NHS Data Security Guide

The DSPT is an annual self-assessment that all organisations handling NHS patient data must complete. It covers 10 National Data Guardian standards.

Key Requirements:

• Personal Confidential Data: Identify what you hold and where
• Staff Responsibilities: Training and awareness
• Training: Annual cyber security training for all staff
• Managing Access: Principle of least privilege
• Process Reviews: Regular review of who has access to what
• Responding to Incidents: Documented procedures
• Continuity Planning: Backup and disaster recovery
• Unsupported Systems: No Windows 7/XP without risk mitigation
• IT Protection: Antivirus, patching, firewalls
• Accountable Suppliers: Due diligence on third parties

Submission Deadline:

30th June annually. Status affects ability to access NHS systems.

Common Fail Points:

• Staff training not completed (or not documented)
• Outdated systems still in use
• No documented incident response procedure
• Backup testing not evidenced

Clinical systems (EMIS, SystmOne, Vision, Dentally, etc.) contain highly sensitive patient data. Lose control of them and you have a reportable data breach, lost patient trust, and every clinical record exposed at once.

Access Control:

• Individual logins for every user (no shared accounts)
• Role-based permissions (reception can't access clinical notes)
• Automatic session timeout after inactivity
• Audit trail of who accessed which records

Integration Security:

• Secure connections to NHS Spine
• NHSmail for clinical correspondence
• Encrypted connections for remote access
• No patient data on personal email accounts

Workstation Security:

• Screen positioned away from patient view
• Automatic screen lock after 5 minutes
• Privacy screens on reception PCs
• Smartcard required for NHS Spine access

Patients expect WiFi. But letting them on your clinical network is a serious security risk.

The Three-Network Model:

1. Clinical Network: Staff PCs, clinical systems, NHS Spine
2. Corporate Network: Admin PCs, email, non-clinical applications
3. Guest Network: Patient WiFi, isolated from everything else

Guest WiFi Best Practices:

• Completely separate VLAN (can't see clinical network)
• Bandwidth throttling (patients don't slow down clinical work)
• Content filtering (block inappropriate sites)
• Terms of use acceptance (liability protection)
• No password, or simple daily-changing password

Implementation:

Modern access points (like Ubiquiti UniFi) make this straightforward. A single device can broadcast multiple network names (SSIDs), each on a separate VLAN.

CQC inspectors increasingly ask about IT security as part of the "Safe" and "Well-led" domains.

What Inspectors Look For:

• Evidence of staff training (certificates, attendance records)
• Written policies (IT security, acceptable use, BYOD)
• Business continuity plans (what if systems go down?)
• Incident records (even if no incidents have occurred)
• Risk assessments (including cyber risks)

Common Questions:

• "How do you ensure patient data is kept confidential?"
• "What would happen if your clinical system was unavailable?"
• "How are staff trained on data protection?"
• "When did you last test your backups?"

Documentation to Prepare:

• IT Security Policy
• Business Continuity Plan
• Staff training records
• Backup test evidence
• Supplier contracts with data processing terms