According to the lawsuit filed by Texas Attorney General Ken Paxton, a parent logging into a hospital portal would find part of a child’s record hidden once the child reached the age of 12. Medication lists, treatment notes and messages from clinicians would no longer appear. The information still existed. A default setting had moved the threshold of access, and a state with firm views on parental rights treated that as a deceptive practice by the software supplier.

Texas has now withdrawn those claims, citing recent changes to Epic's software, and continues with its antitrust case under state law. Epic maintained throughout that it does not decide parental access, which is set by doctors and health systems. The attorney general framed the dispute in partisan terms, describing the company as woke, and a British reader could reasonably file the whole affair under American politics. The relevance to the NHS is more modest than a direct read-across would suggest. It is nonetheless real, and it is structural.

Epic is no longer a distant name. A growing number of large acute trusts in England have adopted it, and the government's plans for a single patient record, reached through the NHS App, assume that a small number of supplier platforms will behave as policy intends. The ten year plan treats the electronic record as infrastructure. Infrastructure carries obligations of oversight that a procurement contract rarely captures.

The Texas dispute shows how policy migrates into configuration. Guidance on children's records in England is subtle. Parental access narrows as a child gains competence, and clinicians are expected to judge confidentiality case by case, particularly for adolescents seeking sensitive care. A software default turns that judgement into a rule applied automatically to every record that crosses an age threshold. Who chose the default, who approved it and who can alter it are questions of governance. They are seldom asked when a trust signs a contract, and they surface only when a parent or a litigant raises them.

Epic's position, that decisions belong to health systems, is probably correct in a narrow sense and unsatisfying in practice. Trusts configure within the options a supplier provides. The supplier sets the menu and the customer orders from it. A chief clinical information officer in a trust under financial strain, mid-implementation, with training time scarce and clinicians stretched, will usually accept the standard build. Operational pressure encourages the acceptance of defaults, and defaults accumulate without anyone having decided them. The NHS has a long history of local variation producing national surprises, and its experience of large IT programmes should make it wary of assuming that a vendor's standard settings match the law, guidance and public expectation.

The antitrust claims are a separate matter and remain untested. Texas alleges that Epic uses exclusionary tactics against partners, customers and its own employees, raising hospital costs and blocking innovative technology. Epic will contest this, and a British observer has no basis for judging the merits. The structural question is nonetheless familiar. Once a trust has committed to an integrated record, the cost and disruption of leaving are considerable. Terms of interoperability then matter a great deal. Smaller health-tech firms depend on access to interfaces to reach clinicians and patients. The life sciences strategy depends on health data that can move between systems and into research. If the dominant platform controls the terms of integration, the pipeline of innovation that ministers say they want narrows without any dramatic act of exclusion.

British institutions have tools for this, although none was designed for the purpose. The Procurement Act 2023 gives contracting authorities greater flexibility to assess the risks of supplier lock-in and the options for exiting contracts. The Competition and Markets Authority has market investigation powers it has not so far applied to clinical software. The absorption of NHS England into the Department of Health and Social Care places responsibility for digital standards more squarely with ministers, which makes political accountability clearer and the consequences of neglect more visible.

The practical implications are specific. Trust boards should require suppliers to document default configurations that touch patient access, consent and confidentiality, and should secure contractual rights to review and change them. The department should set national standards for proxy access and adolescent confidentiality that every supplier must meet, so that a teenager's privacy does not depend on which platform their local hospital bought. Suppliers should expect that openness on interfaces and change logs will become a condition of doing business. Health-tech companies should press for those terms now, while the single record is still being specified.

Public trust sits beneath all of this. The controversies over care.data and over the extraction of GP data for planning showed how quickly confidence erodes when people discover that decisions about their records were made somewhere they could not see. Parents and teenagers both have legitimate interests in a child's record, and they will not always agree. A health service that cannot explain who set the rule will struggle to defend it.

Texas resolved this part of its dispute through a change to software, which shows that the problem always sat within reach of configuration. The task for the NHS is to know who holds that control and what they have chosen before a dispute forces the answer into the open.

‍