Healthcare IT: our controls against NHS DSPT and clinical-safety expectations
A guide for clinics and health-tech companies evaluating us: what we run, how it maps, and what we do not claim.
Discuss a readiness assessmentWhat the frameworks expect
NHS Data Security and Protection Toolkit (DSPT)
Organisations with access to NHS patient data and systems complete the DSPT every year to show they practise good data security. Their suppliers are asked for evidence for the parts their services touch.
Clinical safety: DCB 0129 and DCB 0160
DCB 0129 applies to the makers of health IT systems and DCB 0160 to the organisations that deploy and use them. Both call for a named clinical safety officer, a hazard log and a clinical safety case.
Patient data kept apart
Patient-identifiable data should be separated from corporate systems, encrypted in transit and at rest, with access logged and reviewed.
What we run
Separation
Our standard controls include an isolated network for each client on our private cloud. For a clinic, we would put clinical systems in their own segment, with explicit rules for traffic to and from corporate IT.
Encryption and secrets
Data in transit encrypted with Transport Layer Security (TLS), encrypted storage at our disaster-recovery site, and secrets held in OpenBao.
Access and monitoring
Single sign-on, a tiered admin model, per-client access groups and security monitoring with Wazuh.
Backup and recovery
Nightly backups and continuous replication from London to our disaster-recovery site in Sofia, where recovery was rehearsed in September 2026.
Response targets
Incidents are prioritised P1 to P4, with response targets set in our standard agreement.
How it maps
We map our controls to Cyber Essentials Plus, the UK General Data Protection Regulation (UK GDPR) and NIST CSF 2.0, the Cybersecurity Framework of the US National Institute of Standards and Technology. For a healthcare client, we would extend that mapping to the DSPT assertions our services touch as part of a readiness assessment.
How we protect client data is set out on our trust page.
Healthcare work we have done
Through a specialist oncology-IT partner we have maintained oncology information systems and designed deployments of oncology information and radiotherapy treatment-planning systems, on-premises and in the cloud, for hospitals in the UK and the US. For a private healthcare cloud operator we provide platform engineering, backup modernisation and audit evidence in the style of HITRUST, the US healthcare information-security framework. For a medical-AI company we containerised its product for deployment on on-premises AI accelerator cards. None of this work is published as a named case study without the client's written consent.
What we do not claim
We do not serve hospitals directly; our healthcare work is delivered through specialist partners.
We are not your clinical safety officer. The clinical safety case stays with you.
We do not offer round-the-clock cover as standard. Out-of-hours cover for critical incidents is agreed in your contract.
Frequently asked questions
How would you support our DSPT submission?
We would supply evidence for the assertions our services touch, such as access control, backups, patching and incident handling, mapped from our standard controls.
How would you support DCB 0129 and DCB 0160 obligations?
Your clinical safety officer owns the clinical safety case. We would provide the IT-supplier inputs: hazard-log entries for changes that touch clinical workflow, and the mitigations applied.
Where would our data be hosted?
On our private cloud in London, replicated to our disaster-recovery site in Sofia, Bulgaria, or in Microsoft 365 and Azure in UK or EU regions if you choose them.
Discuss a readiness assessment
A 30-minute call, no slides. We walk through your framework and how our controls would map to it.
Book a call