NHS England Fit and Proper Person Test Framework Goes Live

The NHS England Fit and Proper Person Test Framework (FPPT) took effect on 30 September 2023. From this date onwards, NHS trusts, Foundation Trusts and ICBs should:

• obtain references using the new Board Member Reference template for all new appointments to Board Member roles
• carry out assessments of whether Board Members meet the FPPT, both at the time of appointment and on an ongoing basis, following the guidance in NHS England’s Framework
• complete and retain references using the new Board Member Reference template for any Board Member who leaves the Board for any reason, regardless of whether a reference has been requested

The Framework reminds NHS organisations that they should communicate with all board members whose details will be included in the Electronic Staff Record for the purpose of the FPPT. The Framework states that “by doing so directors will be afforded the opportunity to object if they have concerns regarding the proposed use of the data… and data controllers will be able to consider these concerns and amend their approach if necessary”.

As an immediate step, all NHS organisations caught by the Framework (whether NHS trusts, Foundation Trusts or ICBs) should review their relevant Privacy Notices and ensure that, for individuals classed as Board Members for the purposes of the Framework, these reference the processing of personal data for the purposes of the FPPT, and set out an appropriate lawful basis for doing so. This lawful basis may be different for NHS trusts and Foundation Trusts (which are subject to the regulatory requirements under the Health and Social Care Act) compared to ICBs which, whilst not registered with CQC, are still expected to comply with the Framework.

There has been some debate as to whether it is also necessary to amend directors’ contracts of employment to make reference to this use of their personal data. However, whilst it is important to ensure Privacy Notices accurately reflect the position, there should be no need for this processing of personal data to be specified in the contracts. It may be helpful, though, for the contracts to reflect when roles are subject to the FPPT.

If you require support in connection with any data protection, governance, regulatory or HR issues arising from the Framework – whether FPPT policies, privacy notices, Board briefings, or advice on individual assessments or references – please get in touch with Carlton Sadler, Partner, Alastair Currie, Partner or Ben Pumphrey, Senior Associate.