[{"u":"templates.html","p":"Templates","h":"All templates","t":"All the documents in the toolkit, to read, print or download.","a":"template download word excel document","k":1},{"u":"ai-policy/cqc-readiness.html","p":"CQC","h":"CQC readiness","t":"What inspectors may ask for when your practice uses AI.","a":"cqc inspection mythbuster evidence","k":1},{"u":"explainers/large-language-models.html#the-other-risk-us","p":"Automation bias","h":"The other risk: us","t":"The more often a tool is right, the less carefully people check it.","a":"automation bias human in the loop over-reliance","k":1},{"u":"explainers/large-language-models.html","p":"Large language model (LLM)","h":"LLM explainer","t":"The technology behind chatbots and AI scribes, and why it can be confidently wrong.","a":"llm large language model hallucination generative ai","k":1},{"u":"ai-policy/understand.html#what-counts-as-ai","p":"Microsoft Copilot","h":"What counts as AI","t":"The AI assistant in NHS.net Microsoft 365. Fine for admin, not for clinical decisions.","a":"copilot microsoft 365 m365 chatgpt chatbot","k":1},{"u":"ai-policy/your-policy.html#the-ai-tool-register","p":"Microsoft Copilot","h":"Your AI tool register","t":"The AI assistant in NHS.net Microsoft 365. Fine for admin, not for clinical decisions.","a":"copilot microsoft 365 m365 chatgpt chatbot","k":1},{"u":"ai-policy/understand.html#the-ai-you-cant-see","p":"Shadow AI","h":"The AI you can’t see","t":"AI used for work without the practice knowing or approving it.","a":"shadow ai personal chatgpt unapproved","k":1},{"u":"ai-policy/your-policy.html#the-ai-tool-register","p":"AI tool register","h":"The AI tool register","t":"The list of AI tools the practice has approved, and for what.","a":"ai register approved tools","k":1},{"u":"ai-policy/understand.html#why-have-one","p":"AI policy","h":"Why have one","t":"Which AI tools staff can use, what for, and how a new one gets approved.","a":"ai policy template","k":1},{"u":"ai-policy/your-policy.html#the-example-policy","p":"AI policy","h":"Example AI policy","t":"Which AI tools staff can use, what for, and how a new one gets approved.","a":"ai policy template","k":1},{"u":"explainers/ai-scribe-registry.html","p":"AI scribe","h":"The AI scribe registry","t":"Software that listens to a consultation and drafts the notes.","a":"ai scribe ambient voice technology avt heidi listening","k":1},{"u":"clinical-safety/worked-examples.html#ai-scribe","p":"AI scribe","h":"AI scribe worked example","t":"Software that listens to a consultation and drafts the notes.","a":"ai scribe ambient voice technology avt heidi listening","k":1},{"u":"explainers/im1.html","p":"IM1","h":"IM1 explainer","t":"The NHS standard that lets other tools connect to GP clinical systems.","a":"im1 interface integration emis systmone vision gp system link","k":1},{"u":"explainers/cyber-security.html","p":"Cyber security","h":"Cyber security explainer","t":"Keeping systems and data safe from attack, and what Cyber Essentials shows.","a":"cyber essentials plus phishing passwords security","k":1},{"u":"explainers/dtac.html","p":"DTAC","h":"DTAC explainer","t":"The NHS questionnaire suppliers complete so buyers can check a product.","a":"digital technology assessment criteria dtac","k":1},{"u":"explainers/dspt.html","p":"DSPT","h":"DSPT explainer","t":"Your yearly online data security self-assessment, due by 30 June.","a":"data security and protection toolkit dspt","k":1},{"u":"information-governance/after-go-live.html#keeping-records","p":"Records retention","h":"Keeping records","t":"How long different records should be kept.","a":"retention how long keep records","k":1},{"u":"information-governance/after-go-live.html#data-breaches","p":"Data breach","h":"Data breaches","t":"Patient information lost, destroyed, changed or seen by the wrong person.","a":"breach data breach 72 hours ico report","k":1},{"u":"information-governance/understand.html#consent-two-different-things","p":"Consent","h":"Consent: two different things","t":"Means different things in data protection law and in confidentiality.","a":"consent confidentiality implied consent lawful basis","k":1},{"u":"information-governance/telling-patients.html#the-national-data-opt-out","p":"National data opt-out","h":"The national data opt-out","t":"Lets patients opt out of their data being used beyond their own care.","a":"opt out national data opt-out","k":1},{"u":"information-governance/telling-patients.html#your-privacy-notice","p":"Privacy notice","h":"Your privacy notice","t":"How you tell patients what you do with their information.","a":"privacy notice fair processing telling patients","k":1},{"u":"information-governance/suppliers.html#the-data-processing-agreement-dpa","p":"Data processing agreement","h":"The data processing agreement","t":"The contract that says what a supplier may do with your patients’ data.","a":"dpa contract data processing agreement","k":1},{"u":"information-governance/understand.html#the-house-keys-analogy","p":"Controller and processor","h":"The house keys","t":"The practice decides how patient data is used; a supplier processes it on your instructions.","a":"data controller processor house keys","k":1},{"u":"information-governance/understand.html#who-does-what","p":"SIRO","h":"Who does what","t":"The person who accepts information risk for the practice, often a partner.","a":"senior information risk owner siro","k":1},{"u":"information-governance/help.html#caldicott-guardian-and-siro","p":"Caldicott Guardian","h":"Caldicott Guardian","t":"A senior person who makes sure confidential information is used properly.","a":"caldicott guardian principles confidentiality","k":1},{"u":"information-governance/help.html#finding-a-dpo","p":"Data Protection Officer (DPO)","h":"Finding a DPO","t":"Advises the practice on data protection. Every GP practice must have one.","a":"dpo data protection officer","k":1},{"u":"templates/dpia.html","p":"DPIA","h":"DPIA template","t":"How you think through and record the data risks of a new tool.","a":"data protection impact assessment dpia","k":1},{"u":"information-governance/dpia.html","p":"DPIA","h":"The DPIA","t":"How you think through and record the data risks of a new tool.","a":"data protection impact assessment dpia","k":1},{"u":"explainers/medical-devices.html","p":"Medical device","h":"Medical devices explainer","t":"Software with a medical purpose, regulated by the MHRA and placed in a risk class.","a":"mhra ukca ce mark class i iia iib iii device","k":1},{"u":"explainers/medical-devices.html","p":"Yellow Card","h":"Medical devices","t":"The MHRA scheme for reporting problems with medical devices, including software.","a":"yellow card mhra report device","k":1},{"u":"clinical-safety/after-go-live.html#who-to-tell","p":"LFPSE","h":"Who to tell","t":"The national service for recording patient safety events.","a":"learn from patient safety events lfpse report","k":1},{"u":"clinical-safety/after-go-live.html#who-to-tell","p":"Incident","h":"Who to tell","t":"Something that went wrong, or nearly did, with a digital tool.","a":"incident near miss incident log significant event report","k":1},{"u":"clinical-safety/after-go-live.html#the-safety-loop","p":"Incident","h":"The incident log","t":"Something that went wrong, or nearly did, with a digital tool.","a":"incident near miss incident log significant event report","k":1},{"u":"clinical-safety/process.html#stage-2-assess","p":"Hazard workshop","h":"Stage 2: Assess","t":"A one-hour meeting with the people who’ll use a tool, to find what could go wrong.","a":"workshop hazard identification meeting","k":1},{"u":"templates/hazard-workshop-pack.html","p":"Hazard workshop","h":"Workshop pack","t":"A one-hour meeting with the people who’ll use a tool, to find what could go wrong.","a":"workshop hazard identification meeting","k":1},{"u":"clinical-safety/process.html#stage-1-prepare","p":"Technology register","h":"Stage 1: Prepare","t":"A list of every digital tool the practice uses and where each stands.","a":"register inventory list of tools asset register","k":1},{"u":"templates/technology-register.html","p":"Technology register","h":"Technology register template","t":"A list of every digital tool the practice uses and where each stands.","a":"register inventory list of tools asset register","k":1},{"u":"templates/clinical-risk-management-system.html","p":"Clinical risk management system (CRMS)","h":"CRMS template","t":"Your practice’s written process for clinical safety, used for every tool.","a":"crms system policy","k":1},{"u":"templates/clinical-risk-management-plan.html","p":"Clinical risk management plan (CRMP)","h":"CRMP template","t":"The scope, people and timeline for assessing one tool.","a":"crmp plan","k":1},{"u":"clinical-safety/process.html#stage-3-approve","p":"Safety case report (CSCR)","h":"Stage 3: Approve","t":"The short summary the CSO signs to say a tool is acceptably safe to use.","a":"clinical safety case report cscr safety case sign off","k":1},{"u":"templates/safety-case-report.html","p":"Safety case report (CSCR)","h":"Safety case report template","t":"The short summary the CSO signs to say a tool is acceptably safe to use.","a":"clinical safety case report cscr safety case sign off","k":1},{"u":"clinical-safety/understand.html#scoring-a-risk","p":"Risk score","h":"Scoring a risk","t":"Likelihood combined with severity gives a score from 1 to 5.","a":"risk matrix grid likelihood severity score acceptable","k":1},{"u":"clinical-safety/understand.html#the-trampoline-analogy","p":"Cause, effect, hazard and harm","h":"The trampoline","t":"The chain clinical safety uses: a cause leads to an effect, which creates a hazard for a person, which could lead to harm.","a":"hazard cause effect harm control mitigation trampoline bow tie","k":1},{"u":"clinical-safety/worked-examples.html","p":"Hazard log","h":"Oakfield’s hazard log","t":"The list of what could go wrong with a tool, the controls, and the risk before and after.","a":"hazard log risk register hazards","k":1},{"u":"templates/hazard-log.html","p":"Hazard log","h":"Hazard log template","t":"The list of what could go wrong with a tool, the controls, and the risk before and after.","a":"hazard log risk register hazards","k":1},{"u":"clinical-safety/help.html#training-to-be-a-cso","p":"Clinical Safety Officer (CSO)","h":"Training to be a CSO","t":"A registered clinician trained in clinical risk management who signs off your safety work.","a":"cso clinical safety officer who signs training","k":1},{"u":"clinical-safety/help.html#finding-a-cso","p":"Clinical Safety Officer (CSO)","h":"Finding a CSO","t":"A registered clinician trained in clinical risk management who signs off your safety work.","a":"cso clinical safety officer who signs training","k":1},{"u":"clinical-safety/help.html#common-questions","p":"DCB0129","h":"If the supplier won’t share it","t":"The clinical safety standard for the companies that make health IT.","a":"dcb 0129 manufacturer supplier standard","k":1},{"u":"explainers/dcb0129-and-dcb0160.html","p":"DCB0129","h":"How DCB0129 and DCB0160 fit","t":"The clinical safety standard for the companies that make health IT.","a":"dcb 0129 manufacturer supplier standard","k":1},{"u":"clinical-safety/process.html","p":"DCB0160","h":"The process","t":"The clinical safety standard for organisations that use health IT, including practices.","a":"dcb 0160 deployment standard clinical risk management","k":1},{"u":"explainers/dcb0129-and-dcb0160.html","p":"DCB0160","h":"How DCB0129 and DCB0160 fit","t":"The clinical safety standard for organisations that use health IT, including practices.","a":"dcb 0160 deployment standard clinical risk management","k":1},{"u":"adopting-a-tool.html","p":"Adopting a digital tool","h":"Three areas of work","t":"Clinical safety How could this tool harm a patient, and what are we doing about it? Main documents Clinical risk management system (CRMS) and plan (CRMP), hazard log, clinical safety case report (CSCR) Usually led by CSO and practice manager Go to clinical safety → Information governance Are we handling patient data lawfully and securely? Main documents Data protection impact assessment (DPIA), data processing agreement (DPA), privacy notice Usually led by DPO and practice manager Go to information governance → AI and digital use policy What are staff allowed to use, and how? Main documents Practice AI policy and tool register Usually led by Partners and practice manager Go to AI policy → They run in parallel and often overlap: a text sent to the wrong number belongs in both the hazard log (clinical safety) and the DPIA (information governance)."},{"u":"adopting-a-tool.html","p":"Adopting a digital tool","h":"The five stages","t":"Choose a stage to see its steps. Stage 1 of 5 Prepare Everyone Add the tool to your technology register Clinical safety Get the supplier’s clinical safety documents (DCB0129) Data protection Start the data protection impact assessment (DPIA) and check the data processing agreement (DPA) AI policy If it uses AI, check it fits your practice AI policy and add it as necessary Clinical safety Agree who is acting as your Clinical Safety Officer (CSO) The tag shows which section of the toolkit has the detail. Stage 2 of 5 Assess Clinical safety Hold a hazard workshop with the staff who will use the tool Clinical safety Write the hazard log: each cause, effect, hazard and harm, with controls and mitigations Clinical safety Score each hazard before and after controls Data protection Work through the data protection risks in the DPIA The tag shows which section of the toolkit has the detail. Stage 3 of 5 Approve Clinical safety The CSO writes and signs a short clinical safety case report (CSCR) Data protection The DPIA is signed off, with input from your Caldicott Guardian and data protection officer (DPO) Everyone The partners review the residual risk, and accept it or decline to go live with the tool The tag shows which section of the toolkit has the detail. Stage 4 of 5 Go live Everyone Train everyone who will use it, and record who was trained Clinical safety Start small if possible, and check early outcomes closely for incidents and recurring themes Data protection Update your privacy notice and tell patients what you are using AI policy Add the tool to any induction pack for existing and new staff, including locums The tag shows which section of the toolkit has the detail. Stage 5 of 5 Monitor and review Clinical safety Log incidents and near misses, and review the hazard log when incidents happen and periodically Everyone Reassess when the supplier changes the product, or if you start to use it differently in your workflow Data protection Review the DPIA if the data processing changes, and periodically Everyone Switch the tool off safely when the time comes The tag shows which section of the toolkit has the detail."},{"u":"adopting-a-tool.html","p":"Adopting a digital tool","h":"Which tools need what?","t":"A rough guide. Your CSO and DPO make the final call. Which tools need a clinical safety assessment, a DPIA and a place in your AI policy Tool Clinical safety DCB0160 DPIA Data protection AI policy On the register AI scribe Yes Yes Yes AI receptionist or phone agent Yes Yes Yes Online consultation or triage Yes Yes If AI Document processing (reads, codes or files letters) Yes Yes If AI Automatic results filing (RPA) Yes Review If AI Recall tools that find and invite patients Yes Yes If AI New AI feature in software you already use Reassess Review Yes Patient messaging (texts, emails, booking links) Yes Yes No Phone system with queues or call-backs Usually Usually If AI AI assistants for admin (chatbots, Copilot) If clinical If personal data Yes Rota, HR or finance software No Staff data No If it uses AI to triage, hold an extra hazard workshop on the AI's decisions and check if it's a medical device . Especially if calls are recorded. Personal data shouldn't go in unless the tool is NHS-provided and approved locally. Rule of thumb: if a tool could affect a clinical decision, a record or access to care, it needs a clinical safety assessment. If it handles patient data, it almost certainly needs a DPIA."},{"u":"adopting-a-tool.html","p":"Adopting a digital tool","h":"Go deeper","t":"Clinical safety Hazard logs, safety cases and a full worked example. Information governance DPIAs, suppliers, telling patients and data breaches. AI policy An example policy, a tool register and a CQC checklist. Explainers DTAC, DSPT, medical devices, IM1 and more, one short page each."},{"u":"adopting-a-tool.html","p":"Adopting a digital tool","h":"References","t":"DCB0160: Clinical risk management in the deployment and use of health IT systems . NHS England standards directory Data protection impact assessments . Information Commissioner’s Office Sources on this page last checked 3 November 2026."},{"u":"ai-policy/cqc-readiness.html","p":"AI policy › CQC readiness","h":"What CQC has said","t":"What inspectors may ask for when your practice uses AI, and where in this toolkit to find help with each part. CQC’s GP mythbuster on AI asks for evidence that AI is chosen carefully, used safely and kept under review, not for any one document. There should be a responsible CSO and digital lead for AI technologies and related clinical governance. CQC GP mythbuster 109"},{"u":"ai-policy/cqc-readiness.html","p":"AI policy › CQC readiness","h":"Check where you are","t":"Tick what you have. Each item links to the part of the toolkit that helps. 0 of 20 Let's get started Ticks are saved in this browser only. People and responsibility A named digital lead responsible for AI How A named Clinical Safety Officer (CSO) with practitioner-level training How An AI policy and tool register, so all of this is in one place How Supplier evidence The supplier’s clinical safety documents (DCB0129 safety case and hazard log) How The supplier’s Digital Technology Assessment Criteria (DTAC) How Medical device status checked, and MHRA registration where it is one How The tool is used only for what the supplier says it is for How Clinical safety A clinical risk management plan (CRMP) for each AI tool How A hazard log and risk assessment for each AI tool How A clinical safety case report (CSCR) signed by the CSO How Data protection A data protection impact assessment (DPIA) for each tool How A data processing agreement (DPA) with the supplier How The supplier’s Data Security and Protection Toolkit (DSPT) and Cyber Essentials Plus How The tool recorded in your record of processing activities (ROPA) How Patients Patients are told when AI is used, and can object How The tool works fairly for all your patients, and there’s a way to get care without it How Staff and learning Training records for staff who use each tool How Audits or quality improvement showing a person checks AI output How Incidents reported, including to the supplier, Yellow Card and LFPSE where relevant How Incidents and learning discussed at clinical governance meetings How This list is our summary of the mythbuster, grouped for practices. It isn’t exhaustive or an official CQC checklist, and inspectors may ask about other things. Check the mythbuster for the latest wording."