From 15 July 2026, anyone offering Buy Now, Pay Later credit in the United Kingdom has had to answer to the Financial Conduct Authority. Deferred Payment Credit, the interest-free instalment product that has quietly become one of the fastest-growing forms of consumer borrowing in the country, moved from an unregulated grey zone into full FCA oversight, with lenders required to hold proper authorisation, run affordability checks and give customers clear information before they borrow. Writing in these pages this week, the chief executive of NatWest Boxed argued that the change is less about compliance than about a reckoning retailers have avoided for years. Retailers built their businesses on trust with their customers, then handed the credit relationship to a third party at the exact moment that relationship deepened. Regulation, in his telling, is the prompt to ask whether that arrangement still makes sense.

It is a narrower question than it sounds, and a more familiar one than a health service reader might expect. Replace the retailer with an NHS trust, the third-party lender with a data platform vendor, and the shape of the argument barely changes.

The clearest illustration sits inside NHS England's own digital infrastructure. The Federated Data Platform, built by a consortium led by Palantir Technologies under a contract worth up to £330 million, now underpins bed management, elective recovery tracking and patient flow across a growing number of trusts, with national planning guidance setting an expectation that all providers and integrated care boards be onboarded and using its core tools by 2028/29. That is a substantial transfer of operational dependency to a single external supplier, and the past two months have shown how uncomfortable that dependency can become. NHS England was forced to admit that a data protection impact assessment had understated who could see identifiable patient information within the platform, after it emerged that Palantir staff could access it. The government has confirmed it is weighing whether to exercise a break clause and end the arrangement when the contract reaches its scheduled expiry in February 2027, and a Commons select committee has already recommended it do exactly that.

None of this means the platform has failed operationally. NHS England points to more than 100,000 additional patients supported through procedures since its rollout, even as campaigners and statisticians have questioned how much of that can fairly be attributed to the software rather than other factors. The dispute itself is the point. A health system that has leaned on a single vendor to hold and interpret its most sensitive operational and clinical data now finds itself unable to answer confidently what that vendor can see, what it has delivered, and how easily it could be replaced. That is precisely the position Ellis describes retailers occupying with BNPL, only with patient records rather than purchase histories at stake, and a public trust dimension that a missed loan repayment could never carry.

The parallel extends further than data platforms. Ambient voice technology now transcribing clinical consultations, and the noncompete disputes tying NHS-trained staff to proprietary electronic record systems such as Epic, share the same underlying structure. In each case, a system built to serve patients has allowed a commercial intermediary to become the custodian of information, workflow or skill that the NHS cannot easily reclaim.

Regulation of consumer credit will not, by itself, change how the NHS manages its vendor relationships. But the FCA's intervention offers a useful discipline that health policy has been slower to apply to itself: forcing an institution to state plainly who holds a relationship, on what terms, and what it would cost to take it back. As NHS leaders weigh the FDP's renewal, and as ministers decide whether the 2027 break clause is exercised or waved through, that is the question worth putting to them directly. It has taken a change in consumer credit law to make retailers ask it of themselves. The NHS should not need a regulator to ask it first.