Clinical Safety ToolkitStaffordshire Training Hub

Type at least two letters.

    Home / Information governance

    After go-live

    Once a tool is in use, you need to spot and report data breaches, keep records for the right length of time, and keep the DPIA up to date.

    Data breaches

    Patients’ information lost, changed, or seen by someone who shouldn’t see it. For example:

    Filed to the wrong patientA request or note in the wrong record.
    Sent to the wrong personA message to the wrong number or email.
    Pasted into personal AIPatient details put into a free chatbot.

    The first 72 hours

    1. Straight awayContain it: recall the message, remove access, pause the tool if needed, and deal with any clinical harm.
    2. Same dayTell your DPO. Together, decide how serious it is and what to do next.
    3. Without undue delayTell the patients affected if there is a high risk to them, and if not already done. If a patient was harmed, the duty of candour applies too.
    4. Within 72 hoursReport it through the DSPT incident tool, if it is reportable.
    Record every breach in your own log, even the ones you don't need to report.

    Report through the incident tool in the DSPT, which notifies the ICO.1 If the tool caused or nearly caused harm, tell your CSO too.

    Keeping records

    Copy what matters into the medical record, agree with the supplier how long the tool keeps its copy, and follow NHS England’s Records Management Code of Practice.2

    When to review the DPIA

    • A new use: a new way of working, or new patients
    • Supplier changes: where data goes, or a new subcontractor
    • A breach that shows a risk you hadn’t spotted
    • A year on, even if nothing else has changed

    Every year

    The DSPT

    Every practice completes it. Add new tools to your list of information assets and data flows.3

    Due by 30 June. DSPT explainer
    Staff training

    Every member of staff refreshes data security awareness training.

    What counts

    Ending a contract

    1. Get your data backIn a format you can use
    2. Confirm deletionIn writing from the supplier
    3. Remove accessStaff logins and links to your clinical system
    4. Update your recordsPrivacy notice and information asset register

    References

    1. DSPT help: incident reporting. NHS England
    2. Records Management Code of Practice. NHS England
    3. Data Security and Protection Toolkit. NHS England

    Sources on this page last checked 3 November 2026.