A user's information, including their health status, the treatment they received or any stay in a facility, is confidential; no third party may disclose information submitted to the Fund's platform unless the user consents in writing, providers share it among themselves lawfully in users' interests, it is required by an accredited provider, establishment, supplier or researcher for the lawful, non-commercial purpose of improving health care practice and policy, the Fund uses it for its own lawful functioning, a court order or law requires disclosure, or non-disclosure would seriously threaten public health (section 40(4)). The platform has to build in fraud and risk management (section 40(5)), and selling or disclosing the Fund's confidential information without its written consent is an offence under section 54(1)(e).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.