Require a usable exit from clinical suppliers
Before signing a contract, ask for an example export of the information the service will need if it changes suppliers. Include records, attachments, consent history, prescriptions, and outstanding tasks. A list of completed appointments alone may not support safe continuation.
Use the ICO's special-category framework to assess the purposes and roles in the transfer. Identify the appropriate lawful basis and condition, along with security and retention responsibilities. A commercial right to download data should not be mistaken for a complete privacy assessment. ICO: special category data rules
Run a migration rehearsal with synthetic records. Ask a clinician to interpret the exported information in the receiving process. Check that dates, identity, and relationships between files remain clear. Technical file completeness is different from clinical intelligibility.
Agree how the outgoing supplier supports unresolved issues during transition. Preserve access long enough for the lawful operational need, then remove unnecessary permissions. Make the patient contact route stable while the company changes systems behind it.