All health and social care organizations in England must comply with this by September 2021 (delayed from original date due to the pandemic). This was based on a recommendation from the previous National Data Guardian.
Scotland, Wales and Northern Ireland have different policies.
Massive data sets were mobilized for covid-19, and I advise anyone politically exposed that it would be unwise to consider their health records a secure secret, and to challenge the security controls on any private electronic information.
If you really have a privacy risk, you already know how to avoid these issues, but everyone should understand and always assert their privacy rights, because there are a lot of parties interested in taking them.
Scotland, Wales and Northern Ireland have different policies.