Common:
- DCB0160The clinical safety standard for organisations that use health IT, including practices.How DCB0129 and DCB0160 fit →The process →
- DCB0129The clinical safety standard for the companies that make health IT.How DCB0129 and DCB0160 fit →If the supplier won’t share it →
- Clinical Safety Officer (CSO)A registered clinician trained in clinical risk management who signs off your safety work.Finding a CSO →Training to be a CSO →
- Hazard logThe list of what could go wrong with a tool, the controls, and the risk before and after.Hazard log template →Oakfield’s hazard log →
- Cause, effect, hazard and harmThe chain clinical safety uses: a cause leads to an effect, which creates a hazard for a person, which could lead to harm.The trampoline →
- Risk scoreLikelihood combined with severity gives a score from 1 to 5.Scoring a risk →
- Safety case report (CSCR)The short summary the CSO signs to say a tool is acceptably safe to use.Safety case report template →Stage 3: Approve →
- Clinical risk management plan (CRMP)The scope, people and timeline for assessing one tool.CRMP template →
- Clinical risk management system (CRMS)Your practice’s written process for clinical safety, used for every tool.CRMS template →
- Technology registerA list of every digital tool the practice uses and where each stands.Technology register template →Stage 1: Prepare →
- Hazard workshopA one-hour meeting with the people who’ll use a tool, to find what could go wrong.Workshop pack →Stage 2: Assess →
- IncidentSomething that went wrong, or nearly did, with a digital tool.The incident log →Who to tell →
- LFPSEThe national service for recording patient safety events.Who to tell →
- Yellow CardThe MHRA scheme for reporting problems with medical devices, including software.Medical devices →
- Medical deviceSoftware with a medical purpose, regulated by the MHRA and placed in a risk class.Medical devices explainer →
- DPIAHow you think through and record the data risks of a new tool.The DPIA →DPIA template →
- Data Protection Officer (DPO)Advises the practice on data protection. Every GP practice must have one.Finding a DPO →
- Caldicott GuardianA senior person who makes sure confidential information is used properly.Caldicott Guardian →
- SIROThe person who accepts information risk for the practice, often a partner.Who does what →
- Controller and processorThe practice decides how patient data is used; a supplier processes it on your instructions.The house keys →
- Data processing agreementThe contract that says what a supplier may do with your patients’ data.The data processing agreement →
- Privacy noticeHow you tell patients what you do with their information.Your privacy notice →
- National data opt-outLets patients opt out of their data being used beyond their own care.The national data opt-out →
- ConsentMeans different things in data protection law and in confidentiality.Consent: two different things →
- Data breachPatient information lost, destroyed, changed or seen by the wrong person.Data breaches →
- Records retentionHow long different records should be kept.Keeping records →
- DSPTYour yearly online data security self-assessment, due by 30 June.DSPT explainer →
- DTACThe NHS questionnaire suppliers complete so buyers can check a product.DTAC explainer →
- Cyber securityKeeping systems and data safe from attack, and what Cyber Essentials shows.Cyber security explainer →
- IM1The NHS standard that lets other tools connect to GP clinical systems.IM1 explainer →
- AI scribeSoftware that listens to a consultation and drafts the notes.AI scribe worked example →The AI scribe registry →
- AI policyWhich AI tools staff can use, what for, and how a new one gets approved.Example AI policy →Why have one →
- AI tool registerThe list of AI tools the practice has approved, and for what.The AI tool register →
- Shadow AIAI used for work without the practice knowing or approving it.The AI you can’t see →
- Microsoft CopilotThe AI assistant in NHS.net Microsoft 365. Fine for admin, not for clinical decisions.Your AI tool register →What counts as AI →
- Large language model (LLM)The technology behind chatbots and AI scribes, and why it can be confidently wrong.LLM explainer →
- Automation biasThe more often a tool is right, the less carefully people check it.The other risk: us →
- CQCWhat inspectors may ask for when your practice uses AI.CQC readiness →
- TemplatesAll the documents in the toolkit, to read, print or download.All templates →
Or browse every term below.
