<!-- Derived Markdown alternate of nhs-standards.md; canonical repository sources and registered evidence retain authority. -->


# NHS standards and assurance

**Healthcare Data Management: Beyond Individual Care** · England with UK-wide law · Sources checked **19 October 2026**.

NHS requirements depend on the organisation, product, data access and intended use. Holding health data does not activate every NHS standard. Use the [applicability assessment](https://healthcare-data-management-wiki.pages.dev/applicability/index.md) with the [core legal framework](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md).

## Distinguish the source of each requirement

| Layer | What it means | Application test |
|---|---|---|
| Legislation | Parliament creates powers and duties. | Check the provision, commencement, addressees and savings. |
| Information standard | A published standard defines requirements within a specified scope. | Check its notice, release, recipients and implementation date. |
| Contract or access condition | A purchaser or data custodian requires evidence or controls. | Read the actual contract and access agreement. |
| Assurance or guidance | A framework helps assess products, organisations or practice. | Identify any underlying legal or contractual requirement. |

These layers can overlap. Section 250 provides the standards framework; NHS guidance separately explains procurement and assurance routes. [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046), [SRC-053](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-053), [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056)

## Information standards: the current statutory framework

Section 250 of the Health and Social Care Act 2012 requires standards to identify their addressees. Eligible categories include relevant public bodies, regulated care providers and relevant IT providers. A standard's existence does not make it applicable to every software service. [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046)

Two changes require careful dating:

| Change | Effective date | Qualification |
|---|---|---|
| Health and Care Act 2022, section 95 | 7 July 2025 | The commencement instrument preserves the previous regime for standards already published and in effect before that date. |
| Data (Use and Access) Act 2025, section 121 and Schedule 15 | 5 February 2026 | The framework now expressly reaches relevant IT providers and standards concerning technology and IT services. |

The first change introduced a stronger compliance framework and wider provider scope. The second permits standards about matters including interoperability, portability and information security. Neither change proves that every possible requirement has been imposed on a particular service. [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047), [SRC-048](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-048), [SRC-049](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-049)

## DCB0129 and DCB0160: clinical safety

The roles differ:

- **DCB0129** addresses organisations responsible for developing and maintaining health IT systems.
- **DCB0160** addresses health organisations responsible for deployment, use, maintenance or decommissioning.

The labels are broader than “commercial vendor” and “service provider”. Determine the actual role, including in-house development. Both official release pages still identify the June 2018 releases and an ongoing review. [SRC-050](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-050), [SRC-051](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-051)

NHS's detailed applicability guide focuses on products affecting real-time or near-real-time direct care. It excludes population-level statistical reporting from that scope, while recommending clinical-risk practice, especially for commissioning decisions. A system labelled “secondary use” still needs assessment if its outputs affect individual care. [SRC-052](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-052)

The guide dates from 2022. Read its legal explanation with the later legislation and savings above. In particular, do not apply the new statutory wording retrospectively to all pre-existing standards. Record the applicable notice, release and contractual route. [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047), [SRC-052](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-052)

NHS's background guidance explains how DCB0160 procurement requirements pass DCB0129 assurance into the manufacturer relationship. It also recognises contractual requirements. This supports a scoped assessment, rather than a blanket assertion about every software supplier. [SRC-053](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-053)

## DTAC: product assessment

The Digital Technology Assessment Criteria (DTAC) is a product-assurance framework for care commissioners and providers. It covers software, including software as a service, designed to improve health outcomes or health and care services. Population-health and service-management products can qualify. General-purpose HR or finance software merely used in healthcare falls outside its intended assessment scope. [SRC-054](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-054)

DTAC covers clinical safety, data protection, technical security, interoperability, usability and accessibility. It complements other applicable regulation and assurance. A completed form does not replace medical-device duties, DSPT or assessment of the actual deployment. [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055)

NHS England links DSPT to products accessing NHS systems or patient data. DTAC checks that applicability and avoids duplicate questions. This does not make DSPT a universal prerequisite for every DTAC assessment, or a substitute for its entire data-protection assessment. Commissioners assess the product's DTAC scope separately from the supplier organisation's DSPT assurance. [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055)

NHS England introduced an updated form in February 2026. The previous form should not be used from 6 April 2026. Assessment uses documentation for the relevant product version; DTAC should not be described as a universal NHS licence. [SRC-054](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-054)

## DSPT: organisational assurance for NHS data and systems

**NHS policy requires organisations processing NHS patient information to provide annual DSPT assurance, including for purposes beyond individual care.** The receiving organisation completes and publishes its assessment. The purchaser checks the legal entity, assessment year, published status, service coverage and applicable audit evidence. NHS-system access terms can impose additional conditions. The [DSPT chapter](https://healthcare-data-management-wiki.pages.dev/dspt/index.md) distinguishes these requirements from DTAC product assessment and legal permission to process data. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082), [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094)

### NHS-origin records outside NHS commissioning

A non-NHS commissioner does not remove the DHSC policy requirement for organisations processing NHS patient information. For direct receipt of identifiable NHS GP material, the commissioning organisation should put a mandatory DSPT condition in the contractor's service contract. The [authority table](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#what-makes-dspt-mandatory) distinguishes this recommendation from existing duties. GC21.2 requires annual publication and compliance with applicable mandatory DSPT requirements where the NHS Standard Contract governs the service. [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-096](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-096)

The [recruitment example](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md) also separates permission to receive a GP report from permission to access a particular NHS system. DSPT alone does not establish either permission.

The requester receives the information and remains accountable for its own processing, even if the sending provider sets no express conditions. Its [readiness evidence](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) should identify lawful grounds, the responsible controller, any required DPIA and role-specific agreements alongside DSPT assurance. The GP practice or other provider receives the request and decides whether to disclose; its decision does not approve all later uses. [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103)

### Recommended contract condition

Under the [proposed DSPT condition](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#recommended-contract-condition), the contractor must have acceptable published status before receiving records. The contractor must maintain assurance for the contracted service through annual submissions, applicable audits and coverage changes. The purchaser checks the evidence and enforces the agreed reporting and remediation terms. These are recommended contract provisions; no actual contract has been reviewed.

## Records and cloud services

The NHS Records Management Code includes secondary-use, administrative and staff records within its stated scope. Private providers outside that scope can use it as guidance. It is not a universal statutory retention schedule for every copy of health information. [SRC-058](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-058)

Use a justified, record-specific retention schedule. At the minimum period's end, assess continuing need, preservation and relevant holds before approved disposal. Access requests, proceedings and inquiries can prevent destruction. The software must support the resulting decisions across records and copies. [SRC-059](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-059)

NHS cloud guidance permits appropriately controlled cloud hosting, including specified overseas locations. It does not establish a universal UK-only rule. That guidance dates from 2022. Apply current transfer law and the actual hosting, support-access and contractual arrangements through the [operating model](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md). [SRC-060](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-060)

## What remains application-specific

Before treating any requirement as applicable, record:

1. The service's intended purpose and any effect on individual care.
2. The data source and NHS-system access.
3. Each organisation's functional role.
4. The current standard, notice and implementation date.
5. The contract or data-access condition.
6. The evidence that supports applicability or non-applicability.

These are assessment steps, not findings that a proposed service complies. Log unresolved statutory transitions and product boundaries in the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md).

**Related:** [Home and governing question](https://healthcare-data-management-wiki.pages.dev/index.md) · [Confidentiality](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) · [Conditional regimes](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) · [Source register](https://healthcare-data-management-wiki.pages.dev/sources/index.md)