},{"u":"ai-policy/cqc-readiness.html","p":"AI policy › CQC readiness","h":"Keep an evidence folder","t":"When an inspector asks how you know a tool is safe, this is the answer. Choose a section to see where the toolkit helps. Evidence folder One per AI tool AI policy at the front 1 The register entry What it is, what it’s approved for, who approved it 2 Clinical safety CRMP, hazard log and safety case report, signed by the CSO 3 Data protection DPIA, data processing agreement and updated privacy notice 4 Supplier evidence DCB0129 documents, DTAC, DSPT, medical device registration 5 Training records Who was trained, and when 6 Proof it’s watched Audits, incidents, what changed, governance meeting minutes"},{"u":"ai-policy/cqc-readiness.html","p":"AI policy › CQC readiness","h":"References","t":"GP mythbuster 109: Artificial intelligence in GP services . Care Quality Commission Sources on this page last checked 6 November 2026."},{"u":"ai-policy/understand.html","p":"AI policy › Understand","h":"Why have one","t":"An AI policy is a short document that tells everyone in the practice which AI tools they can use, what for, and how a new one gets approved. AI tools are arriving faster than practices can assess them, some through software updates and others on a locum’s or new staff member’s phone. A policy means everyone works to the same rules, and it’s one of the first things CQC inspectors may ask to see. A good policy answers three questions. Which AI tools are we allowed to use, and for what? What must never go into an AI tool? How does a new tool get approved?"},{"u":"ai-policy/understand.html","p":"AI policy › Understand","h":"What counts as AI","t":"AI is built into everyday software as well as scribes and chatbots. Your policy should cover the whole range. Clearly AI Easy to miss AI scribes Listen to the consultation and draft notes AI triage and online consultation Sort requests or suggest urgency AI receptionists Answer calls or chats, book and signpost Results and document tools File results, summarise and code letters Recall tools Search the list to find who to invite Chatbots and Copilot ChatGPT, Gemini, Copilot in email and Teams Call and meeting transcription In Teams or your phone system Features added in updates AI switched on in software you already use Your policy should cover all of these, not just the tools you bought on purpose."},{"u":"ai-policy/understand.html","p":"AI policy › Understand","h":"The AI you can’t see","t":"The biggest risk is often the tool nobody told you about: a free chatbot, or a feature that switched itself on. Above the water Your approved AI scribe · Your online triage tool Below the water Free chatbot on a personal phone · A locum’s own AI scribe · AI added in a software update · Browser AI add-ons An AI policy brings what's under the water into view. It says which tools are approved, and makes it clear that nothing else is used for practice work. At Oakfield Surgery: a locum used their own AI scribe app in clinic. Nobody knew where the recordings went. The policy now says only registered tools may be used, on page one of the locum pack."},{"u":"ai-policy/understand.html","p":"AI policy › Understand","h":"How it fits with the rest","t":"The policy sets the rules, the register lists what’s approved or live and what’s being assessed, and each tool has its own clinical safety and data protection assessment underneath. NHS England expects a DPIA before AI is used with patient information. The AI policy The rules: what staff can and can't do, and how a tool gets approved The AI tool register The list: which tools are approved, for what, and by whom Clinical safety assessment Could it harm a patient? Data protection impact assessment Is patient data safe and lawful? Training, monitoring and incident reporting Keeping it working once it's in use"},{"u":"ai-policy/understand.html","p":"AI policy › Understand","h":"References","t":"GP mythbuster 109: Artificial intelligence in GP services . Care Quality Commission Information governance guidance: Artificial intelligence . NHS England Sources on this page last checked 6 November 2026."},{"u":"ai-policy/your-policy.html","p":"AI policy › Your policy","h":"The example policy","t":"Oakfield’s AI policy, written to be used rather than filed. It names who is responsible, lists each tool with what it can and can’t be used for, and sets out what happens when something goes wrong. Switch between the blank version and Oakfield’s, or download it as Word. It’s based on CQC’s mythbuster and NHS England’s AI guidance, and you’re free to copy it and change the names, tools and dates. Prepare AI policy Open ↗ AI policy Open in new tab ↗ Oakfield example Download Word This is an example, not a legal document. Check it against your ICB’s guidance and your own processes. Incident reporting routes: Learn from Patient Safety Events and the MHRA Yellow Card scheme. Copilot use follows NHS England’s guidance. For other published examples, see One Care’s AI policy template for practices and Doncaster and Bassetlaw Teaching Hospitals’ AI policy."},{"u":"ai-policy/your-policy.html","p":"AI policy › Your policy","h":"The AI tool register","t":"Section 3 of the policy is a summary of it. The full register is a spreadsheet with a row for each tool: what it is, its status, what it’s approved for and who can use it, the CSO and DPO sign-off dates, and the next review. It’s the first thing to show an inspector. Start from the technology register template , which covers all your digital tools, AI included. Products named here are examples only. They are not recommendations, and your register will look different."},{"u":"ai-policy/your-policy.html","p":"AI policy › Your policy","h":"A card for staff","t":"Print this for the staff room and the locum pack. It’s the policy in one glance. Using AI at work Ask the digital lead if you’re not sure Do Use only tools on the practice AI register Check everything AI writes before you act on it or save it Tell patients when AI is being used in their care Report anything odd, including near misses Ask before trying a new AI feature Don’t Put patient details into a free or personal AI account Bring your own AI app to use in clinic Let AI make a clinical decision for you Assume a new feature in an update is approved Sign off a note you haven’t read You are responsible for anything you sign, however it was written."},{"u":"ai-policy/your-policy.html","p":"AI policy › Your policy","h":"Making it stick","t":"Add it to induction for new staff, locums and trainees, make AI a standing item at practice meetings, and review the policy and register once a year alongside your DSPT ."},{"u":"ai-policy/your-policy.html","p":"AI policy › Your policy","h":"References","t":"GP mythbuster 109: Artificial intelligence in GP services . Care Quality Commission Information governance guidance: Artificial intelligence . NHS England Learn from Patient Safety Events: primary care . NHS England Yellow Card scheme . MHRA. Report problems with medical devices, including software and AI Information governance guidance: Microsoft 365 Copilot . NHS England. Copilot can support clinical administration with a DPIA, but must not be used for clinical decisions Ambient voice technology toolkit, appendix A: AI policy . One Care, 2025. A draft policy for practices to adapt Artificial Intelligence (AI) Policy, CORP/ICT 32 . Doncaster and Bassetlaw Teaching Hospitals NHS Foundation Trust, 2026 Sources on this page last checked 6 November 2026."},{"u":"ai-policy.html","p":"AI policy","h":"","t":"Home / AI policy AI policy What staff can use, how a tool gets approved, and how to show CQC it's under control. Brings together the more detailed work done in clinical safety and information governance . 1 Understand What counts as AI, why a policy matters, and how it fits with the rest. → 2 Your policy An example policy to adapt, what goes in your tool register, and a staff card. → 3 CQC readiness What inspectors may ask for, as a checklist. →"},{"u":"clinical-safety/after-go-live.html","p":"Clinical safety › After go-live","h":"The safety loop","t":"Every incident or near miss is a chance to check the hazard log. Listed already? A control may have failed. Not listed? You’ve found a new hazard. Something happens An incident or near miss Record it In the incident log CSO reviews Is it a new hazard, or a control failing? Update the hazard log New or stronger controls (or mitigations) Tell people The patient, staff, the supplier, and the national Learning from Patient Safety Events (LFPSE) service if needed Keep one incident log for all your digital tools, alongside your significant event process."},{"u":"clinical-safety/after-go-live.html","p":"Clinical safety › After go-live","h":"Who to tell","t":"Always Your CSO, and record it locally The tool contributed The supplier, who should have an escalation route for safety issues A patient was or could have been harmed The patient (duty of candour), and the national LFPSE service It’s a medical device The MHRA Yellow Card scheme Data went somewhere it shouldn’t Your Caldicott Guardian and DPO straight away: it’s a data breach"},{"u":"clinical-safety/after-go-live.html","p":"Clinical safety › After go-live","h":"Keeping watch","t":"Five minutes on digital tools at the monthly clinical governance meeting, where incidents and what was learned are shared, and a monthly check of ten random examples. That audit makes a good QI project for a GP registrar or FY2. Example check: AI scribe notes Was the patient asked, and the answer recorded? Every note Does the note include anything that wasn’t said? Nothing Are the plan and safety-netting recorded? Yes"},{"u":"clinical-safety/after-go-live.html","p":"Clinical safety › After go-live","h":"When to look again","t":"A significant update or new feature A new way of using it An incident that shows a new hazard New national guidance A year since the last review Switching a tool off has risks too: finish open work, get the supplier’s data handling in writing, and update the register."},{"u":"clinical-safety/after-go-live.html","p":"Clinical safety › After go-live","h":"References","t":"Primary care information on the Learn from Patient Safety Events service . NHS England Sources on this page last checked 3 November 2026."},{"u":"clinical-safety/help.html","p":"Clinical safety › Help","h":"Finding a CSO","t":"Options for finding a Clinical Safety Officer, where to train, and the questions asked most. A clinician in your practice A GP, nurse or pharmacist completes CSO training. Good for: an interested clinician with some protected time Shared across a PCN One trained CSO covers several practices. Good for: spreading cost and time across an area, whilst keeping a local clinician An external provider A company provides a CSO for a yearly fee. Some are listed in the references below, as a guide only. Good for: practices and PCNs without in-house capacity. The practice still has to sign off the work. Ask your ICB or PCN first: there may already be an arrangement you can join."},{"u":"clinical-safety/help.html","p":"Clinical safety › Help","h":"Training to be a CSO","t":"Free e-learning Eight short sessions on e-Learning for Healthcare. Everyone involved Live practitioner course A one-day course from NHS England’s clinical safety team. Anyone signing off Keep it up Refresher days, regular assessments, and communities such as NHS England’s CSO Coffee and Chat sessions. Ongoing"},{"u":"clinical-safety/help.html","p":"Clinical safety › Help","h":"Common questions","t":"Does every practice need its own CSO? No. One CSO can cover several practices. Their job is to review and sign off; the practice team can do much of the groundwork. If the ICB bought the tool, haven’t they done the clinical safety? Partly. DCB0160 is about how the tool is used in your practice, which only you can assess. Ask what they’ve done and build on it. Can we use the practice down the road’s safety case? As a starting point, not as your own. Your workflows and controls will differ. Isn’t the DPIA enough? No. The DPIA covers data protection. Clinical safety is a separate requirement."},{"u":"clinical-safety/help.html","p":"Clinical safety › Help","h":"Further reading","t":"Bitesize digital training: understanding DCB0160 , a 17-minute video from Greater Manchester Primary Care Provider Board Clinical safety and AVTs webinar , a 34-minute panel from Newton’s Tree"},{"u":"clinical-safety/help.html","p":"Clinical safety › Help","h":"References","t":"Clinical risk management training . NHS England. Page last updated 2021, so check current courses Clinical risk management training programme . e-Learning for Healthcare Clinical safety and AVTs webinar . Newton’s Tree, April 2026. Panel with Dr Keith Grimes, Dr Youssof Oskrochi and Haris Shuaib Bordercross Health . Clinical safety documentation platform and support. Listed as a guide only, not an endorsement Curistica . CSO and DCB0160 services for practices, PCNs and federations. Listed as a guide only, not an endorsement Howbeck Healthcare . GP digital clinical safety service and DPO service. Listed as a guide only, not an endorsement Sources on this page last checked 3 November 2026."},{"u":"clinical-safety/process.html","p":"Clinical safety › The process","h":"","t":"The clinical safety steps within the five stages of adopting a tool. A small change to an existing system can take minutes; a big new tool, a few weeks. Stage 1 of 5 Prepare Add the tool to your technology register Get the supplier’s clinical safety documents (DCB0129) Agree who is acting as your Clinical Safety Officer (CSO) Who CSO and practice manager You end up with The supplier’s clinical safety documents on file; a named CSO More on this stage → Stage 2 of 5 Assess Hold a hazard workshop with the staff who will use the tool Write the hazard log: each cause, effect, hazard and harm, with controls and mitigations Score each hazard before and after controls Who CSO leads, with the staff who will use it You end up with A hazard log More on this stage → Stage 3 of 5 Approve The CSO writes and signs a short clinical safety case report (CSCR) The partners review the residual risk, and accept it or decline to go live with the tool Who CSO and partners You end up with A signed safety case report More on this stage → Stage 4 of 5 Go live Train everyone who will use it, and record who was trained Start small if possible, and check early outcomes closely for incidents and recurring themes Who Practice manager You end up with A training record; early checks under way More on this stage → Stage 5 of 5 Monitor and review Log incidents and near misses, and review the hazard log when incidents happen and periodically Reassess when the supplier changes the product, or if you start to use it differently in your workflow Switch the tool off safely when the time comes Who Everyone reports; the CSO reviews You end up with A live hazard log and incident log More on this stage →"},{"u":"clinical-safety/process.html","p":"Clinical safety › The process","h":"Stage 1: Prepare","t":"Add it to your technology register , your list of every digital tool you use. Agree who your CSO is. See help . Ask the supplier: Can you send your clinical safety case report and hazard log? How do you inform us about changes to the product? Is it a medical device ? What class? How do we report a clinical safety problem to you? If your ICB or PCN already has a DCB0160 hazard log for the same tool, start from it, but remember your documents need to be specific to how you use the tool locally."},{"u":"clinical-safety/process.html","p":"Clinical safety › The process","h":"Stage 2: Assess","t":"Hold a hazard workshop . A meeting with the people who’ll use the tool, reception included. Walk through the workflow and ask at each step what could go wrong. A simple way to do this is the Structured What-If Technique (SWIFT), which NHS England teaches on its clinical safety course. At each step of the workflow, ask “what if…?”: what if the wrong information is entered, the system is down, someone leaves without saving, or two records are open at once? Write each answer down as cause, effect, hazard and harm. Write the hazard log . Start from the supplier’s, then add hazards from your own set-up. Each row reads left to right: One row of Oakfield's hazard log: the chain, then the scores and controls Cause What could make it happen The form doesn’t flag red-flag symptoms Effect What goes wrong with the information An urgent request sits in the routine queue Hazard The situation that puts a patient at risk A patient with red-flag symptoms isn’t directed to an urgent assessment in time Harm What could happen to the patient Delayed treatment; at worst, death Score before Likelihood × severity, with evidence 3 Medium × Major Controls What stops it, and what limits the harm, each with an owner and evidence Red flags stop the form; two-hour clinician review; safety-netting message Score after The risk that remains, with evidence 2 Very low × Major The full log, with evidence for each score, is in the hazard log template . Scores come from the risk grid ."},{"u":"clinical-safety/process.html","p":"Clinical safety › The process","h":"Stage 3: Approve","t":"Write the clinical safety case report . Two to six pages is plenty; it doesn’t have to be a long essay: What the tool is and how you’ll use it How you assessed it The main hazards and controls The risk that remains, and why it’s acceptable When you’ll review it The CSO signs it, and the partners review the residual risk before agreeing to go live with the tool."},{"u":"clinical-safety/process.html","p":"Clinical safety › The process","h":"Stage 4: Go live","t":"Train everyone And keep a record. Tell patients For example, for AI scribes, tell patients and respect a no. Start small One team first, outcomes checked closely. Add it to induction So new staff and locums know which tools are approved."},{"u":"clinical-safety/process.html","p":"Clinical safety › The process","h":"Stage 5: Monitor and review","t":"Keep an incident log and review the hazard log when anything changes. It isn’t a one-off: it carries on as the product and your practice’s ways of working change. See after go-live ."},{"u":"clinical-safety/process.html","p":"Clinical safety › The process","h":"References","t":"DCB0160: Clinical risk management in the deployment and use of health IT systems . NHS England standards directory DCB0129: Clinical risk management in the manufacture of health IT systems . NHS England standards directory Sources on this page last checked 3 November 2026."