| Term | Plain English |
|---|---|
| AI policy | A short practice document saying which AI tools staff can use, what for, and how a new one gets approved |
| AI scribe (ambient voice technology, AVT) | A tool that listens to a consultation and drafts the notes |
| AI tool register | The practice’s list of AI tools, with each one’s status and what it may be used for |
| Automation bias | Trusting a tool’s output without checking it, because it’s usually right |
| Bow-tie | A picture of one hazard in the middle, its causes on the left and the harms it could lead to on the right. Controls sit on the cause side; mitigations sit on the harm side |
| Caldicott Guardian | The person responsible for protecting patient confidentiality |
| Caldicott Principles | Eight principles from the National Data Guardian for using confidential information well |
| Clinical risk management file | The folder holding all the safety documents for your tools |
| Clinical safety case report (CSCR) | A short report arguing that a tool is safe to use here, signed by the CSO |
| Clinical Safety Officer (CSO) | A registered clinician trained in clinical risk management who signs off safety work |
| Controls | The things you do to reduce a risk |
| CRMP (Clinical Risk Management Plan) | How you’ll assess one particular tool |
| CRMS (Clinical Risk Management System) | How your practice does clinical safety in general |
| Cyber Essentials | A government-backed certificate showing five basic cyber security protections are in place. Plus adds hands-on testing. Explainer |
| Data controller | The organisation that decides how and why personal information is used. For its patients, the practice |
| Data processing agreement | The contract setting out what a supplier may do with data on your behalf |
| Data processor | An organisation that handles personal information on someone else’s instructions, such as a supplier |
| DCB0129 | The safety standard for companies that make health software |
| DCB0160 | The safety standard for organisations that use health software, including GP practices |
| Digital lead | The named person responsible for digital and AI tools in the practice. CQC expects one where AI is used |
| DPIA (Data Protection Impact Assessment) | The data protection check for a new way of using patient data |
| DPO (Data Protection Officer) | The person who advises on data protection law |
| DSPT (Data Security and Protection Toolkit) | The yearly data security self-assessment every practice completes. Explainer |
| DTAC (Digital Technology Assessment Criteria) | NHS England’s baseline checklist for digital products. Explainer |
| Cause | Something that could make a hazard happen, usually a problem with the technology or how it’s used. There is often more than one |
| Effect | What goes wrong with the information because of a cause, before anyone is at risk. For example, an urgent request sitting in the routine queue |
| Hallucination | When an AI tool produces something fluent and confident that is wrong |
| Harm | What could happen to the patient: injury, illness, delayed care or, at worst, death |
| Hazard log | The list of hazards, controls and scores for a tool |
| Hazard | A situation in which a person, usually a patient, could come to harm. It always names a person. For example, a patient with red-flag symptoms not directed to urgent care in time |
| IM1 (Interface Mechanism 1) | The NHS standard that lets other software connect to GP clinical systems. Explainer |
| Incident log | Your record of things that went wrong or nearly did, linked to the hazard log |
| Large language model (LLM) | The technology behind AI chatbots and most AI scribes, which writes by predicting likely words. Explainer |
| Lawful basis | The legal reason for using personal information. For NHS care, usually public task, not consent |
| LFPSE | Learn from Patient Safety Events, the national incident recording service |
| Medical device | Software or equipment with a medical purpose, regulated by the MHRA. Explainer |
| National data opt-out | Lets patients opt out of their information being used for research and planning; doesn’t apply to their care |
| Personal data breach | A security incident where personal information is lost, changed, or seen by someone who shouldn’t see it |
| Post-deployment surveillance | Checking a tool is still safe once it is in use |
| Privacy notice | What you publish to tell patients how their information is used |
| Residual risk | The risk left after controls are in place |
| Mitigation | Something that limits the harm if a hazard still happens, such as a same-day clinician review |
| Risk | How likely harm is, combined with how bad it would be |
| Shadow AI | AI used for work without the practice knowing or approving it, such as a free chatbot on a personal phone |
| SIRO (Senior Information Risk Owner) | The person accountable for information risk in the practice |
| Special category data | Types of personal information, including health, that the law protects more strongly |
| Subject access request | A request from a person for a copy of the information you hold about them |
| Technology register | A list of every digital tool the practice uses |
| UK GDPR | The main UK law on using personal information, alongside the Data Protection Act 2018 |