Clinical Safety ToolkitStaffordshire Training Hub

Type at least two letters.

    Home / Information governance

    Suppliers

    When a supplier handles patient information for you, you need to know where it goes and agree in writing what they can do with it.

    Follow the data

    Take one request and follow it from the patient to the record. At each stop, ask the question underneath.

    1. 1The patientTypes a request into the online formDo they know what happens to it?
    2. 2The supplier’s systemStores and sorts the requestWhere is it stored, and for how long?
    3. 3The supplier’s subcontractorsCloud hosting, AI models, support staff, and any company linking the tool to your clinical systemWho are they, and where are they?
    4. 4Practice staffRead the request and act on itWho can see it, and is that logged?
    5. 5The patient’s recordWhat matters is copied into the recordIs anything left behind in the tool?
    Follow one request from the patient to the record. A good data processing agreement and DPIA answer the question at every stop.

    For a worked example, see Oakfield’s data flow on the DPIA page.

    Three ways to protect data

    At each step in a data flow, ask how the data is protected, and whether the supplier needs to know who the patient is.

    Encryption

    Scrambles data so only someone with the key can read it. Ask for it both while data moves between systems and where it’s stored.2

    Still personal data
    Pseudonymisation

    Swaps names and NHS numbers for a code. Whoever holds the key can link it back to the patient, for example an AI scribe working on a transcript.3

    Still personal data
    Anonymisation

    Removes anything that could identify the patient, so it can’t be linked back. This is the only form a supplier should use to improve its product.3

    No longer personal data

    The data processing agreement (DPA)

    The law requires a written contract.1 In plain English, the supplier promises to:

    • Follow your instructionsOnly use the data the way you’ve agreed.
    • Keep it secureAppropriate technical and organisational security.
    • Ask before subcontractingOnly use other companies with your permission, on the same terms.
    • Tell you about breachesPromptly, so you can meet your own deadlines.
    • Delete or return itWhen the contract ends.

    Ask your DPO to read the supplier’s standard agreement before you sign.

    Questions to ask before you sign

    • Where is the data stored and processed? Is any of it outside the UK?
    • Do you use our data to train or improve your product, including AI models?
    • Have you completed the Data Security and Protection Toolkit, and do you hold Cyber Essentials Plus?
    • Can you provide a draft DPIA and your data processing agreement?

    Warning signs

    No agreement offeredOr one that lets the supplier use data “for any purpose”.
    “To improve our services”Data reuse with no detail about what that means.
    Free or consumer versionsA personal or free version being used for patient work.

    When the ICB or NHS England buys the tool

    Usually the practice is still the data controller for its own patients. Ask for the central agreement and DPIA, check they cover how you use the tool, and add your own where needed.

    References

    1. Contracts and liabilities between controllers and processors. Information Commissioner’s Office
    2. Encryption. Information Commissioner’s Office
    3. Anonymisation. Information Commissioner’s Office

    Sources on this page last checked 3 November 2026.