},{"u":"clinical-safety/templates.html","p":"Clinical safety › Templates","h":"How the documents fit together","t":"Seven documents to read, print or download, each with a blank version and one filled in for Oakfield Surgery. The supplier · DCB0129 Their hazard log Their safety case report Ask for these. They are your starting point. shared with you Your practice · DCB0160 Once for the practice Technology register Clinical risk management system: how we do clinical safety here For each tool Plan Hazard log Safety case report In use Incident log ↺ Every incident is checked against the hazard log Keep them together in one folder: your clinical risk management file."},{"u":"clinical-safety/templates.html","p":"Clinical safety › Templates","h":"The templates","t":"Seven documents, written for this toolkit. The DPIA template is on the DPIA page , and all eight are together on the templates page . Pick one to read it here, open it in its own tab, or download it as Word or Excel to fill in. Each has a blank version and one filled in for Oakfield Surgery: use the switch at the top of the document. Prepare Technology register Open ↗ Prepare Clinical risk management system Open ↗ Prepare Clinical risk management plan (CRMP) Open ↗ Assess Hazard workshop pack Open ↗ Assess Hazard log Open ↗ Approve Safety case report Open ↗ Monitor Incident log Open ↗ Technology register Open in new tab ↗ Oakfield example Download Excel These are example drafts. Your documents need to be reviewed by a Clinical Safety Officer. NHS England also has draft versions of several documents available. Adapt them to your practice, and make sure the work is your own, based on your local operating procedures and team protocols."},{"u":"clinical-safety/templates.html","p":"Clinical safety › Templates","h":"Supplier templates","t":"Your supplier may also provide a DCB0160 starter template for their product, in addition to their DCB0129 documents. Use it as a starting point, and make sure the final version describes your practice, not just the product. Templates for data protection impact assessments are in the information governance section . Sources on this page last checked 9 November 2026."},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"Why it matters","t":"If your practice uses a digital tool in patient care, you need to show you’ve thought about how it could harm a patient and what you’re doing about it. That’s clinical safety. Anything used in patient care has to be safe. We expect that of the medicines and equipment we use, and digital software is no different. When it goes wrong, patients can come to harm, sometimes for years before anyone notices. A real example from general practice A heart-risk calculator gave wrong answers for seven years In 2016 the MHRA found that the QRISK2 calculator inside one GP clinical system had been miscalculating cardiovascular risk scores, possibly since 2009. Some clinical codes had been missed when the system was built. Potentially, up to 270,000 patients were affected. Most scores were only slightly out. But where a wrong score landed on the wrong side of the 10% threshold for offering a statin, the treatment decision could change, and harm was possible either way. A patient who needed a statin might not be offered one, raising their risk of heart attack or stroke. A patient at low risk might take one they didn't need, with the risk of side effects. 10% statin threshold On screen 8% Correct 12% Illustrative chart showing how an incorrectly calculated QRISK2 score could underestimate cardiovascular risk"},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"The national study","t":"A 2025 national study found most NHS digital tools had no documented clinical safety assurance, despite it being a legal requirement. 70% of digital tools in use across NHS trusts and ICBs had no documented clinical safety assurance 14,747 tools counted in 178 organisations 13 of 204 organisations had every tool assured 10,000+ tools estimated to be in use without assurance Both standards 17.3% DCB0129 only 8.7% DCB0160 only 4.6% No documented assurance 70.1% Oskrochi, Roy-Highley, Grimes and Shah, Journal of Medical Internet Research , 2025. Freedom of information requests to 239 NHS trusts and ICBs. General practice wasn't included. The study measured whether safety documents existed, and not how good they were."},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"DCB0160: the two-minute version","t":"DCB0160 is the NHS standard for organisations that use health software, including GP practices. It’s a legal requirement. The supplier’s clinical safety work (known as DCB0129 ) doesn’t cover you. You check what could go wrong with the tool in your own practice, so DCB0160 can only be completed by the local team. You need a Clinical Safety Officer (CSO) to sign off your clinical safety work. They don’t have to work directly in your practice, but they need to be named and accountable for signing off your DCB0160 work. The DCB0160 documents are your clinical risk management system (CRMS: one practice-wide document on how you manage clinical safety for any tool), a clinical risk management plan (CRMP) for each individual tool, a hazard log and a clinical safety case report (CSCR). This process carries on for as long as you use the tool. It isn’t a one-off. DCB0160 applies if a tool could affect a clinical decision, a patient’s record or access to care. For example, a staff rota doesn’t need it. See which tools need what . Our example practice Oakfield Surgery A fictional practice we use throughout the toolkit: a practice of 9,000 patients with five GPs, two nurses, a practice manager and a care navigation (reception) team. Like every practice, Oakfield must keep an online consultation tool open throughout core hours, a contract requirement since October 2025 . Oakfield is switching to a new tool, Kestrel Consult , and needs to show it’s clinically safe in the way they run it. In simple terms, patients send requests for appointments through the practice website, a care navigator sorts them, and the duty doctor reviews anything needing specific clinical input. Kestrel Consult and the other product names in Oakfield's examples are made up. Follow Oakfield through the whole process →"},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"The trampoline analogy","t":"The words and phrases used in clinical safety sound technical, but the principles are something anybody can relate to. It’s the same process any parent goes through without thinking when they put a trampoline in the garden: what could go wrong, why could it go wrong, how bad would it be, and what are you going to do to stop it happening or limit the harm if it does. Click through the steps one by one. Each shows the process for a garden trampoline, then the same process for Oakfield Surgery’s new online consultation tool. The steps follow a chain: a cause leads to an effect , which creates a hazard for a person, which could lead to harm . Controls work on the causes; mitigations work on the harm. 1 of 9 The system The thing you’re putting in place. On its own it can’t harm anyone, but in the wrong circumstances it could. In the garden The trampoline in the garden. At Oakfield Surgery The online consultation form. 2 of 9 Causes What could make the hazard happen. There is usually more than one, often about the technology itself or how people use it. In the garden Three children bouncing at once. Someone trying a flip. At Oakfield Surgery The form doesn’t highlight red-flag symptoms. Some patients think the form is fine for urgent problems. 3 of 9 Effect What goes wrong first, before anyone is actually harmed. In the garden The bounces become unpredictable. At Oakfield Surgery A request with red-flag symptoms that needs urgent action sits in the routine queue. 4 of 9 Hazard The situation where a person could come to harm. It always involves a person, usually the patient. In the garden A child loses control while bouncing and could fall off or collide with another child. At Oakfield Surgery A patient with red-flag symptoms is not directed to an urgent assessment in time. 5 of 9 Harm What happens to the person or patient. One hazard can lead to harms of different likelihood and severity. In the garden An upset child, a bruise, a broken arm, or at worst a head injury or death. At Oakfield Surgery Patient worry, repeated calls to the practice, delayed treatment, or at worst serious harm or death. 6 of 9 Risk How likely the harm is, combined with how serious it would be. Scored from 1 to 5 using a risk matrix , which tells you whether the risk is acceptable. In the garden Quite likely, and could be fairly serious. Score: 3. Not acceptable yet. At Oakfield Surgery Possible, and could be very serious. Score: 3. Not acceptable yet. 7 of 9 Controls that prevent These act on the causes, so the hazard is less likely to happen in the first place. They reduce likelihood. In the garden One child at a time, no flips, and a safety net round the edge. At Oakfield Surgery A banner at the start of the form tells patients to call 999 or 111 for red-flag symptoms. Red-flag answers stop the form from going any further and direct the patient to 999 or 111. 8 of 9 Mitigations that limit harm These act after the hazard, so if it still happens the harm is less severe. They r"},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"Scoring a risk","t":"Each hazard is scored before and after controls, by combining likelihood with severity . Choose a square to see what it means. Likelihood Very high High Medium Low Very low Minor Minor Significant Signif. Considerable Consid. Major Major Catastrophic Catast. Severity 3 Reduce it if you reasonably can Medium likelihood (possible) and Considerable severity (a more serious injury or harm needing treatment). Try it with Oakfield's hazard H1 A patient with red-flag symptoms is not directed to an urgent assessment in time. 1 to 2: acceptable 3: reduce if you can 4 to 5: must reduce before go-live"},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"Real incidents","t":"Harm usually comes from how a tool fits the day’s work, not just from the software crashing. Turn each card to see the lesson. 2025 General practice, London An AI summary invents a diagnosis An AI tool summarising incoming documents added type 2 diabetes, medicines and other invented details to a young man’s GP record. He was then invited to diabetic eye screening. A nurse spotted it when he said he wasn’t diabetic. 2025 The lesson An AI summary invents a diagnosis Why it happened: NHS England said a staff member had been distracted and saved the unreviewed draft instead of the corrected version. The lesson: \"A human checks every output\" only works as a control if checking is easy and someone audits that it happens. In your hazard log Cause the AI adds a diagnosis that isn’t in the letter Effect a wrong code is filed Hazard the patient is recalled or treated for a condition they don’t have Harm patient anxiety; side effects of unnecessary tests or treatment Controls reviewer opens the source document before filing; monthly sample audit of AI summaries Source: Fortune, July 2025 2016 General practice, England A risk calculator gives wrong scores for years The QRISK2 calculator built into SystmOne used wrongly mapped clinical codes when pulling data from the record, so scores could be wrong back to 2009. The supplier estimated 260,000 to 270,000 patients were affected, around 100 per practice. 2016 The lesson A risk calculator gives wrong scores for years Why it happened: Codes were left out and mis-mapped when a third-party tool was built into the clinical system. The MHRA told practices to stop using it, and practices had to review statin decisions. The lesson: Tools that pull data from the record are only as good as that link, and the clean-up lands on practices. In your hazard log Cause a built-in calculator uses the wrong data from the record Effect a wrong score is shown Hazard a patient is offered the wrong treatment, or none Harm a preventable heart attack or stroke, or statin side effects Control after system updates, spot-check a few scores against the official online calculator Source: Digital Health, June 2016 ; MIMS, May 2016 2025 Hospital prescribing A wrong default dose reaches a child A four-year-old needed 1,520 units of a blood thinner twice daily but was prescribed 15,000 units through an electronic prescribing system. She received five doses over three days, which contributed to bleeding around her brain. 2025 The lesson A wrong default dose reaches a child Why it happened: The system was set up to favour adult strengths and didn’t flag the dose. The national safety investigator found these problems keep recurring and that staff training is often too thin. The lesson: Defaults and set-up choices are clinical decisions, in GP prescribing as much as in hospitals. In your hazard log Cause the default dose is wrong for this patient Effect the wrong dose is prescribed Hazard the patient takes too much or too little Harm bleeding or c"},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"Six habits for every user","t":"Know what the tool is for, and what it isn’t for. Get trained, and make sure it’s recorded. Know how it fails and what to do when it does. Tell patients when it affects them. Check the output before acting on it. Report anything that goes wrong, including near misses."},{"u":"clinical-safety/understand.html","p":"Clinical safety › Understand","h":"References","t":"DCB0160: Clinical risk management in the deployment and use of health IT systems . NHS England standards directory Guidance on the use of AI-enabled ambient scribing products in health and care settings . NHS England Patient safety issues associated with electronic patient record systems: a thematic review . HSSIB, November 2025 Digital health technology compliance with clinical safety standards in the National Health Service in England: national cross-sectional study . Oskrochi Y, Roy-Highley E, Grimes K, Shah S. Journal of Medical Internet Research, 2025 QRisk2 in TPP “fixed” but up to 270,000 patients affected . Digital Health News, June 2016 Sources on this page last checked 3 November 2026."},{"u":"clinical-safety/worked-examples.html","p":"Clinical safety › Worked examples","h":"Oakfield Surgery: online consultations","t":"Oakfield’s hazard log, then two shorter examples using the same method: an AI scribe, and a calculator built into your clinical system. Our example practice Oakfield Surgery A fictional practice we use throughout the toolkit: a practice of 9,000 patients with five GPs, two nurses, a practice manager and a care navigation (reception) team. Like every practice, Oakfield must keep an online consultation tool open throughout core hours, a contract requirement since October 2025 . Oakfield is switching to a new tool, Kestrel Consult , and needs to show it’s clinically safe in the way they run it. In simple terms, patients send requests for appointments through the practice website, a care navigator sorts them, and the duty doctor reviews anything needing specific clinical input. Kestrel Consult and the other product names in Oakfield's examples are made up. One of the GP partners has done Clinical Safety Officer training and will act as CSO. The practice manager will run the process. The hazard log Here is the hazard log Oakfield produced after a one-hour workshop with the CSO, practice manager, care navigators and reception, a nurse and a salaried GP who regularly does duty doctor sessions. Switch between the score before and after controls to see what made the difference. How to read this. Each card is one hazard: the situation where a patient could come to harm. Underneath are its cause, its effect and the harm it could lead to. Each hazard is scored twice on the risk grid : before anything is done about it, and after the controls or mitigations are in place. Use the switch on each card to toggle. 1–2 acceptable 3 reduce if you can 4–5 must reduce before go-live H1 A patient with red-flag symptoms is not directed to an urgent assessment in time Cause The patient chooses an admin or \"ask a question\" route but includes red-flag symptoms. The form’s questions don’t pick up the red flag. The patient goes back and changes answers after a red-flag warning. Effect A request describing red-flag symptoms is triaged as routine Harm Delayed treatment of a serious condition, such as sepsis, a heart attack or a suicidal crisis; at worst, death 3 Reduce if you can. Medium likelihood × Major severity. 2 Acceptable. Very low likelihood × Major severity. Controls that prevent it A banner at the start of the form tells patients to call 999 or 111 for red-flag symptoms Red-flag answers stop the form from going further and direct the patient to 999 or 111 The supplier confirms in writing that changing answers after a red-flag warning is logged and flagged Requests sent as “ask the GP a question” go straight to the duty GP, so any symptoms in them are seen quickly Mitigations that limit harm Every request that mentions symptoms is reviewed by the duty doctor within two hours in core hours A safety-netting message about red-flag symptoms is shown when the form is sent Owner: CSO H2 A patient whose problem needs an earlier or different assessment waits for a routine appointment Cause The tool books some requests straight into a routine slot, or sends the patient a booking link, using the patient’s answer"},{"u":"clinical-safety/worked-examples.html","p":"Clinical safety › Worked examples","h":"AI scribe","t":"An AI scribe transcribes the consultation and drafts the notes. Same method: start from the supplier’s hazard log and add your own. For example: Cause Effect Hazard Controls and mitigations The AI mishears, or “fills in” plausible detail (it “hallucinates”). Because the notes are usually right, the clinician skims instead of reading (automation bias) The note or letter contains something that wasn’t said, and it’s saved unnoticed A patient is treated on the basis of a wrong record Clinician reads every note before saving; monthly sample audit of notes; training covers automation bias and why checking matters The plan or safety-netting is said after the recording stops The note is missing the plan A patient’s follow-up or safety-netting is missed Clinician checks the plan and safety-netting are in the note before saving Back-to-back patients: the clinician doesn’t start a new session, or copies the note into EMIS after the next patient’s record is already open One patient’s note is saved in another patient’s record Two patients’ records are wrong, and the next clinician acts on someone else’s history or plan A new session for every patient; check the name on the scribe matches the open record before pasting; use the direct EMIS link where there is one Asking the patient’s permission matters too, but it’s a data protection and confidentiality question rather than a clinical safety hazard. See the section on telling patients . NHS England expects practices using AI scribes to have a CSO and complete DCB0160, as well as a DPIA from the information governance side."