Three areas of work
They run in parallel and often overlap: a text sent to the wrong number belongs in both the hazard log (clinical safety) and the DPIA (information governance).
The five stages
Choose a stage to see its steps.
Stage 1 of 5
Prepare
- EveryoneAdd the tool to your technology register
- Clinical safetyGet the supplier’s clinical safety documents (DCB0129)
- Data protectionStart the data protection impact assessment (DPIA) and check the data processing agreement (DPA)
- AI policyIf it uses AI, check it fits your practice AI policy and add it as necessary
- Clinical safetyAgree who is acting as your Clinical Safety Officer (CSO)
Stage 2 of 5
Assess
- Clinical safetyHold a hazard workshop with the staff who will use the tool
- Clinical safetyWrite the hazard log: each cause, effect, hazard and harm, with controls and mitigations
- Clinical safetyScore each hazard before and after controls
- Data protectionWork through the data protection risks in the DPIA
Stage 3 of 5
Approve
- Clinical safetyThe CSO writes and signs a short clinical safety case report (CSCR)
- Data protectionThe DPIA is signed off, with input from your Caldicott Guardian and data protection officer (DPO)
- EveryoneThe partners review the residual risk, and accept it or decline to go live with the tool
Stage 4 of 5
Go live
- EveryoneTrain everyone who will use it, and record who was trained
- Clinical safetyStart small if possible, and check early outcomes closely for incidents and recurring themes
- Data protectionUpdate your privacy notice and tell patients what you are using
- AI policyAdd the tool to any induction pack for existing and new staff, including locums
Stage 5 of 5
Monitor and review
- Clinical safetyLog incidents and near misses, and review the hazard log when incidents happen and periodically
- EveryoneReassess when the supplier changes the product, or if you start to use it differently in your workflow
- Data protectionReview the DPIA if the data processing changes, and periodically
- EveryoneSwitch the tool off safely when the time comes
Which tools need what?
A rough guide. Your CSO and DPO make the final call.
| Tool | Clinical safetyDCB0160 | DPIAData protection | AI policyOn the register |
|---|---|---|---|
| AI scribe | Yes | Yes | Yes |
| AI receptionist or phone agent | Yes | Yes | Yes |
| Online consultation or triage | Yes1 | Yes | If AI |
| Document processing (reads, codes or files letters) | Yes | Yes | If AI |
| Automatic results filing (RPA) | Yes | Review | If AI |
| Recall tools that find and invite patients | Yes | Yes | If AI |
| New AI feature in software you already use | Reassess | Review | Yes |
| Patient messaging (texts, emails, booking links) | Yes | Yes | No |
| Phone system with queues or call-backs | Usually | Usually2 | If AI |
| AI assistants for admin (chatbots, Copilot) | If clinical | If personal data3 | Yes |
| Rota, HR or finance software | No | Staff data | No |
- If it uses AI to triage, hold an extra hazard workshop on the AI's decisions and check if it's a medical device.
- Especially if calls are recorded.
- Personal data shouldn't go in unless the tool is NHS-provided and approved locally.
Rule of thumb: if a tool could affect a clinical decision, a record or access to care, it needs a clinical safety assessment.1 If it handles patient data, it almost certainly needs a DPIA.2
Go deeper
Clinical safetyHazard logs, safety cases and a full worked example.Information governanceDPIAs, suppliers, telling patients and data breaches.AI policyAn example policy, a tool register and a CQC checklist.ExplainersDTAC, DSPT, medical devices, IM1 and more, one short page each.
References
- DCB0160: Clinical risk management in the deployment and use of health IT systems. NHS England standards directory
- Data protection impact assessments. Information Commissioner’s Office
Sources on this page last checked 3 November 2026.