NHS standards and assurance

Healthcare Data Management: Beyond Individual Care · England with UK-wide law · Sources checked 19 October 2026.

NHS requirements depend on the organisation, product, data access and intended use. Holding health data does not activate every NHS standard. Use the applicability assessment with the core legal framework.

Distinguish the source of each requirement

Layer	What it means	Application test
Legislation	Parliament creates powers and duties.	Check the provision, commencement, addressees and savings.
Information standard	A published standard defines requirements within a specified scope.	Check its notice, release, recipients and implementation date.
Contract or access condition	A purchaser or data custodian requires evidence or controls.	Read the actual contract and access agreement.
Assurance or guidance	A framework helps assess products, organisations or practice.	Identify any underlying legal or contractual requirement.

These layers can overlap. Section 250 provides the standards framework; NHS guidance separately explains procurement and assurance routes. SRC-046, SRC-053, SRC-056

Information standards: the current statutory framework

Section 250 of the Health and Social Care Act 2012 requires standards to identify their addressees. Eligible categories include relevant public bodies, regulated care providers and relevant IT providers. A standard's existence does not make it applicable to every software service. SRC-046

Two changes require careful dating:

Change	Effective date	Qualification
Health and Care Act 2022, section 95	7 July 2025	The commencement instrument preserves the previous regime for standards already published and in effect before that date.
Data (Use and Access) Act 2025, section 121 and Schedule 15	5 February 2026	The framework now expressly reaches relevant IT providers and standards concerning technology and IT services.

The first change introduced a stronger compliance framework and wider provider scope. The second permits standards about matters including interoperability, portability and information security. Neither change proves that every possible requirement has been imposed on a particular service. SRC-047, SRC-048, SRC-049

DCB0129 and DCB0160: clinical safety

The roles differ:

DCB0129 addresses organisations responsible for developing and maintaining health IT systems.
DCB0160 addresses health organisations responsible for deployment, use, maintenance or decommissioning.

The labels are broader than “commercial vendor” and “service provider”. Determine the actual role, including in-house development. Both official release pages still identify the June 2018 releases and an ongoing review. SRC-050, SRC-051

NHS's detailed applicability guide focuses on products affecting real-time or near-real-time direct care. It excludes population-level statistical reporting from that scope, while recommending clinical-risk practice, especially for commissioning decisions. A system labelled “secondary use” still needs assessment if its outputs affect individual care. SRC-052

The guide dates from 2022. Read its legal explanation with the later legislation and savings above. In particular, do not apply the new statutory wording retrospectively to all pre-existing standards. Record the applicable notice, release and contractual route. SRC-047, SRC-052

NHS's background guidance explains how DCB0160 procurement requirements pass DCB0129 assurance into the manufacturer relationship. It also recognises contractual requirements. This supports a scoped assessment, rather than a blanket assertion about every software supplier. SRC-053

DTAC: product assessment

The Digital Technology Assessment Criteria (DTAC) is a product-assurance framework for care commissioners and providers. It covers software, including software as a service, designed to improve health outcomes or health and care services. Population-health and service-management products can qualify. General-purpose HR or finance software merely used in healthcare falls outside its intended assessment scope. SRC-054

DTAC covers clinical safety, data protection, technical security, interoperability, usability and accessibility. It complements other applicable regulation and assurance. A completed form does not replace medical-device duties, DSPT or assessment of the actual deployment. SRC-055

NHS England links DSPT to products accessing NHS systems or patient data. DTAC checks that applicability and avoids duplicate questions. This does not make DSPT a universal prerequisite for every DTAC assessment, or a substitute for its entire data-protection assessment. Assess product scope and organisational assurance separately. SRC-055

NHS England introduced an updated form in February 2026. The previous form should not be used from 6 April 2026. Assessment uses documentation for the relevant product version; DTAC should not be described as a universal NHS licence. SRC-054

DSPT: organisational assurance for NHS data and systems

Assess DSPT early when NHS patient information or system access is involved. Use the dedicated DSPT assessment for scope, annual requirements, status verification and continuing assurance. It remains separate from DTAC product assessment and permission to process data. SRC-055, SRC-056

NHS-origin records outside NHS commissioning

A different commissioner does not by itself remove the NHS-data assurance expectation. For direct receipt of identifiable NHS GP material, the recommended decision is an explicit mandatory DSPT contract condition. The authority table distinguishes this decision from existing duties, including GC21.2 of the NHS Standard Contract where that contract applies. SRC-081, SRC-096

The recruitment example also separates permission to receive a GP report from permission to access a particular NHS system. DSPT alone does not establish either permission.

The requester receives the information and remains accountable for its own processing, even if the sending provider sets no express conditions. Use requester readiness alongside DSPT to identify lawful grounds, the responsible controller, any required DPIA and role-specific agreements. The provider receives the request and assesses disclosure; its decision does not approve all later uses. SRC-098, SRC-103

Recommended contract condition

The proposed DSPT condition covers status before receipt, service coverage, annual maintenance, evidence and remedies. It is a recommendation, not a finding that a particular contract already contains those terms.

Records and cloud services

The NHS Records Management Code includes secondary-use, administrative and staff records within its stated scope. Private providers outside that scope can use it as guidance. It is not a universal statutory retention schedule for every copy of health information. SRC-058

Use a justified, record-specific retention schedule. At the minimum period's end, assess continuing need, preservation and relevant holds before approved disposal. Access requests, proceedings and inquiries can prevent destruction. The software must support the resulting decisions across records and copies. SRC-059

NHS cloud guidance permits appropriately controlled cloud hosting, including specified overseas locations. It does not establish a universal UK-only rule. That guidance dates from 2022. Apply current transfer law and the actual hosting, support-access and contractual arrangements through the operating model. SRC-060

What remains application-specific

Before treating any requirement as applicable, record:

The service's intended purpose and any effect on individual care.
The data source and NHS-system access.
Each organisation's functional role.
The current standard, notice and implementation date.
The contract or data-access condition.
The evidence that supports applicability or non-applicability.

These are assessment steps, not findings that a proposed service complies. Log unresolved statutory transitions and product boundaries in the validation queue.