},{"u":"clinical-safety/worked-examples.html","p":"Clinical safety › Worked examples","h":"A calculator built into your clinical system","t":"Calculators inside the clinical system or prescribing software, such as QRISK or creatinine clearance, feel like part of the furniture, but they’re health IT too. The QRISK2 error went unnoticed for years. Two hazards a practice might log: Cause Effect Hazard Controls and mitigations The creatinine clearance calculation uses an out-of-date weight, or eGFR is used in its place Kidney function is overestimated A patient on a DOAC (such as apixaban) is prescribed a dose too high for their kidney function Record a current weight before calculating; use creatinine clearance, not eGFR, for DOAC doses, as the MHRA advises ; pharmacist check at annual DOAC review A system update changes how a built-in risk calculator reads the record Risk scores are wrong, with no warning on screen A patient isn’t offered treatment they need, such as a statin, or is offered one they don’t After each system update, check a few scores against the official online calculator; ask the supplier to flag calculator changes in release notes"},{"u":"clinical-safety/worked-examples.html","p":"Clinical safety › Worked examples","h":"References","t":"Guidance on the use of AI-enabled ambient scribing products in health and care settings . NHS England Prescribing medicines in renal impairment: using the appropriate estimate of renal function to avoid the risk of adverse drug reactions . MHRA Drug Safety Update, October 2019 Sources on this page last checked 3 November 2026."},{"u":"clinical-safety.html","p":"Clinical safety","h":"","t":"Home / Clinical safety Clinical safety Six sections on the clinical safety side of adopting a digital tool. If you're new to this, start with Understand. For the whole journey, including data protection, see adopting a tool . 1 Understand What clinical safety is, who does what, and how risk is scored. 2 The process Five stages, from first look to keeping it safe. 3 Worked examples An online consultation tool in full, plus an AI scribe and a built-in calculator. 4 Templates Documents to read, download and adapt. 5 After go-live Incident logs, monitoring and when to reassess. 6 Help Finding a CSO, training and common questions."},{"u":"clinical-safety.html","p":"Clinical safety","h":"The clinical safety process at a glance","t":"Stage 1 of 5 Prepare Add the tool to your technology register Get the supplier’s clinical safety documents (DCB0129) Agree who is acting as your Clinical Safety Officer (CSO) Who CSO and practice manager You end up with The supplier’s clinical safety documents on file; a named CSO More on this stage → Stage 2 of 5 Assess Hold a hazard workshop with the staff who will use the tool Write the hazard log: each cause, effect, hazard and harm, with controls and mitigations Score each hazard before and after controls Who CSO leads, with the staff who will use it You end up with A hazard log More on this stage → Stage 3 of 5 Approve The CSO writes and signs a short clinical safety case report (CSCR) The partners review the residual risk, and accept it or decline to go live with the tool Who CSO and partners You end up with A signed safety case report More on this stage → Stage 4 of 5 Go live Train everyone who will use it, and record who was trained Start small if possible, and check early outcomes closely for incidents and recurring themes Who Practice manager You end up with A training record; early checks under way More on this stage → Stage 5 of 5 Monitor and review Log incidents and near misses, and review the hazard log when incidents happen and periodically Reassess when the supplier changes the product, or if you start to use it differently in your workflow Switch the tool off safely when the time comes Who Everyone reports; the CSO reviews You end up with A live hazard log and incident log More on this stage →"},{"u":"disclaimer.html","p":"Disclaimer and privacy","h":"What this toolkit is","t":"What this toolkit is, what it isn’t, and what happens to anything you type into it. General information and example documents to help general practice teams understand and apply the NHS clinical safety standards (DCB0129 and DCB0160), data protection requirements, and good practice for AI tools."},{"u":"disclaimer.html","p":"Disclaimer and privacy","h":"What it isn’t","t":"It isn’t legal, clinical or professional advice. It doesn’t replace your Clinical Safety Officer, your Data Protection Officer, your ICB, or your indemnity provider. Your CSO signs off your practice’s own clinical safety work, and your practice remains responsible for its decisions. It isn’t official NHS guidance. Where it summarises guidance, it links to the original. If the two differ, the original is right. It may not be up to date. National guidance changes. Each page shows when its sources were last checked. Check the source before relying on a detail."},{"u":"disclaimer.html","p":"Disclaimer and privacy","h":"The templates","t":"The templates and the example AI policy are drafts written for this toolkit, and are being reviewed by a Clinical Safety Officer. You’re free to copy and adapt them for your own practice. Adapt them before use: an unchanged template doesn’t describe your practice. Oakfield Surgery and everyone named in the examples are made up."},{"u":"disclaimer.html","p":"Disclaimer and privacy","h":"Suppliers and other organisations","t":"Products, suppliers and services are named only as examples or to explain guidance. Naming them isn’t an endorsement by the author or by Staffordshire Training Hub. Material from other organisations is linked, not copied, and stays theirs. See sources and permissions ."},{"u":"disclaimer.html","p":"Disclaimer and privacy","h":"Liability","t":"The toolkit is provided in good faith, as it is. As far as the law allows, the author and Staffordshire Training Hub accept no liability for any loss or harm arising from its use. Nothing here limits liability that can’t be limited by law."},{"u":"disclaimer.html","p":"Disclaimer and privacy","h":"Privacy","t":"No accounts and no tracking. The site doesn’t use cookies, analytics or advertising. What you type stays in your browser. The AI policy builder and the CQC checklist remember your entries on your own device only, so you don’t lose them. Nothing is sent to us. Clearing your browser’s site data removes them. Third parties. Fonts are loaded from Google Fonts, and the site is hosted on GitHub Pages. Like any web service, they receive basic technical information such as your IP address when the page loads. Don’t enter patient information into any part of this site."},{"u":"disclaimer.html","p":"Disclaimer and privacy","h":"Contact","t":"Questions or corrections: niraj.samani@gpfirst.net ."},{"u":"explainers/ai-scribe-registry.html","p":"Explainers › The AI scribe registry","h":"","t":"NHS England’s list of AI scribe suppliers who say they meet its criteria. A useful starting point, but not an approval. Being on the registry gets a supplier onto your shortlist. It doesn’t do your checks for you. Whose job NHS England runs it. Your practice or ICB decides. Who usually leads Practice manager and CSO How often When you choose an AI scribe"},{"u":"explainers/ai-scribe-registry.html","p":"Explainers › The AI scribe registry","h":"What it is","t":"NHS England’s self-certified registry of suppliers of ambient voice technology, often called AI scribes. Suppliers on it have provided evidence against NHS England’s criteria, and NHS organisations can view that evidence through the national procurement hub. The first list, in January 2026, named 19 suppliers. NHS England is clear about who decides: “All assurance and decision-making sits with your local NHS organisation, not NHS England.”"},{"u":"explainers/ai-scribe-registry.html","p":"Explainers › The AI scribe registry","h":"What being listed means","t":"LISTED NHS England AI scribe supplier registry Self-certified It means The supplier says it meets NHS England’s criteria, and has shared its evidence NHS organisations can view that evidence through the national procurement hub A sensible starting point for a shortlist It doesn't mean NHS England has approved it for your practice Your clinical safety assessment and DPIA are done It’s right for your patients and your workflows It’s a medical device, or that it isn’t"},{"u":"explainers/ai-scribe-registry.html","p":"Explainers › The AI scribe registry","h":"Using it well","t":"Shortlist Start with listed suppliers, and check whether your ICB has already bought one. Practice or ICB Read the evidence What each supplier has submitted, including their safety documents and DTAC . CSO and DPO Check device status What the product does, and whether it’s a medical device . CSO Do your own assessment Your clinical safety assessment and DPIA, following NHS England’s AI scribe guidance. Practice"},{"u":"explainers/ai-scribe-registry.html","p":"Explainers › The AI scribe registry","h":"References","t":"Ambient voice technology self-certified supplier registry . NHS England NHS England lists 19 suppliers meeting criteria for ambient voice registry . HTN, January 2026 Guidance on the use of AI-enabled ambient scribing products in health and care settings . NHS England Sources on this page last checked 6 November 2026."},{"u":"explainers/cyber-security.html","p":"Explainers › Cyber security","h":"","t":"Keeping practice systems and patient data safe from attack. Most attacks start with something ordinary, like an email or a password. Cyber security in general practice is shared. Your ICB runs the IT, suppliers secure their products, and your practice keeps everyday habits safe. Whose job Shared: your practice, the ICB and suppliers Who usually leads Your named data and cyber security lead How often All the time. Checked yearly through the DSPT."},{"u":"explainers/cyber-security.html","p":"Explainers › Cyber security","h":"Who does what","t":"Your ICB provides core GP IT, including security updates and anti-virus. Practices must name someone responsible for IT, including data and cyber security, and must have a Data Protection Officer. Suppliers are responsible for the security of their own products, and you check that when you buy."},{"u":"explainers/cyber-security.html","p":"Explainers › Cyber security","h":"Five ways in","t":"Most attacks come through a handful of doors. Open each one to see the lock, and who holds the key."},{"u":"explainers/cyber-security.html","p":"Explainers › Cyber security","h":"Cyber Essentials","t":"A government-backed certificate that shows an organisation has five basic protections in place: firewalls, secure settings, security updates, controlled user access, and malware protection. Cyber Essentials A self-assessment, independently checked. Cyber Essentials Plus The same five protections, plus hands-on technical testing to show they work. The one to ask suppliers for."},{"u":"explainers/cyber-security.html","p":"Explainers › Cyber security","h":"If something goes wrong","t":"Tell your ICB GP IT service straight away, and report it through the DSPT. For urgent help, the NHS data security centre has a 24-hour line: 0300 303 5222. See data breaches for the rest of the steps."},{"u":"explainers/cyber-security.html","p":"Explainers › Cyber security","h":"References","t":"NHS England updates GP IT operating model requirements . HTN, May 2026 Cyber Essentials overview . National Cyber Security Centre DSPT help: incident reporting . NHS England Sources on this page last checked 6 November 2026."},{"u":"explainers/dcb0129-and-dcb0160.html","p":"Explainers › DCB0129 and DCB0160","h":"","t":"Two legally required NHS clinical safety standards. One is for the company that makes the software, the other is for you. Both standards ask the same question, “could this harm a patient?”, from two sides: the supplier’s product and your practice’s use of it. Whose job Supplier: DCB0129. Your practice: DCB0160. Who usually leads Each side’s Clinical Safety Officer How often Every new tool, and every significant change"},{"u":"explainers/dcb0129-and-dcb0160.html","p":"Explainers › DCB0129 and DCB0160","h":"Side by side","t":"Both are NHS information standards that are mandatory by law. DCB0129 DCB0160 Who it’s for The manufacturer of the software The organisation using it: your practice What it covers Risks in the product itself Risks in how you set it up and use it Who signs The supplier’s Clinical Safety Officer Your Clinical Safety Officer What it produces Their hazard log and safety case report Your hazard log and safety case report"},{"u":"explainers/dcb0129-and-dcb0160.html","p":"Explainers › DCB0129 and DCB0160","h":"How they fit together","t":"DCB0129 The supplier Hazard log for the product Clinical safety case report Signed by their CSO Shared with you Handed over DCB0160 Your practice Read their documents Add your own local hazards Your safety case report Signed by your CSO Go live and keep watch Their documents cover the product. Yours cover how your practice uses it: your patients, your staff, your workflows. You can’t do good DCB0160 work without the supplier’s DCB0129 documents. They tell you what the supplier has already thought about, and what they expect you to manage locally."},{"u":"explainers/dcb0129-and-dcb0160.html","p":"Explainers › DCB0129 and DCB0160","h":"What to ask the supplier","t":"Can you send your clinical safety case report and hazard log? Who is your Clinical Safety Officer? Which risks do you expect us to manage locally? How will you tell us about safety issues and updates? For the whole process, with templates and a worked example, see clinical safety ."},{"u":"explainers/dcb0129-and-dcb0160.html","p":"Explainers › DCB0129 and DCB0160","h":"References","t":"DCB0129: Clinical risk management in the manufacture of health IT systems . NHS England standards directory DCB0160: Clinical risk management in the deployment and use of health IT systems . NHS England standards directory Sources on this page last checked 6 November 2026."},{"u":"explainers/dspt.html","p":"Explainers › DSPT","h":"","t":"The Data Security and Protection Toolkit. A yearly online self-assessment that shows your practice looks after data properly. Every practice with access to NHS patient data and systems completes the Data Security and Protection Toolkit (DSPT) each year. New tools need to show up in it. Whose job Your practice Who usually leads Practice manager, with your DPO and ICB GP IT team How often Every year, by 30 June"},{"u":"explainers/dspt.html","p":"Explainers › DSPT","h":"What it is","t":"An online self-assessment against the National Data Guardian’s data security standards. Organisations with access to NHS patient data and systems must complete it. The 2025-26 toolkit for GP practices had 45 evidence items, with a deadline of 30 June 2026. Large NHS organisations are moving to a version based on the Cyber Assessment Framework. Other organisations stay on the current version until NHS England tells them it’s their turn."},{"u":"explainers/dspt.html","p":"Explainers › DSPT","h":"The year at a glance","t":"July to March: keep it up to date as things change. A new tool means updating your information asset register and data flow map. April to June: review every answer, gather the evidence, and submit. By 30 June: publish the assessment. The aim is \"Standards Met\"."},{"u":"explainers/dspt.html","p":"Explainers › DSPT","h":"Where a new tool comes in","t":"Asset register Add the tool to your list of information assets. Data flows Record what data goes to the supplier and where. DPIA Keep the DPIA and data processing agreement as evidence. The DPIA . Training Staff who use it are trained, and it’s recorded. Incidents Data breaches involving the tool are reported through the DSPT. Data breaches . Many practices get help from their ICB or DPO service, which often provides template evidence. Ask yours before you start."},{"u":"explainers/dspt.html","p":"Explainers › DSPT","h":"References","t":"Data Security and Protection Toolkit . NHS England Data Security and Protection Toolkit 2025-26 update . NHS North East London ICB. An example of ICB guidance for practices CAF-aligned DSPT: evolution of our assurance model . NHS England Sources on this page last checked 6 November 2026."},{"u":"explainers/dtac.html","p":"Explainers › DTAC","h":"","t":"The Digital Technology Assessment Criteria. A standard questionnaire that suppliers fill in, so NHS buyers can check a product before using it. The Digital Technology Assessment Criteria (DTAC) are the supplier’s homework on five areas. Your job is to read it and check the answers stand up. Whose job The supplier completes it. You review it. Who usually leads Practice manager, with your CSO and DPO How often Before you buy or switch on a tool"},{"u":"explainers/dtac.html","p":"Explainers › DTAC","h":"What it is","t":"NHS England describes DTAC as an assessment framework for health and care providers to use when buying or deploying digital products. The supplier completes the form and you use it as part of your checks. A shorter, updated form was published in March 2026, with about a quarter fewer questions and less overlap with other NHS checks such as the DSPT."},{"u":"explainers/dtac.html","p":"Explainers › DTAC","h":"The five areas","t":"Pick an area to see what it covers and what you should do with it. Has the supplier done its DCB0129 safety work, with a named CSO? Your part: Ask for their hazard log and safety case report. More Do they meet data protection law, with DSPT and the right agreements? Your part: Use their answers to help write your DPIA. More Is the product secure, with Cyber Essentials Plus and security testing? Your part: Check the certificate is current. More Does it connect to other systems using recognised standards? Your part: Ask how it links to your clinical system. More Is it easy to use, and does it meet accessibility standards? Your part: Ask how it works for patients and staff with disabilities. More"},{"u":"explainers/dtac.html","p":"Explainers › DTAC","h":"Worth knowing","t":"It isn’t a certificate DTAC sits alongside other approvals and doesn’t replace them. NHS England doesn’t endorse third-party DTAC certification schemes. It doesn’t replace your own work You still need your own clinical safety assessment and DPIA. DTAC answers help you write them. Check the date Ask for the current version. A form from years ago may not reflect the product you’re buying. ICB-bought tools If your ICB has bought the tool, ask whether it already holds the supplier’s DTAC."