Private firms can already get their hands on your NHS records Analysis: A new law could weaken protections for our NHS data. But it can already be accessed without consent