right to healthcare, equality, privacy, dignity, accessibility, due process and effective review.

(b) This Act works in conjunction with the Linkslandic Health Service Act 2026, Data Protection Act 2026, Public Administration Efficiency Act 2025, Unity and Equality Act 2025, Health Information and Patient Privacy Act 2026, and Senior Dignity and Welfare Act 2025.

(c) Where a conflict is alleged, the relevant constitutional court or tribunal retains its ordinary jurisdiction and remedies.