If your product stores, collects or uses NHS data, then you need to complete a DTAC.
Like any journey, if you’ve not travelled it before, its always much easier and quicker with a guide. We will partner you along this process, we know how to get you there in the most efficient route, we speak the language of the NHS so that you don’t have to!
DTAC stands for Digital Technology Assessment Criteria.
If you want to sell into the NHS, you need a DTAC. The NHS uses the DTAC to ensure the products it buys will operate easily, safely and securely alongside other products it already uses.
Our DTAC Service
The process is confusing and complex as different elements apply depending on your operations and its solution. There is no one-fits-all solution, that’s why the first step is a deep dive into your business; we are learning what elements of compliance you need, and also what you don’t need. This means you only select the DTAC components that are necessary to get your product over the line.
What is DTAC?
The national safety and security standard for digital health technologies entering, and continuing to be used in, the NHS and social care settings. Without a DTAC, the NHS won’t consider your product.
Clinical safety
Does your product have clinical safety measures in place and can you demonstrate that you are undertaking ongoing management of clinical risk? If not, our Clinical Safety Officer will set up a risk management system and guide you through the necessary steps to achieving compliance and gaining authority to release your product.
Data protection
Do you process NHS patient or customer data? If so, you’ll need evidence that you have systems and processes in place to protect the data, and remove it if requested. We can provide a Data Protection Officer, who will help you to identify and minimise risks and complete compulsory assessments, required on an ongoing basis.
You will need to comply with the Data Security and Protection Toolkit (DSPT) assessment and the Data Protection Impact Assessment (DPIA).
Technical security and assurance
How confident are you that your digital product, its security processes and its sensitive data is safe from hackers or malicious activity? With ever more sophisticated methods, cyber criminals are exploiting vulnerabilities to steal data. DTAC requires evidence that you are implementing measures to keep your product secure and stable, and we help you do this with periodic penetration testing.
Do you know your OWASP Top 10?
Interoperability
Do you know how your product will operate alongside the other solutions already implemented by the NHS? Joined-up systems are crucial for safe patient care. You need to demonstrate that your product’s APIs are open – that they can seamlessly and securely communicate with other systems, and we help you do this.
Usability and accessibility
Are you confident you can meet the 11 NHS service standards? This is an assessment to determine whether your product is fit for purpose and adheres to best practice on usability. We will work with you to achieve a high conformity rating.
You can read more about NHS Service Standards here.
Our Information Governance as a Service option will quickly set up an ISMS & QMS that includes the technical, physical and legal procedures and policies required for information risk management. This framework is ready to be integrated into your business.
Do you process NHS patient or customer data? If so, you’ll need evidence that you have systems and processes in place to protect the data, and remove it if requested. We can provide a Data Protection Officer, who will help you to identify and minimise risks and complete compulsory assessments, required on an ongoing basis.
Our IGaaS will help you comply with your data protection requirements.
The ability to sell your digital product into the NHS can mean success for your business. Yet selling into the NHS is a complex process.
Framework Genie is your guide along this journey. We help you identify a suitable framework, obtain the necessary compliances to achieving a fully validated and assessed product, and support you step by step to a successful listing.
If you hold personal information about your customers then, by law, you must protect it!
You may not have to hand an expert in data protection. Our IGaaS provides a DPO when, where and for as long as you need them.
You may not have to hand an expert in Clinical Safety. Our CSaaS provides a CSO when, where and for as long as you need them.