I am writing to confirm that I have now completed my search for the information which you requested.

Request

You asked us:

The NHS Business Services Authority (NHSBSA) received your request on 5 February 2026.

We have handled your request under the Freedom of Information Act 2000 (FOIA).

Our response

Question 1 – Is financial information provided in HC2/HC3 applications (including payslips, bank statements, and income details) shared with or accessible by other departments within NHS BSA, specifically debt recovery teams?

I can confirm that the NHSBSA holds the information you have requested.

Access to application or financial information is not granted routinely to any other department outside of our Help with Health Costs department. The NHSBSA shares information internally on a strict need-to-know basis. Only those colleagues who require access to personal data in connection with their roles are granted access.

Debt recovery teams can check whether a person has a valid HC2/HC3 certificate. They do not have access to the financial information or supporting evidence used in the application and cannot see how the assessment was carried out.

Question 2 – What specific data protection barriers, if any, exist between the HC2/HC3 assessment function and debt recovery functions to prevent internal sharing of applicant financial information?

I am writing to advise you that the information you requested is not held by the NHSBSA.

This question would require an explanation to be provided, thereby creating new information, rather than providing recorded information.

Question 3 – Under what circumstances and legal basis would HC2/HC3 applicant data be shared internally within NHS BSA?

Circumstances that data may be shared

We do not hold this information. There is no list of circumstances available where data may be shared.

Any internal sharing is considered on a case-by-case basis, taking into consideration the requirements of the work, and only when it is strictly necessary to do so.

Legal basis that data may be shared

Under Section 21 of the FOIA we are not required to provide information in response to a request if it is already reasonably accessible to you.

Information on the legal basis of processing applications, including internal sharing as required, can be found at the below link:

https://www.nhsbsa.nhs.uk/our-policies/privacy/lawful-basis-processing#jumplink7

You can search “Low Income Scheme” using your web browser’s search function to find information on the legal basis for that processing.

The NHSBSA shares information internally on a strict need-to-know basis. Only those colleagues who require access to personal data in connection with their role, are granted access.

Question 4 – What are the stated purposes for which HC2/HC3 application data is processed?

Question 5 – Please provide a copy of your privacy notice relating to HC2/HC3 applications.

See the below which answers both questions 4 and 5.

Under Section 21 of the FOIA we are not required to provide information in response to a request if it is already reasonably accessible to you.

The LIS privacy notice can be found at the below link.

Information on the purpose of processing is provided under “Why we process your information”.

https://www.nhsbsa.nhs.uk/our-policies/privacy/nhs-low-income-scheme-privacy-notice

Data Queries

Please contact foirequests@nhsbsa.nhs.uk ensuring you quote the above reference if you have any specific questions regarding this response; or, if you feel you may be misunderstanding or misinterpreting the information; or, if you plan on publishing the data.

Reusing the data and copyright

If you plan on producing a press or broadcast story based upon the data please contact communicationsteam@nhsbsa.nhs.uk. This is important to ensure that the figures are not misunderstood or misrepresented.

The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988 and is subject to NHSBSA copyright. This information is licenced under the terms of the Open Government Licence detailed at: http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Should you wish to re-use the information you must include the following statement: “NHSBSA Copyright 2026” This information is licenced under the terms of the Open Government Licence:

http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Failure to do so is a breach of the terms of the licence.

Information you receive which is not subject to NHSBSA Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated. Please obtain their permission before reproducing any third party (non NHSBSA Copyright) information.