},{"u":"explainers/dtac.html","p":"Explainers › DTAC","h":"References","t":"Digital Technology Assessment Criteria (DTAC) . NHS England Updated NHS England DTAC form and guidance . NHS Innovation Service, March 2026 Sources on this page last checked 6 November 2026."},{"u":"explainers/im1.html","p":"Explainers › IM1 and GP system links","h":"","t":"How other software connects to your clinical system, and why a tool that writes into the record needs a closer look. IM1 is the NHS standard that lets other tools connect to the main GP clinical systems (electronic health records, EHRs): EMIS Web, SystmOne and Vision. Connecting is checked nationally. How you use it is up to you. Whose job The supplier, with national assurance Who usually leads Supplier. Your CSO looks at local risks. How often Before you switch on a linked tool"},{"u":"explainers/im1.html","p":"Explainers › IM1 and GP system links","h":"What it is","t":"IM1 (short for Interface Mechanism 1) is a set of standard connections into the main GP clinical systems. A tool that is “paired” through IM1 can read patient information, extract data in bulk, or enter data into the record. Before a pairing goes live, the supplier has to show evidence that the connection works as it should, and this is assured nationally."},{"u":"explainers/im1.html","p":"Explainers › IM1 and GP system links","h":"Three ways a tool can connect","t":"Writing is where clinical risk concentrates. A wrong code, a note filed to the wrong patient, or a duplicate entry lands straight in the record. These belong in your hazard log."},{"u":"explainers/im1.html","p":"Explainers › IM1 and GP system links","h":"What national assurance doesn’t cover","t":"IM1 assurance is about the connection. It doesn’t look at your practice’s workflows, your staff, or how a tool’s output is checked before it’s saved. That’s what your clinical safety assessment is for."},{"u":"explainers/im1.html","p":"Explainers › IM1 and GP system links","h":"What to ask","t":"Does your product read from our clinical system, write to it, or both? What exactly does it write, and does a person check it first? What happens if the connection drops part-way through? Which of these risks are in your hazard log?"},{"u":"explainers/im1.html","p":"Explainers › IM1 and GP system links","h":"References","t":"IM1 pairing integration . NHS England Sources on this page last checked 6 November 2026."},{"u":"explainers/large-language-models.html","p":"Explainers › Large language models","h":"","t":"The technology behind AI chatbots and most AI scribes. Knowing how it works explains why it can sound right and still be wrong. A large language model writes by predicting the next likely word. It is very good at sounding right. It doesn’t check whether it is right. Whose job Everyone who uses an AI tool Who usually leads Your digital lead, through training How often Every time you use one"},{"u":"explainers/large-language-models.html","p":"Explainers › Large language models","h":"How it works","t":"A large language model (LLM) is trained on huge amounts of text. When you give it some words, it predicts which word is likely to come next, then the next, and so on. The UK government’s guidance puts it simply: LLMs “predict the next word in a sequence”, and don’t understand what they produce the way a person does. Try it. The odds below are made up, but the idea is real. Illustration with made-up numbers “The patient was started on ______ ” ramipril 34% amlodipine 29% a statin 17% metformin 12% aspirin 8%"},{"u":"explainers/large-language-models.html","p":"Explainers › Large language models","h":"Why it makes things up","t":"Because it’s built to produce text that sounds plausible, an LLM can write something fluent, confident and wrong. The government’s guidance warns that output can look convincing while being factually incorrect. This is often called a “hallucination”. In a scribe, it might be a symptom the patient never mentioned, or a dose that was never said."},{"u":"explainers/large-language-models.html","p":"Explainers › Large language models","h":"The other risk: us","t":"The more often a tool is right, the less carefully people check it. This is called automation bias, and it’s why a person checking every output matters most once a tool feels reliable. One UK study of AI in radiology found that, week by week over three months, radiologists agreed with the AI more and more. It was most marked in junior staff and out of hours, when people were busiest. So “a clinician checks it” isn’t a control on its own. It depends on time, training and workload, and those belong in your hazard log too. See the clinical safety basics ."},{"u":"explainers/large-language-models.html","p":"Explainers › Large language models","h":"Good habits","t":"Read it before you sign it Every note, letter or summary, every time. NHS England’s guidance on AI scribes expects the clinician to review what the tool produces. Watch for the specific Doses, dates, numbers, names and sides of the body are where errors hurt most. Approved tools only No patient details in free or personal accounts. See your AI policy . Report the odd ones A strange output is a near miss. Report it so it can be fixed."},{"u":"explainers/large-language-models.html","p":"Explainers › Large language models","h":"References","t":"Generative AI framework for HM Government . Cabinet Office Guidance on the use of AI-enabled ambient scribing products in health and care settings . NHS England Clinical safety and AVTs webinar . Newton’s Tree, April 2026. Haris Shuaib describes Newton’s Tree’s radiology study. Panel with Dr Keith Grimes, Dr Youssof Oskrochi and Haris Shuaib Sources on this page last checked 6 November 2026."},{"u":"explainers/medical-devices.html","p":"Explainers › Medical devices","h":"","t":"Some software counts as a medical device. If it does, it has to meet safety rules and be registered with the Medicines and Healthcare products Regulatory Agency (MHRA) before it can be sold. Whether software is a medical device depends on what the manufacturer says it is for. Your job is to ask, and to check the answer. Whose job The supplier (the manufacturer) Who usually leads Supplier. Your CSO checks the answer. How often Before you buy, and when new features arrive"},{"u":"explainers/medical-devices.html","p":"Explainers › Medical devices","h":"What makes software a medical device","t":"It depends on its intended purpose: what the manufacturer says the software is for. Software that helps diagnose, treat or prevent illness is more likely to be a device. Software that stores, displays or transcribes information usually isn’t. If it is a device, it must be registered with the MHRA before it’s placed on the market in Great Britain. It should carry a UKCA or CE mark."},{"u":"explainers/medical-devices.html","p":"Explainers › Medical devices","h":"The classes","t":"Devices are put into one of four classes by risk. The higher the class, the more checking is needed before the product can be sold. Class Who checks it Everyday examples Software and AI examples I Low risk The manufacturer declares it meets the rules itself, unless it is sterile or measures something Bandages, examination lights, syringes without needles A symptom checker that does not give a diagnosis. In Great Britain, most software is Class I unless something below applies. IIa Medium risk An independent UK approved body checks it Standard hearing aids, suture needles, short-term corrective lenses Software that gives a diagnosis, or decisive information for one, such as a tool that suggests the likely diagnosis to the clinician. IIb Higher medium risk An independent UK approved body checks it Ventilators, apnoea monitors, surgical lasers Software that monitors vital functions where a change could be immediately dangerous, such as heart rhythm or breathing. III High risk An independent UK approved body checks it Pacemakers, hip replacements, breast implants Rare for software. Under EU rules, software whose output could lead to death or permanent harm if wrong. How the examples fit: Risk levels, and who checks each class, come from the MHRA. The everyday examples come from the NHS Innovation Service guide to device regulation. The software examples for Class I to IIb follow the MHRA’s guidance on software and apps. Software that allows a direct diagnosis is at least Class IIa, and software that monitors vital functions where a change could be immediately dangerous is Class IIb. Under EU rules, which many suppliers also follow for their CE mark, software tends to sit in higher classes than in Great Britain. Software informing decisions that could cause serious harm is IIb, and death or irreversible harm is III. The UK rules are changing. The MHRA published draft new regulations in May 2026. The classification rules are being rewritten, so a product’s class may change. Ask suppliers how they’re preparing."},{"u":"explainers/medical-devices.html","p":"Explainers › Medical devices","h":"AI scribes: the July 2026 guidance","t":"In July 2026 the MHRA published guidance on when AI scribes count as medical devices. Try it below. What does the AI scribe do? Pick one or more. This is a summary of reporting on the guidance. For a real product, ask the supplier and check the MHRA guidance itself."},{"u":"explainers/medical-devices.html","p":"Explainers › Medical devices","h":"What to do","t":"1 Ask the supplier whether the product is a medical device, what its class is, and what its intended purpose is. 2 If it is a device, check it’s registered on the MHRA’s public register of devices , and report problems through the Yellow Card scheme . 3 Watch for new features. A scribe that starts suggesting diagnoses may have changed category. Ask before switching new features on. 4 Either way, you still need your own clinical safety assessment and DPIA . Not being a device doesn’t mean low risk."},{"u":"explainers/medical-devices.html","p":"Explainers › Medical devices","h":"References","t":"Regulating medical devices in the UK . MHRA Medical devices: how to comply with the legal requirements in Great Britain . MHRA. Risk level of each class, and when an approved body is needed General medical devices and active implantable medical devices . NHS Innovation Service. Examples for each class Medical device stand-alone software including apps . MHRA guidance (PDF). How software is classified in Great Britain Draft UK medical device amending regulations: key proposals . Bristows LLP, May 2026 Ambient voice technology-enabled products . MHRA, July 2026 MHRA clarifies regulatory medical devices status of ambient voice technologies . HTN, July 2026 Sources on this page last checked 6 November 2026."},{"u":"explainers.html","p":"Explainers","h":"","t":"Home / Explainers Explainers One short page on each term you'll meet when bringing in a digital tool. Each one starts with the same four answers: what it is, whose job it is, who usually leads, and how often it comes up. Whose job? DCB DCB0129 and DCB0160 The two clinical safety standards, and how the supplier’s work feeds into yours. Supplier Your practice DTAC DTAC The NHS checklist suppliers fill in. You read it before you buy. Supplier MD Medical devices When software counts as a medical device, and what that means for AI scribes. Supplier DSPT DSPT Your yearly data security check, and where new tools come into it. Your practice CY Cyber security How attackers get in, who locks which door, and what Cyber Essentials is. Your practice ICB Supplier IM1 IM1 and GP system links How other tools read from and write to your clinical system. Supplier AVT The AI scribe registry What being on NHS England’s list means, and what it doesn’t. Your practice LLM Large language models How AI chatbots and scribes produce text, and why they sometimes make things up. Everyone Can't find a term? Try the glossary ."},{"u":"glossary.html","p":"Glossary","h":"","t":"Every term used in this toolkit, in plain English. Look up a term Common: DCB0160 The clinical safety standard for organisations that use health IT, including practices. How DCB0129 and DCB0160 fit → The process → DCB0129 The clinical safety standard for the companies that make health IT. How DCB0129 and DCB0160 fit → If the supplier won’t share it → Clinical Safety Officer (CSO) A registered clinician trained in clinical risk management who signs off your safety work. Finding a CSO → Training to be a CSO → Hazard log The list of what could go wrong with a tool, the controls, and the risk before and after. Hazard log template → Oakfield’s hazard log → Cause, effect, hazard and harm The chain clinical safety uses: a cause leads to an effect, which creates a hazard for a person, which could lead to harm. The trampoline → Risk score Likelihood combined with severity gives a score from 1 to 5. Scoring a risk → Safety case report (CSCR) The short summary the CSO signs to say a tool is acceptably safe to use. Safety case report template → Stage 3: Approve → Clinical risk management plan (CRMP) The scope, people and timeline for assessing one tool. CRMP template → Clinical risk management system (CRMS) Your practice’s written process for clinical safety, used for every tool. CRMS template → Technology register A list of every digital tool the practice uses and where each stands. Technology register template → Stage 1: Prepare → Hazard workshop A one-hour meeting with the people who’ll use a tool, to find what could go wrong. Workshop pack → Stage 2: Assess → Incident Something that went wrong, or nearly did, with a digital tool. The incident log → Who to tell → LFPSE The national service for recording patient safety events. Who to tell → Yellow Card The MHRA scheme for reporting problems with medical devices, including software. Medical devices → Medical device Software with a medical purpose, regulated by the MHRA and placed in a risk class. Medical devices explainer → DPIA How you think through and record the data risks of a new tool. The DPIA → DPIA template → Data Protection Officer (DPO) Advises the practice on data protection. Every GP practice must have one. Finding a DPO → Caldicott Guardian A senior person who makes sure confidential information is used properly. Caldicott Guardian → SIRO The person who accepts information risk for the practice, often a partner. Who does what → Controller and processor The practice decides how patient data is used; a supplier processes it on your instructions. The house keys → Data processing agreement The contract that says what a supplier may do with your patients’ data. The data processing agreement → Privacy notice How you tell patients what you do with their information. Your privacy notice → National data opt-out Lets patients opt out of their data being used beyond their own care. The national data opt-out → Consent Means different things in data protection law and in confidentiality. Consent: two different things → Data breach Patient information lost, "},{"u":"index.html","p":"Clinical Safety Toolkit","h":"","t":"For GP teams, practice managers and partners Clinical safety, without the jargon. Every digital tool you use in patient care needs a safety check. This toolkit shows what the NHS standards ask of your practice, in plain English, with analogies, examples and templates. Bringing in a new tool? Start here → Start with the basics Before you use a new digital tool 1 Clinical safety Could it harm a patient, and what are we doing about it? 2 Data protection Are we handling patient data lawfully and securely? 3 AI policy What are staff allowed to use, and how? How the three fit together →"},{"u":"index.html","p":"Clinical Safety Toolkit","h":"Where do you want to start?","t":"We’re adopting a new tool The whole journey in five stages, across clinical safety, data protection and AI policy. See the journey → What does that word mean? Causes, effects, hazards and harms, explained with a garden trampoline. Understand the basics → I need a template Hazard log, clinical safety case report, DPIA and more, to read, print or download. See the templates → Something’s gone wrong Who to tell, what to record, and how it feeds back into your hazard log. What to do →"},{"u":"index.html","p":"Clinical Safety Toolkit","h":"Five stages","t":"From \"we're thinking about how to roll this out\" to \"is it still safe for staff and patients?\". Choose a stage to see the steps. Stage 1 of 5 Prepare Everyone Add the tool to your technology register Clinical safety Get the supplier’s clinical safety documents (DCB0129) Data protection Start the data protection impact assessment (DPIA) and check the data processing agreement (DPA) AI policy If it uses AI, check it fits your practice AI policy and add it as necessary Clinical safety Agree who is acting as your Clinical Safety Officer (CSO) The tag shows which section of the toolkit has the detail. Stage 2 of 5 Assess Clinical safety Hold a hazard workshop with the staff who will use the tool Clinical safety Write the hazard log: each cause, effect, hazard and harm, with controls and mitigations Clinical safety Score each hazard before and after controls Data protection Work through the data protection risks in the DPIA The tag shows which section of the toolkit has the detail. Stage 3 of 5 Approve Clinical safety The CSO writes and signs a short clinical safety case report (CSCR) Data protection The DPIA is signed off, with input from your Caldicott Guardian and data protection officer (DPO) Everyone The partners review the residual risk, and accept it or decline to go live with the tool The tag shows which section of the toolkit has the detail. Stage 4 of 5 Go live Everyone Train everyone who will use it, and record who was trained Clinical safety Start small if possible, and check early outcomes closely for incidents and recurring themes Data protection Update your privacy notice and tell patients what you are using AI policy Add the tool to any induction pack for existing and new staff, including locums The tag shows which section of the toolkit has the detail. Stage 5 of 5 Monitor and review Clinical safety Log incidents and near misses, and review the hazard log when incidents happen and periodically Everyone Reassess when the supplier changes the product, or if you start to use it differently in your workflow Data protection Review the DPIA if the data processing changes, and periodically Everyone Switch the tool off safely when the time comes The tag shows which section of the toolkit has the detail."