England's health and care system is thousands of separate legal entities, and that separation is where accountability lives. This is the blueprint for joining it up without dissolving it — what federates at each of the four layers, what it costs, and an honest account of which parts are running today.
Every proposal to join up health and care data eventually meets the same wall. England's health and care system is not one organisation. It is thousands of separate legal entities, and the separation is load-bearing: it is where accountability sits.
commvita is built the second way. That is a design commitment with consequences, not a slogan, and the rest of this document is the evidence for it.
“Federated” is not one thing. Identity, record, query and governance each have to federate on their own terms, and a platform that does one of them is not federated.
A master patient index resolves a person across sources and identifier schemes, rather than creating one merged record that some organisation then has to own. A national record locator points at where a document lives instead of copying it.
The shared record is assembled from contributing systems and is explicit that the source systems remain the systems of record. Care homes and community providers contribute and read through the same contract as an acute trust.
A cohort question is executed at each site and returns an aggregate. Counts below five are suppressed, so a small cohort cannot be narrowed to a person. This is the layer that makes multi-site research and population analysis possible without a transfer.
Data sharing partnership agreements with their signatories and review dates; a Caldicott queue for non-direct-care access; cross-controller notification when a non-controller reads; and an append-only hash-chained access log re-verified whenever it is read.
A person's reach is resolved at sign-in from their own organisations, anything delegated to them and any group they belong to. No organisation's boundary is enforced by hiding a menu — the same check applies to a typed URL.
effective_scope() ·
/rbac-matrixSharing preferences are held per person, including partial objection by category, and are expressed as a standard consent resource so they travel with the query rather than being re-implemented at each site.
HL7 v2 and FHIR R4 over the connector layer, IHE profiles for cross-enterprise document exchange, and a canonical data model for secondary use — so a participant is not buying a dependency on commvita to talk to its neighbours.
The federation network is demonstrated, not deployed. The query layer, its node board and the suppression rule are built and behave as described against seeded nodes. commvita is not today operating a live multi-organisation query network, and nothing in this document should be read as saying it is.
Three entity counts here are secondary. Only the ICB figure was read from its instrument. The publishers of the other three could not be reached from this build environment, so they carry a “secondary source” tag in the figure rather than a footnote nobody reads.
Federating does not remove the need for agreements. It changes what they have to say. A partnership agreement is still signed, still has signatories and a review date, and is still the thing an information governance team is accountable for.
The Community Edition is not free. It is £1 per instance, with optional paid support, and carries the platform base — identity, access, audit, data fabric — deliberately without the clinical record or clinical workflow.
| Capability | Route | API / basis | Status |
|---|---|---|---|
| Resolve one person across organisations EMPI Hub | /empi | GET /empi/ | Live |
| Point at a record without copying it NRL Connector | /nrl-connector | National Record Locator v3.0 · FHIR DocumentReference | Demonstrated |
| Shared cross-organisation record Single Patient Record · NHR | /single-patient-record · /nhr | GET /nhr/ | Live |
| Care homes contribute and read Care Homes Shared Record | /care-homes-shared-record | PRSB Core Information Standard | Demonstrated |
| Aggregate-only cohort feasibility, k≥5 Federated Cohort Discovery | /cohort-discovery | GDPR Art.89 · ICO anonymisation | Demonstrated |
| Cross-site query, no rows transferred Federated Query | /federated-query | GET /federated-query/nodes · /execute · /governance | Demonstrated |
| Sharing agreements and signatories DSPA Manager | /dspa-manager | GDPR Art.26 joint controller | Demonstrated |
| Caldicott queue, cross-controller notice Confidential IG Spine | /ig-spine | Caldicott 8 · National Data Opt-Out | Demonstrated |
| Hash-chained access log, verified on read Legitimate Relationship Log | /legitimate-access-log | GET /legitimate-access/events | Live |
| Federation governance surface Federated Governance | /federated-governance | GET /federated-governance | Live |
| Person-level sharing objection Shared Care Opt-Out | /shcr-opt-out | FHIR R4 Consent · DUA Act 2025 | Demonstrated |
| Scope resolved at sign-in RBAC and scope | /rbac-matrix | effective_scope() · effective_role() | Live |
| Organisational map as sourced configuration Jurisdiction Profile | /jurisdiction-profile | health_system §7.2 · ICB Order 2026 | Live |
| Standards on the wire PulseGrid · EPR Hub · IHE | /connector-dashboard · /epr-hub · /ihe-profiles | HL7 v2 · FHIR R4 · IHE XCPD/XCA | Live |
| Canonical model for secondary use FDP CDM Console | /fdp-cdm | GET /fdp-cdm/extract/{product} | Live |