What assessors look for, common failure points, and how to prepare your evidence pack for NHS Digital Readiness assessment.
Selling into the NHS is one of the most rewarding, and most demanding, compliance journeys a healthtech company can undertake. The NHS Digital Readiness Framework is the gateway to NHS procurement, and understanding what assessors look for is essential to passing first time. This guide explains the framework, the evidence requirements, and the most common failure points.
The NHS Digital Readiness Framework is a set of standards and requirements that technology suppliers must meet to supply digital products and services to NHS organisations. It covers data security, clinical safety, interoperability, and supplier assurance.
The framework is not a single certification, it encompasses multiple standards including the Data Security and Protection Toolkit (DSPT), DCB0129 (clinical risk management for health IT manufacturers), DCB0160 (clinical risk management for health IT deployment), and HL7 FHIR interoperability standards.
NHS organisations are required to ensure their technology suppliers meet these standards before procurement. Failure to meet the framework requirements will prevent you from selling to NHS organisations, regardless of the quality of your product.
The DSPT is the primary data security assessment for NHS suppliers. It is based on the National Data Guardian's ten data security standards and requires organisations to demonstrate compliance across people, processes, and technology.
The DSPT has three assertion levels: Standards Not Met, Standards Met, and Standards Exceeded. NHS organisations typically require suppliers to achieve at least Standards Met. Standards Exceeded requires independent third-party assessment.
Key DSPT requirements include data security and protection training for all staff, a named Data Security and Protection Lead, documented data flows, a business continuity plan, and evidence of cyber security controls.
DCB0129 applies to manufacturers of health IT systems. It requires a Clinical Safety Management System, a Clinical Safety Officer, a Hazard Log, and a Clinical Safety Case Report demonstrating that the system is safe for clinical use.
DCB0160 applies to NHS organisations deploying health IT systems, but suppliers are often required to support the deployment organisation's DCB0160 compliance by providing clinical safety documentation.
Clinical safety is frequently the most challenging aspect of NHS Digital Readiness for technology companies without a clinical background. A qualified Clinical Safety Officer is essential.
Annual DSPT submission demonstrating compliance with the ten National Data Guardian data security standards.
Clinical Safety Management System, Clinical Safety Officer, Hazard Log, and Clinical Safety Case Report for health IT manufacturers.
Cyber Essentials certification is required for all NHS suppliers handling patient data.
Information governance policies, data flow mapping, and staff training documentation.
HL7 FHIR R4 compliance for systems that need to exchange data with NHS systems.
Documented business continuity and disaster recovery plans tested at least annually.
Map the specific NHS Digital Readiness requirements applicable to your product and procurement pathway.
Assess your current posture against all applicable requirements and produce a prioritised remediation plan.
Complete and submit the Data Security and Protection Toolkit, with supporting evidence.
Establish the Clinical Safety Management System, appoint a Clinical Safety Officer, and produce the required clinical safety documentation.
Achieve Cyber Essentials certification (required for all NHS suppliers handling patient data).
Annual DSPT renewal, clinical safety case updates, and monitoring of NHS Digital Readiness framework changes.
Netru methodology