},{"u":"index.html","p":"Clinical Safety Toolkit","h":"The toolkit","t":"Available now Adopting a tool The whole journey in five stages, and which tools need what. Available now Clinical safety Hazard logs, safety cases and the five-stage process, with a worked example and templates. Available now Information governance DPIAs, privacy notices, data processing agreements and your DPO. Available now AI policy An example AI policy, a tool register and a CQC readiness checklist. Available now Explainers Short explainers on DTAC, DSPT, cyber security, medical devices, IM1 and other key topics."},{"u":"information-governance/after-go-live.html","p":"Information governance › After go-live","h":"Data breaches","t":"Patients’ information lost, changed, or seen by someone who shouldn’t see it. For example: Filed to the wrong patient A request or note in the wrong record. Sent to the wrong person A message to the wrong number or email. Pasted into personal AI Patient details put into a free chatbot. The first 72 hours 0 hours 24 48 72 hours Straight away Contain it: recall the message, remove access, pause the tool if needed, and deal with any clinical harm. Same day Tell your DPO. Together, decide how serious it is and what to do next. Without undue delay Tell the patients affected if there is a high risk to them, and if not already done. If a patient was harmed, the duty of candour applies too. Within 72 hours Report it through the DSPT incident tool, if it is reportable. Record every breach in your own log, even the ones you don't need to report. Report through the incident tool in the DSPT, which notifies the ICO. If the tool caused or nearly caused harm, tell your CSO too."},{"u":"information-governance/after-go-live.html","p":"Information governance › After go-live","h":"Keeping records","t":"Copy what matters into the medical record, agree with the supplier how long the tool keeps its copy, and follow NHS England’s Records Management Code of Practice."},{"u":"information-governance/after-go-live.html","p":"Information governance › After go-live","h":"When to review the DPIA","t":"A new use: a new way of working, or new patients Supplier changes: where data goes, or a new subcontractor A breach that shows a risk you hadn’t spotted A year on, even if nothing else has changed"},{"u":"information-governance/after-go-live.html","p":"Information governance › After go-live","h":"Every year","t":"The DSPT Every practice completes it. Add new tools to your list of information assets and data flows. Due by 30 June. DSPT explainer Staff training Every member of staff refreshes data security awareness training. What counts"},{"u":"information-governance/after-go-live.html","p":"Information governance › After go-live","h":"Ending a contract","t":"Get your data back In a format you can use Confirm deletion In writing from the supplier Remove access Staff logins and links to your clinical system Update your records Privacy notice and information asset register"},{"u":"information-governance/after-go-live.html","p":"Information governance › After go-live","h":"References","t":"DSPT help: incident reporting . NHS England Records Management Code of Practice . NHS England Data Security and Protection Toolkit . NHS England Sources on this page last checked 3 November 2026."},{"u":"information-governance/dpia.html","p":"Information governance › The DPIA","h":"Do we need one?","t":"Rule of thumb: if a new tool will handle patient information, assume you need a DPIA and speak to your DPO. You need a new one ✓ An online consultation or triage tool Patients send health information through it ✓ A patient messaging tool Texts, letters and questionnaires sent from the record ✓ A recall or proactive care tool Searches the whole list to find and invite patients ✓ An AI care navigator or receptionist Talks to patients and handles their details ✓ An AI scribe Records and transcribes consultations ✓ A new phone system that records or transcribes calls Calls hold health information too ✓ A document processing tool Reads incoming letters, then summarises and codes them into the record ✓ A tool that files or codes results automatically Writes into the record without a person doing each step ✓ Switching supplier for a tool you already use New supplier, new contract, data may move You may not need a new one – A tool that uses no personal information For example, a clinical reference app – A small update to a tool whose DPIA already covers it Check the change doesn’t alter the data, then note it on the DPIA – Your clinical system, such as EMIS or SystmOne It still needs a DPIA, but the ICB usually buys it and provides one. Adapt it to your practice – A tool your ICB or PCN has already assessed, used the same way Adopt their DPIA and add anything local, instead of starting again Either way, write down the decision and why."},{"u":"information-governance/dpia.html","p":"Information governance › The DPIA","h":"The steps","t":"The ICO’s eight steps, in four phases. Plan Decide if you need one Use the examples above, and record the decision either way. Describe the data What information, from whom, where it goes, who sees it, how long it’s kept. A simple boxes-and-arrows diagram helps. Follow the data . Ask Ask the people affected For a patient-facing tool, your patient participation group (PPG) is a good start. Ask others who know Your DPO, Caldicott Guardian, the supplier and your IT provider. Assess Is it necessary? Does the tool need everything it collects? Could you do the same with less? List the risks Access, storage, accuracy, security and surprises. Decide what to do Contract terms, settings, training, retention rules. Sign off Sign off and keep it live Record the DPO’s advice, who accepted the remaining risk, and the review date. The practice manager usually writes it, the DPO advises, the Caldicott Guardian is consulted, and the SIRO or a partner accepts the remaining risk."},{"u":"information-governance/dpia.html","p":"Information governance › The DPIA","h":"A template to start from","t":"Plain English, following the ICO’s steps, with a filled-in Oakfield version. Assess Data protection impact assessment (DPIA) Open ↗ Data protection impact assessment (DPIA) Open in new tab ↗ Oakfield example Download Word If your supplier, ICB or PCN already has a DPIA for the tool, build on it. For AI scribes, NHS England has a template DPIA ."},{"u":"information-governance/dpia.html","p":"Information governance › The DPIA","h":"Oakfield’s DPIA","t":"Oakfield started by mapping how data moves through its new online consultation tool, Kestrel Consult, step by step, with a column for each system or person involved. Every time data moves from one column to another, it can reach the wrong record, the wrong person or another company, so that’s where to look for risks. Ask the supplier for their data flow diagram to start from: it should be in their own DPIA. Patient Fills in the online form Kestrel Consult Stores the request on UK servers Risk 3 Heron Link Passes the patient’s details to EMIS Risk 4 EMIS Finds the patient, saves the request Practice staff Read and triage it in the tool EMIS Staff find the patient, add notes Risk 1 Practice staff Write a reply in the tool Kestrel Consult Sends the reply by text or email Risk 2 Patient Gets the reply Kestrel Consult Deletes the request 90 days after closing Follow the steps down. Each colour is a system or person, and the tags mark where Oakfield's risks below come in. Four of the data risks Oakfield found. The full list is in the Oakfield version of the template above. Risk 1 The tool and EMIS don’t stay in step. Opening a request doesn’t open the same patient in EMIS, so staff may add notes or send a message to another patient they had open before by accident. → What Oakfield did Staff check name, date of birth and NHS number match in both systems before adding anything or sending. They close each record when they finish. Anything added to the wrong record is corrected and reported as a data breach. Risk 2 A reply to a patient request reaches someone other than the patient, for example a parent’s phone number on a teenager’s request. → What Oakfield did Staff check who the reply will go to before sending. Sensitive replies ask the patient to phone the practice. Risk 3 The supplier reuses requests to train or improve its product → What Oakfield did The contract rules this out unless the data is anonymised, and the DPIA records it. Risk 4 The link between Kestrel Consult and EMIS is run by another company, Heron Link, so a third organisation handles patient details → What Oakfield did Checked the supplier’s agreement names Heron Link as a subcontractor on the same terms, that it stores data in the UK and has completed the DSPT . The DPIA records it."},{"u":"information-governance/dpia.html","p":"Information governance › The DPIA","h":"References","t":"Data protection impact assessments . Information Commissioner’s Office AI enabled ambient scribing products template DPIA . NHS England Sources on this page last checked 3 November 2026."},{"u":"information-governance/help.html","p":"Information governance › Help","h":"Finding a DPO","t":"Where to get support with data protection, the training your team needs, and answers to common questions. Every practice must have one. They can be shared or external. Through your ICB Ask whether it provides or arranges DPO support for practices. Ask first: it may already exist Shared across a PCN or federation One DPO covers several practices. Good for: spreading cost An external provider A company or commissioning support unit provides a DPO service for a yearly fee. Examples are listed in the references, as a guide only. Good for: practices without in-house capacity The usual route is through the ICB, though more practices now use external providers. The DPO advises independently, so they shouldn’t be someone who decides how data is used. That usually rules out the practice manager."},{"u":"information-governance/help.html","p":"Information governance › Help","h":"Caldicott Guardian and SIRO","t":"Two senior roles, usually held by partners, with different jobs. Caldicott Guardian Looks after confidentiality : is it right to use or share this patient’s information? Advises on sharing and is consulted on DPIAs. Senior Information Risk Owner Owns information risk for the practice: security, breaches and compliance. Accepts the remaining risk in a DPIA. In a small practice one partner may hold both, but they look at different questions, so two people is better where you can. The DPO is usually someone else, so their advice stays independent."},{"u":"information-governance/help.html","p":"Information governance › Help","h":"Training","t":"All staff need data security awareness training, refreshed every year, and the DSPT asks you to show it. The free Data Security Awareness, Level 1 e-learning covers it, and most practice training platforms have an equivalent module. DPOs and IG leads need more; ask your ICB."},{"u":"information-governance/help.html","p":"Information governance › Help","h":"Common questions","t":"Can staff use ChatGPT or a similar tool to write a letter? Not with any patient details in a personal or free account. Only use AI tools the practice has approved, with a DPIA and agreement in place. Your practice AI policy should say which tools are approved: see AI policy . Tools provided through NHS contracts, such as Microsoft 365 Copilot, still need a DPIA that says whether patient information can be entered. Do we need patient consent to use an AI scribe? Not GDPR consent. Tell the patient, respect a no, and record their answer. See consent: two different things ."},{"u":"information-governance/help.html","p":"Information governance › Help","h":"Further reading","t":"Information governance guidance for health and care , NHS England"},{"u":"information-governance/help.html","p":"Information governance › Help","h":"References","t":"Appointing a data protection officer (DPO) . BMA NDG announces new Caldicott principle and guidance on Caldicott Guardians . National Data Guardian Data Security Awareness, Level 1 . e-Learning for Healthcare Howbeck Healthcare . DPO service for GP practices. Listed as a guide only, not an endorsement Primary care information governance and data protection services . Arden and GEM Commissioning Support Unit (NHS). Listed as a guide only, not an endorsement Key relationships: Caldicott Guardian and SIRO . UK Caldicott Guardian Council Data Security and Protection Toolkit . NHS England Sources on this page last checked 3 November 2026."},{"u":"information-governance/suppliers.html","p":"Information governance › Suppliers","h":"Follow the data","t":"When a supplier handles patient information for you, you need to know where it goes and agree in writing what they can do with it. Take one request and follow it from the patient to the record. At each stop, ask the question underneath. 1 The patient Types a request into the online form Do they know what happens to it? 2 The supplier’s system Stores and sorts the request Where is it stored, and for how long? 3 The supplier’s subcontractors Cloud hosting, AI models, support staff, and any company linking the tool to your clinical system Who are they, and where are they? 4 Practice staff Read the request and act on it Who can see it, and is that logged? 5 The patient’s record What matters is copied into the record Is anything left behind in the tool? Follow one request from the patient to the record. A good data processing agreement and DPIA answer the question at every stop. For a worked example, see Oakfield’s data flow on the DPIA page."},{"u":"information-governance/suppliers.html","p":"Information governance › Suppliers","h":"Three ways to protect data","t":"At each step in a data flow, ask how the data is protected, and whether the supplier needs to know who the patient is. Encryption Scrambles data so only someone with the key can read it. Ask for it both while data moves between systems and where it’s stored. Still personal data Pseudonymisation Swaps names and NHS numbers for a code. Whoever holds the key can link it back to the patient, for example an AI scribe working on a transcript. Still personal data Anonymisation Removes anything that could identify the patient, so it can’t be linked back. This is the only form a supplier should use to improve its product. No longer personal data"},{"u":"information-governance/suppliers.html","p":"Information governance › Suppliers","h":"The data processing agreement (DPA)","t":"The law requires a written contract. In plain English, the supplier promises to: Follow your instructions Only use the data the way you’ve agreed. Keep it secure Appropriate technical and organisational security. Ask before subcontracting Only use other companies with your permission, on the same terms. Tell you about breaches Promptly, so you can meet your own deadlines. Delete or return it When the contract ends. Ask your DPO to read the supplier’s standard agreement before you sign."},{"u":"information-governance/suppliers.html","p":"Information governance › Suppliers","h":"Questions to ask before you sign","t":"Where is the data stored and processed? Is any of it outside the UK? Do you use our data to train or improve your product, including AI models? Have you completed the Data Security and Protection Toolkit, and do you hold Cyber Essentials Plus ? Can you provide a draft DPIA and your data processing agreement?"},{"u":"information-governance/suppliers.html","p":"Information governance › Suppliers","h":"Warning signs","t":"No agreement offered Or one that lets the supplier use data “for any purpose”. “To improve our services” Data reuse with no detail about what that means. Free or consumer versions A personal or free version being used for patient work."},{"u":"information-governance/suppliers.html","p":"Information governance › Suppliers","h":"When the ICB or NHS England buys the tool","t":"Usually the practice is still the data controller for its own patients. Ask for the central agreement and DPIA, check they cover how you use the tool, and add your own where needed."},{"u":"information-governance/suppliers.html","p":"Information governance › Suppliers","h":"References","t":"Contracts and liabilities between controllers and processors . Information Commissioner’s Office Encryption . Information Commissioner’s Office Anonymisation . Information Commissioner’s Office Sources on this page last checked 3 November 2026."},{"u":"information-governance/telling-patients.html","p":"Information governance › Telling patients","h":"Your privacy notice","t":"Patients have a right to know how their information is used. When you bring in a new tool, update what you tell them before it goes live. Update it before a new tool goes live, in plain language. The law sets out what it must cover, including why you use the information, who you share it with, how long you keep it and how patients can use their rights. Here’s how Oakfield’s section on its online consultation tool could read. Oakfield Surgery · Privacy notice Online consultations What the tool is We use an online consultation tool, Kestrel Consult, so you can contact us through our website or the NHS App, at any time of day. What information Your name, date of birth, NHS number and contact details, and what you tell us about your health, including any photos you send. Why we can use it We use your information to provide your care. The law allows this as part of our public task of providing NHS care (UK GDPR Articles 6(1)(e) and 9(2)(h)). Who else handles it Kestrel Health Ltd runs the tool for us, and Heron Link connects it to our clinical system. They can only use your information to provide this service for us. They do not use it to train or improve their products. Where and how long Your information is stored securely in the UK. Requests are deleted from the tool 90 days after they’re closed. Anything important is saved in your GP record. Your choices You can still contact us by phone or in person. To ask about your information or object to how we use it, contact our Data Protection Officer at dpo@oakfield.example. You can also complain to the Information Commissioner’s Office. An example section for a fictional practice. The labels on the left show what each part covers; your DPO can check your wording."},{"u":"information-governance/telling-patients.html","p":"Information governance › Telling patients","h":"Other ways to tell people","t":"Alongside the privacy notice: Your website: a plain-English page about the tool Posters in the waiting room and at reception On the tool itself: a short message on the form or app At the point of use, for tools in the consultation such as AI scribes For consultation tools such as AI scribes, tell the patient at the start, respect a no, and record their answer. If a patient objects to any tool, offer another way, and involve your DPO if it’s a formal objection."