For GP teams, practice managers and partners
Clinical safety, without the jargon.
Every digital tool you use in patient care needs a safety check. This toolkit shows what the NHS standards ask of your practice, in plain English, with analogies, examples and templates.
Before you use a new digital tool
- 1Clinical safetyCould it harm a patient, and what are we doing about it?
- 2Data protectionAre we handling patient data lawfully and securely?
- 3AI policyWhat are staff allowed to use, and how?
Where do you want to start?
We're adopting a new tool
The whole journey in five stages, across clinical safety, data protection and AI policy.
See the journey →What does that word mean?
Causes, effects, hazards and harms, explained with a garden trampoline.
Understand the basics →I need a template
Hazard log, clinical safety case report, DPIA and more, to read, print or download.
See the templates →Something's gone wrong
Who to tell, what to record, and how it feeds back into your hazard log.
What to do →Five stages
From "we're thinking about how to roll this out" to "is it still safe for staff and patients?". Choose a stage to see the steps.
Stage 1 of 5
Prepare
- EveryoneAdd the tool to your technology register
- Clinical safetyGet the supplier’s clinical safety documents (DCB0129)
- Data protectionStart the data protection impact assessment (DPIA) and check the data processing agreement (DPA)
- AI policyIf it uses AI, check it fits your practice AI policy and add it as necessary
- Clinical safetyAgree who is acting as your Clinical Safety Officer (CSO)
Stage 2 of 5
Assess
- Clinical safetyHold a hazard workshop with the staff who will use the tool
- Clinical safetyWrite the hazard log: each cause, effect, hazard and harm, with controls and mitigations
- Clinical safetyScore each hazard before and after controls
- Data protectionWork through the data protection risks in the DPIA
Stage 3 of 5
Approve
- Clinical safetyThe CSO writes and signs a short clinical safety case report (CSCR)
- Data protectionThe DPIA is signed off, with input from your Caldicott Guardian and data protection officer (DPO)
- EveryoneThe partners review the residual risk, and accept it or decline to go live with the tool
Stage 4 of 5
Go live
- EveryoneTrain everyone who will use it, and record who was trained
- Clinical safetyStart small if possible, and check early outcomes closely for incidents and recurring themes
- Data protectionUpdate your privacy notice and tell patients what you are using
- AI policyAdd the tool to any induction pack for existing and new staff, including locums
Stage 5 of 5
Monitor and review
- Clinical safetyLog incidents and near misses, and review the hazard log when incidents happen and periodically
- EveryoneReassess when the supplier changes the product, or if you start to use it differently in your workflow
- Data protectionReview the DPIA if the data processing changes, and periodically
- EveryoneSwitch the tool off safely when the time comes
The toolkit
Adopting a tool
The whole journey in five stages, and which tools need what.
Available nowClinical safety
Hazard logs, safety cases and the five-stage process, with a worked example and templates.
Available nowInformation governance
DPIAs, privacy notices, data processing agreements and your DPO.
Available nowAI policy
An example AI policy, a tool register and a CQC readiness checklist.
Available nowExplainers
Short explainers on DTAC, DSPT, cyber security, medical devices, IM1 and other key topics.