Misunderstanding the Environment
Since there are several non-NHS organisation-types which will routinely want to talk with the NHS, and pass on personal data, expecting the network to be NHS-only seems a silly idea.
An example from family experience: my mother was receiving carer support from the local Adult Social Services department. The carers were supplied by a private company. The first time somebody wanted to arrange a check by an NHS physiotherapist (or was it an occupational therapist?), we ended up getting several forms to fill in, giving various people permission to pass on my mother's personal data to anybody. It was a generic form, very generic, and the covering letter didn't even explain what had triggered this request.
"Data Protection Act".
It seems to me that it ought to have been obvious that the Social Services department needed to be able to pass information on to medical professionals, if only to arrange appointments, and it surprised me that the council's data protection registration didn't cover this. And after that form was signed, they had permission to supply data to anyone and everyone, such as a commercial operation making up a mailing list to send out a catalogue of disability support products, or a catalogue selling porn movies.
The NHS needs to talk to outsiders. It's often a statutory requirement, and there were times when it seemed that my mother was spending time in hospital because Social Services couldn't pick up the phone. From what I have seen, the NHS doesn't have that many DPA problems, it's essentially the same as the medical confidentiality that they were used to. But some of the outside operators, frankly, just don't get it.
An NHS-only network doesn't solve those problems. Signing up to another network is no guarantee of security. And this morning's report of Oliver Letwin's handling of mail suggests that there is a huge gap to bridge. But better communications in the health field is going to depend on a far better awareness of privacy and responsible data handling.