},{"u":"information-governance/telling-patients.html","p":"Information governance › Telling patients","h":"The national data opt-out","t":"Patients can choose to stop their confidential information being used for research and planning. They set it themselves, through the NHS App or the NHS website, and it’s held against their NHS number. Doesn’t apply When information is used for the patient’s own care, which covers most practice tools. It also doesn’t apply to anonymised data, or when the patient has agreed to a specific project. May apply If a tool or supplier wants to use identifiable data for anything beyond care, such as research or planning. The records of patients who have opted out must then be removed first. Ask your DPO. For a new tool, ask the supplier whether any identifiable data is used for anything other than care. If not, the opt-out doesn’t affect it."},{"u":"information-governance/telling-patients.html","p":"Information governance › Telling patients","h":"Tools that make decisions","t":"Some tools decide things without a person, for example a triage tool that books, redirects or declines a request automatically. Data protection law has extra rules for decisions made entirely by a computer that have a significant effect on someone. Since February 2026, a decision like this that uses health data is only allowed in narrow cases, such as with the patient’s explicit consent. Keep a person involved Someone who reviews the decision and can change it. Then it isn’t a fully automated decision. Tell patients Say in your privacy notice if a tool makes decisions automatically. Let them ask for a person A patient should be able to challenge the decision and have someone look at it again. Check first Ask your DPO before switching on a fully automated feature. The ICO consulted on updated guidance in 2026."},{"u":"information-governance/telling-patients.html","p":"Information governance › Telling patients","h":"References","t":"Consent and confidential patient information . NHS England Understanding the national data opt-out . NHS England ICO consultation on draft guidance about automated decision-making, including profiling . Information Commissioner’s Office, March 2026 Right to be informed . Information Commissioner’s Office Data (Use and Access) Act 2025, section 80: automated decision-making . legislation.gov.uk Sources on this page last checked 3 November 2026."},{"u":"information-governance/understand.html","p":"Information governance › Understand","h":"The two-minute version","t":"Information governance is how a practice looks after patients’ information. When you bring in a digital tool, it’s about making sure the tool handles that information lawfully, securely and openly. Your practice is responsible As the data controller , the practice decides how patients’ information is used, and stays responsible even when a supplier (the data processor ) does the work. You need a Data Protection Officer (DPO) Practices providing NHS services must have a DPO . They can be shared or external. Think it through first A data protection impact assessment (DPIA) checks the risks before a new tool handles patient information. Get it in writing A data processing agreement (DPA) sets out what the supplier may do with the data. Tell patients Your privacy notice must say how their information is used, and change when that changes."},{"u":"information-governance/understand.html","p":"Information governance › Understand","h":"The house keys analogy","t":"Data protection is like giving a cleaner a key to your home: you decide who comes in, agree what they’ll do, and get the key back when they leave. Click through the steps. Our example practice Oakfield Surgery A fictional practice we use throughout the toolkit: a practice of 9,000 patients with five GPs, two nurses, a practice manager and a care navigation (reception) team. Like every practice, Oakfield must keep an online consultation tool open throughout core hours, a contract requirement since October 2025 . Oakfield is switching to a new tool, Kestrel Consult , and needs to show it complies with data protection law. In simple terms, patients send requests for appointments through the practice website, a care navigator sorts them, and the duty doctor reviews anything needing specific clinical input. Kestrel Consult and the other product names in Oakfield's examples are made up. See the data risks in Oakfield’s DPIA → 1 of 8 You’re in charge The data controller At home You decide who comes into your home, and why. At Oakfield Surgery Oakfield is the data controller for its patients’ information. It decides what the online consultation tool handles and why. That responsibility stays with Oakfield even when a supplier does the work. 2 of 8 Someone works for you The data processor At home A cleaner comes in to do a job for you. They don’t decide what happens in your home. At Oakfield Surgery The supplier is a data processor. It handles patients’ requests only on Oakfield’s instructions. 3 of 8 Agree it in writing The data processing agreement (DPA) At home Which rooms, which jobs, no spare keys cut, nobody else brought round. At Oakfield Surgery A data processing agreement (DPA) sets out what the supplier may do with the data, where it’s kept, for how long, and who else it uses. 4 of 8 Think it through first The data protection impact assessment (DPIA) At home Before you hand over the keys, you think about what could go wrong and how to stop it. At Oakfield Surgery The DPIA looks at the data risks before go-live: who can see requests, where they’re stored, and what happens if they leak. It works like the risk assessment in clinical safety: what could go wrong with the data, and the controls and mitigations that reduce it. 5 of 8 Have a good reason The lawful basis At home There’s a clear reason the cleaner is there: to clean. At Oakfield Surgery Providing care is part of the practice’s public task, and health information may be used for health care, so patients don’t sign a consent form, but they must be told. Who may look is a separate rule: staff only open the records of patients they’re caring for. A receptionist looking up a neighbour’s record breaks confidentiality, even though the practice is allowed to hold it. 6 of 8 Tell the neighbours Transparency At home So nobody is alarmed to see a stranger letting themselves in. At Oakfield Surgery Oakfield updates its privacy notice and website, so patients know the tool exists, what happens to thei"},{"u":"information-governance/understand.html","p":"Information governance › Understand","h":"Consent: two different things","t":"“Consent” means different things in two sets of rules, and they answer different questions. Data protection law The question Is the practice allowed to use this information at all? For direct care Not consent. NHS care is a public task, and health information may be used to provide health care. Example A patient doesn’t sign anything for their GP to write up a consultation in their record. The duty of confidentiality The question Is it right to share it with this person? For direct care Implied consent. Patients expect the people caring for them to see it, unless they object. Example A referral letter to the hospital is fine. Telling the patient’s employer is not, unless the patient agrees. So, for an AI scribe: asking the patient first is about being open and respecting their wishes, not GDPR consent. If they say no, don’t use it."},{"u":"information-governance/understand.html","p":"Information governance › Understand","h":"The rules that apply","t":"The Data Security and Protection Toolkit (DSPT) A yearly self-assessment against NHS data security standards. The national data opt-out Lets patients opt out of research and planning uses, not their own care. The Caldicott Principles Eight principles for using confidential information well. Every practice should have a Caldicott Guardian. The duty of confidentiality Information given in confidence shouldn’t be shared without a good reason. UK GDPR and the Data Protection Act 2018 The law on using personal information. Health information is “special category” data, with extra protection. The law is at the base and underlies everything; the yearly check is at the top."},{"u":"information-governance/understand.html","p":"Information governance › Understand","h":"UK GDPR in seven principles","t":"Everything in data protection law comes back to seven principles. They’re covered in yearly staff data security training. Lawful, fair and open Have a lawful basis, and tell patients what you do with their information. Only for the stated purpose Information collected for care isn’t quietly used for something else. No more than needed Collect and share only what the task needs. Accurate Keep it correct and up to date, and fix errors. Kept no longer than needed Follow the NHS records retention schedule. Secure Protected from loss, theft and the wrong eyes. Accountable Be able to show you comply: DPIAs, contracts, training records."},{"u":"information-governance/understand.html","p":"Information governance › Understand","h":"Who does what","t":"The practice (partners) The data controller, accountable for how information is used. Data Protection Officer Advises on the law and DPIAs. Every practice needs one, but it can be outsourced. Caldicott Guardian Makes sure confidential information is used correctly. Consulted on the DPIA. Every practice needs one. Senior Information Risk Owner (SIRO) Accepts the remaining risk in a DPIA. Often a partner. Some problems are both clinical safety and data protection, like an AI scribe note filed to the wrong patient. Record them in both places. See how the areas fit together ."},{"u":"information-governance/understand.html","p":"Information governance › Understand","h":"References","t":"Appointing a data protection officer (DPO) . BMA Data protection impact assessments . Information Commissioner’s Office Consent and confidential patient information . NHS England The Caldicott Principles . National Data Guardian Understanding the national data opt-out . NHS England Data Security and Protection Toolkit . NHS England A guide to the data protection principles . Information Commissioner’s Office Sources on this page last checked 3 November 2026."},{"u":"information-governance.html","p":"Information governance","h":"","t":"Home / Information governance Information governance The data protection side of adopting and using a digital tool. If you're new to this, start with Understand. For the whole journey, including clinical safety, see adopting a tool . 1 Understand Data protection in plain English, the rules, and who does what. 2 The DPIA When you need one, how to do it, and Oakfield’s example. 3 Suppliers Data processing agreements and the questions to ask. 4 Telling patients Privacy notices, objections and the national data opt-out. 5 After go-live Data breaches, records, reviews and ending a contract. 6 Help Finding a DPO, training and common questions. This section covers information governance when you bring in and use a digital tool. Subject access requests, Freedom of Information and wider records management are touched on only where they affect a tool."},{"u":"sources.html","p":"Sources and permissions","h":"Our approach","t":"Where the content in this toolkit comes from, and how we use other people’s work. Written for this toolkit. The explanations, diagrams, worked examples and templates are original. Oakfield Surgery is fictional. We link rather than copy. Where another organisation has published guidance, a template or a video, we link to the original and credit it. We don’t host copies of other organisations’ documents. Public sector information. Some national guidance from NHS England and GOV.UK is published under the Open Government Licence . We summarise and link to it with attribution. Facts from published reports. The real incidents are short summaries of facts reported in the sources listed, each linked on its card. No endorsements. Staffordshire Training Hub doesn’t endorse any supplier, product or provider. Products are named only where a published source names them. If you think we’ve used your work without proper credit, please email niraj.samani@gpfirst.net and we’ll put it right."},{"u":"sources.html","p":"Sources and permissions","h":"National standards and guidance","t":"Source Publisher DCB0160: Clinical risk management in the deployment and use of health IT systems NHS England DCB0129: Clinical risk management in the manufacture of health IT systems NHS England Guidance on the use of AI-enabled ambient scribing products NHS England Template DPIA for AI-enabled ambient scribing products NHS England Learn from Patient Safety Events: primary care NHS England GP mythbuster 109: Artificial intelligence in GP services Care Quality Commission GP mythbuster: Learn from patient safety events Care Quality Commission Data protection impact assessments Information Commissioner’s Office Patient safety issues associated with EPR systems: a thematic review HSSIB, November 2025"},{"u":"sources.html","p":"Sources and permissions","h":"Information governance","t":"Source Publisher Consent and confidential patient information NHS England Contracts and liabilities between controllers and processors Information Commissioner’s Office Consultation on draft guidance about automated decision-making Information Commissioner’s Office, March 2026 Understanding the national data opt-out NHS England Records Management Code of Practice NHS England DSPT help: incident reporting NHS England The Caldicott Principles National Data Guardian Appointing a data protection officer BMA Data Security Awareness, Level 1 e-Learning for Healthcare"},{"u":"sources.html","p":"Sources and permissions","h":"AI policy","t":"Source Publisher Information governance guidance: Artificial intelligence NHS England The 5 key questions we ask Care Quality Commission Yellow Card scheme MHRA The example AI policy, tool register and staff card were written for this toolkit. You’re free to copy and adapt them."},{"u":"sources.html","p":"Sources and permissions","h":"Explainers","t":"Source Publisher Digital Technology Assessment Criteria (DTAC) NHS England Regulating medical devices in the UK MHRA Ambient voice technology-enabled products MHRA, July 2026 CAF-aligned DSPT: evolution of our assurance model NHS England Cyber Essentials overview National Cyber Security Centre IM1 pairing integration NHS England Ambient voice technology self-certified supplier registry NHS England Generative AI framework for HM Government Cabinet Office"},{"u":"sources.html","p":"Sources and permissions","h":"Evidence and incidents","t":"Source Used for Digital health technology compliance with clinical safety standards in the NHS in England JMIR, October 2025 UK health service AI tool generated false diagnoses for one patient Fortune, July 2025 QRISK2 in TPP fixed but up to 270,000 patients affected Digital Health, June 2016 The Independent Breast Screening Review December 2018 How using Excel may have caused thousands of unreported COVID cases Digital Health, October 2020"},{"u":"sources.html","p":"Sources and permissions","h":"Training and further reading","t":"Source Publisher Clinical risk management training NHS England Clinical risk management e-learning e-Learning for Healthcare Bitesize digital training: understanding DCB0160 Greater Manchester Primary Care Provider Board AVT in general practice: a best practice toolkit South West AVT collaboration NHS AI and Digital Regulations Service NHS Sources on this page last checked 3 November 2026."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"","t":"An example to adapt to your practice. Your partners approve the final version. Practice AI policy · Prepare stage AI policy Oakfield Surgery (a made-up practice) What it's for Tells everyone which AI tools they can use, what for, and how a new one gets approved. Who The digital lead drafts it with the CSO and DPO. The partners approve it. When Before any AI tool is used. Reviewed every year, or when a tool or national guidance changes. Practice Oakfield Surgery Version 2.0 Owner Jo Reid, practice manager and digital lead Approved Partners’ meeting, 14/10/2026 Next review October 2027"},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"1. Purpose and scope","t":"Say what the policy is for and who it covers. Include AI added to software you already use, and apps on personal devices. What this policy is for, and who it covers This policy sets out how Oakfield Surgery chooses, approves and uses tools that use artificial intelligence (AI), so they are safe for patients and protect their information. It applies to everyone who works here, including locums, trainees, students and contractors. It covers any AI tool used for practice work: tools we buy, tools the ICB or NHS England provides, AI features added to software we already use, and apps on personal devices."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"2. Who is responsible","t":"Role Name What they do Digital lead Jo Reid, practice manager Keeps the AI tool register and answers questions Clinical Safety Officer (CSO) Dr Helen Marsh, GP partner Signs off the clinical safety work for each tool Data Protection Officer (DPO) ICB DPO service Advises on the DPIA and data protection Caldicott Guardian Dr Tom Hughes, GP partner Advises on confidentiality Senior Information Risk Owner (SIRO) Dr Helen Marsh, GP partner Accepts the remaining information risk All staff Everyone Follow this policy and report problems"},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"3. Our AI tools","t":"A summary of your AI tool register: each tool, its status, and what it is and isn’t used for. The full register is a spreadsheet kept by the digital lead. Tool Status Used for Not for Kestrel Consult (online consultation and triage) Approved Patients send requests through the website and NHS App; it suggests urgency and which team Closing or turning down a request. A care navigator reads every one and can change the urgency Wren Scribe (AI scribe) Approved Drafting consultation notes and referral letters, for trained clinicians When a patient says no. Nothing saved until the clinician has read and corrected it Microsoft 365 Copilot (NHS.net) Admin only Summarising email chains, drafting practice documents, notes of non-clinical meetings Patient-identifiable information, or anything to do with a clinical decision Linnet Voice (AI phone receptionist) Being assessed Nothing yet. Hazard log and DPIA in progress; decision due January 2027 Any live calls until approved Free public chatbots Not approved Nothing involving patients or practice information Any patient details, on any device, even with names removed"},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"4. Rules for everyone","t":"Use only tools on the register, and only for what the register allows. Never put patient details into a tool that isn’t approved for them, including free or personal accounts. Read and correct anything AI writes before you save it, send it or act on it. You are responsible for what you sign. Don’t switch on a new AI feature in existing software. Tell the digital lead and wait for it to be reviewed. Use practice devices and accounts. Don’t bring your own AI apps into clinic."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"5. Bringing in a new tool","t":"Ask the digital lead, who checks the register and whether the ICB has already assessed it. Get the supplier’s evidence: DCB0129 safety documents, DTAC, DSPT, and medical device registration where it applies. The CSO completes a hazard log and clinical safety case report (DCB0160). The DPO reviews a data protection impact assessment (DPIA), and the privacy notice is updated. The partners approve it at a practice meeting, and the register is updated. Staff are trained before they use it, and the first three months are checked closely."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"6. Telling patients","t":"How patients are told, and how they can say no Our privacy notice, website and waiting room posters explain which AI tools we use and why. For Wren Scribe, the clinician tells the patient at the start, respects a no, and records the answer. Patients can always contact us by phone or in person: AI is never the only way to get care here."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"7. Checking it works","t":"How you check the tools, and how often For the first three months of a new tool, the CSO checks a sample of its output each month. After that, each tool is audited at least once a year. We check whether tools work equally well for all our patients, including people with strong accents, disabilities or limited English."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"8. When something goes wrong","t":"How problems are reported and learned from Report any problem or near miss through our incident process the same day. The CSO reviews it and decides whether to pause the tool. If patient information went somewhere it shouldn’t, tell the DPO straight away: it’s a data breach. We report to the supplier and, where relevant, Learn from Patient Safety Events and the MHRA Yellow Card scheme. Incidents and what we learned are discussed at our monthly clinical governance meeting."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"9. Training","t":"Training and induction Staff are trained on each tool before they use it, and training is recorded. New staff, locums and trainees are shown this policy and the register at induction."},{"u":"templates/ai-policy.html","p":"Templates › AI policy template","h":"10. Review and sign-off","t":"This policy and the register are reviewed every year alongside the DSPT, or sooner if a tool, national guidance or the law changes. Role Name Signature Date Digital lead Clinical Safety Officer Partner (SIRO) From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/clinical-risk-management-plan.html","p":"Templates › Clinical risk management plan (CRMP) template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. Clinical Risk Management Plan (DCB0160) · Prepare stage Clinical risk management plan (CRMP) Oakfield Surgery (a made-up practice) What it's for The CRMP sets out the scope, people and timeline for assessing one particular tool. Who Practice manager drafts it. The CSO agrees it. When At the start, before the hazard workshop. Tool and version Kestrel Consult, version 4 Supplier Kestrel Health Ltd Plan version and date 1.0, 19/01/2026 Clinical Safety Officer Dr Helen Marsh Plan owner Jo Reid, practice manager"},{"u":"templates/clinical-risk-management-plan.html","p":"Templates › Clinical risk management plan (CRMP) template","h":"1. What the tool is and how we’ll use it","t":"Description Patients send requests through our website and the NHS App. Care navigators sort them, admin requests go to the right team, and the duty doctor reviews anything clinical."},{"u":"templates/clinical-risk-management-plan.html","p":"Templates › Clinical risk management plan (CRMP) template","h":"2. Scope","t":"In scope Admin and clinical requests from adult patients and from parents for children, in core hours. Care navigator sorting and duty doctor review. Out of scope Video consultations, and features we are not switching on (automatic booking)."},{"u":"templates/clinical-risk-management-plan.html","p":"Templates › Clinical risk management plan (CRMP) template","h":"3. Supplier documents","t":"Document Received? Date DCB0129 clinical safety case report Yes 26/01/2026 Supplier hazard log Yes 26/01/2026 DTAC Yes 26/01/2026 Medical device status Not a device 26/01/2026"},{"u":"templates/clinical-risk-management-plan.html","p":"Templates › Clinical risk management plan (CRMP) template","h":"4. Who’s involved","t":"Hazard workshop attendees CSO, practice manager, two care navigators, a receptionist, a practice nurse, the duty doctor."},{"u":"templates/clinical-risk-management-plan.html","p":"Templates › Clinical risk management plan (CRMP) template","h":"5. Timeline","t":"Task Who By when Get supplier documents Practice manager 30/01/2026 Hazard workshop CSO and team 06/02/2026 Hazard log complete CSO 13/02/2026 DPIA signed off Practice manager and DPO 20/02/2026 Safety case report signed; partners accept risk CSO and partners 23/02/2026 Staff training Practice manager 27/02/2026 Go live All 02/03/2026 Three-month review CSO 02/06/2026"},{"u":"templates/clinical-risk-management-plan.html","p":"Templates › Clinical risk management plan (CRMP) template","h":"6. How we’ll judge acceptable risk","t":"We use the risk grid and acceptance rules in our clinical risk management system. Role Name Signature Date Clinical Safety Officer From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. Clinical Risk Management System (DCB0160) · Prepare stage Clinical risk management system Oakfield Surgery (a made-up practice) What it's for A short practice document that says how you do clinical safety for every digital tool. Written once, used for all of them. Who Written by the CSO and practice manager. Approved by the partners. When Once, then reviewed yearly. Practice Oakfield Surgery Version 1.0 Approved by The partners, at the practice meeting on 12/01/2026 Next review January 2027"},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"1. Purpose","t":"This document sets out how the practice manages clinical risk when it introduces, changes, uses and switches off digital tools (health IT systems), in line with the NHS standard DCB0160. It applies to every tool that could affect patient care, whoever bought it."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"2. Who does what","t":"Role Responsibility Name Partners Accountable for clinical safety in the practice. Accept the remaining risk before a tool goes live. All partners Clinical Safety Officer (CSO) A registered clinician trained in clinical risk management. Leads the assessment and signs the safety case report. Dr Helen Marsh, GP partner Practice manager Keeps the technology register and the safety documents. Organises workshops, training and reviews. Jo Reid All staff Use tools as trained, follow the controls, and report problems and near misses. Everyone If your CSO is external or shared across your PCN, say so here and how to contact them."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"3. Our process","t":"For each tool, we follow five stages. The paperwork matches the risk: a minor change may need one line in the hazard log, a new clinical tool needs the full set. Prepare: add the tool to the technology register, get the supplier’s safety documents, agree the plan. Assess: hold a hazard workshop and write the hazard log. Approve: the CSO writes and signs the safety case report; the partners accept the remaining risk. Go live: train staff, put the controls in place, tell patients. Monitor and review: record incidents, check the controls work, and review the hazard log."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"4. How we score risk","t":"Each hazard is scored for likelihood and severity using the grid below, before and after controls. Likelihood ↓ / Severity → Minor Significant Considerable Major Catastrophic Very high 3 4 4 5 5 High 2 3 3 4 5 Medium 2 2 3 3 4 Low 1 2 2 3 4 Very low 1 1 2 2 3 Score What it means 1 to 2 Acceptable. Record it and keep it under review. 3 Reduce it if you reasonably can. The CSO records why the remaining risk is acceptable. 4 Must be reduced before go-live. 5 Unacceptable. The tool can’t be used as planned."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"5. The documents we keep","t":"For each tool we keep a clinical risk management file containing: the plan, the supplier’s safety documents, our hazard log, our safety case report, training records and the incident log. Files are kept in: Where the files are kept Shared drive > Governance > Clinical safety > [tool name]. The practice manager controls access."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"6. Incidents","t":"Problems with digital tools, including near misses, go into the incident log and through our usual significant event process. The CSO reviews each one and updates the hazard log. We report to the supplier and, where relevant, to the Learn from Patient Safety Events (LFPSE) service and the MHRA Yellow Card scheme."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"7. Training","t":"The CSO completes recognised clinical safety training and keeps it up to date. Staff are trained before using a new tool, and attendance is recorded. CSO training and date NHS England clinical safety practitioner training, completed 2025."},{"u":"templates/clinical-risk-management-system.html","p":"Templates › Clinical risk management system template","h":"8. Review","t":"This document is reviewed every year, or sooner if national guidance or our arrangements change. Role Name Signature Date Clinical Safety Officer On behalf of the partners From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. DPIA (UK GDPR Article 35) · Assess stage Data protection impact assessment (DPIA) Oakfield Surgery (a made-up practice) What it's for Records what personal data a tool uses, why it’s lawful, the risks to people’s privacy, and what you’ve done about them. Who Practice manager drafts it with the supplier’s help. The DPO advises. A partner, as SIRO, accepts the remaining risk. When Before the tool is used with personal data. Reviewed when use changes, and at least yearly. Practice Oakfield Surgery Tool and supplier Kestrel Consult, Kestrel Health Ltd DPIA version and date 1.0, 18/02/2026 Completed by Jo Reid, practice manager Data Protection Officer Our DPO service"},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"1. Why we need a DPIA","t":"What the tool does and why a DPIA is needed Patients send requests, including health information, through our website and the NHS App. This is new technology processing special category data about many patients, so a DPIA is required."},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"2. The data","t":"Follow the data from start to finish. Ask the supplier for their data flow diagram, or draw your own as boxes and arrows, then list each flow in the table. # From → to What moves How 1 Patient → tool The request: symptoms, any photos, name, date of birth, contact details Online form on the website or NHS App, encrypted 2 Tool → Heron Link → EMIS Name, date of birth and NHS number to find the patient, then the request Heron Link, another company, runs the link 3 Tool → staff The request Staff log in to the tool; access by role 4 Staff → EMIS Notes, codes and actions Typed by staff, who open the patient in EMIS separately 5 Staff → patient The reply Sent from the tool by text or email to the contact details given Question Answer Whose data? Registered patients, and parents or carers acting for them What data? Name, date of birth, NHS number, contact details, the request including symptoms and any photos Where does it come from? Patients, through the online form. Reception enters phone requests. Where is it stored, and in which country? Supplier’s cloud servers in the UK Who can see it? Care navigators, clinicians and the practice manager, by role. Supplier support staff only when we ask them to help. Heron Link, the integration partner that links the tool to EMIS, passes details through but doesn’t use them. Is any of it shared or sent on? Relevant parts are copied into the GP record. Nothing else is shared. How long is it kept? In the tool for 90 days after the request is closed, then deleted. The record keeps what matters. Does the supplier use it for anything else, such as training AI? No. The contract rules this out unless the data is anonymised. How many people? About 9,000 registered patients; around 900 requests a month"},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"3. Is it lawful?","t":"Question Answer Our role Controller. The supplier is our processor. Lawful basis (UK GDPR Article 6) 6(1)(e): a task in the public interest, providing NHS care Condition for health data (Article 9) 9(2)(h): providing health care Confidentiality Used for direct care, so implied consent applies. Patients are told in our privacy notice. Data processing agreement in place? Yes, signed 10/02/2026 Supplier’s DSPT status Standards Met, 2025-26"},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"4. Who we asked","t":"Who was consulted and what they said DPO (advice below). Caldicott Guardian: content with the access controls. Patient participation group: asked for clear guidance on what to put in the form. Supplier: provided their DPIA, hosting details and DSPT."},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"5. Is it necessary and in proportion?","t":"Do we need all of this data? Could we do it with less? How do we tell patients and support their rights? The form asks only for what’s needed to handle the request. Free text is needed for clinical requests. The privacy notice and website explain the tool. Patients can still phone or call in. Rights requests are handled through our usual process."},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"6. Risks to people’s privacy","t":"For each risk, score likelihood (remote, possible, probable) and severity (minimal, significant, severe) to give an overall rating (low, medium, high). The clinical risks go in the hazard log, not here. Risk Likelihood Severity Overall Staff add notes or send a message to the wrong patient because the tool and EMIS don’t open the same patient Possible Significant Medium A reply reaches someone other than the patient Possible Significant Medium Heron Link, the integration partner, handles patient details when linking the tool to EMIS Possible Significant Medium Too many staff can read requests Possible Significant Medium Data is stored outside the UK Remote Significant Low The supplier uses requests to train or improve its product Possible Significant Medium Requests are kept longer than needed Probable Minimal Low"},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"7. What we’re doing about them","t":"Risk Measures Residual risk Approved? Wrong patient open in EMIS Check name, date of birth and NHS number in both systems before adding or sending; close each record when finished; wrong-record entries corrected and reported as a data breach Low Yes Reply reaches the wrong person Check who the reply goes to before sending; sensitive replies ask the patient to phone Low Yes Integration partner handles data Named as a subcontractor in the supplier’s agreement on the same terms; UK storage; DSPT completed Low Yes Too many staff can read Access by role; access log checked monthly Low Yes Stored outside the UK UK hosting written into the contract Low Yes Supplier reuses data Contract rules it out unless anonymised Low Yes Kept too long Deleted 90 days after closing Low Yes"},{"u":"templates/dpia.html","p":"Templates › Data protection impact assessment (DPIA) template","h":"8. Sign-off","t":"Item Name and date Notes Measures approved by Jo Reid, 18/02/2026 Remaining risk accepted by (SIRO or partner) Dr Helen Marsh, 23/02/2026 All residual risks low DPO advice given DPO service, 16/02/2026 Add retention period to privacy notice DPO advice accepted or overruled? Accepted If overruled, say why Caldicott Guardian consulted Dr Tom Hughes, 12/02/2026 Next review June 2026, then yearly If a high risk remains that you can’t reduce, you must consult the ICO before you start. Your DPO will advise. From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/hazard-log.html","p":"Templates › Hazard log template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. Hazard Log (DCB0160) · Assess stage Hazard log Oakfield Surgery (a made-up practice) What it's for Every hazard you’ve found for one tool, written as cause, effect, hazard and harm, with the controls and the risk before and after. Who The CSO owns it. The team adds to it at the workshop and after incidents. When Started at the hazard workshop. Updated after incidents, changes and reviews. This is a spreadsheet. Download the Excel version to use it: the drop-down lists are built in, and the risk scores are worked out for you from the grid. ID Cause Effect Hazard Harm Likelihood before Severity before Risk before Evidence for the score before Controls and mitigations Control owner Evidence the controls are in place Likelihood after Severity after Risk after Evidence for the score after Status Last reviewed H1, H2... What could make it happen, usually the technology or how it’s used. Often more than one What goes wrong with the information first The situation where a person, usually the patient, could come to harm What could happen to the patient From the risk grid From the risk grid Worked out for you Why you chose this likelihood and severity: incidents, supplier data, local experience Controls that stop the cause leading to the hazard; mitigations that limit harm if it happens. Include supplier controls Named person or role How you know: setting checked, training record, audit, test With controls in place With controls in place Worked out for you Why the controls bring the score down, and by how much Open or closed Open / Closed Date H1 The patient chooses an admin or \"ask a question\" route but includes red-flag symptoms. The form’s questions don’t pick up the red flag. The patient goes back and changes answers after a red-flag warning. A request describing red-flag symptoms is triaged as routine A patient with red-flag symptoms is not directed to an urgent assessment in time Delayed treatment of a serious condition, such as sepsis, a heart attack or a suicidal crisis; at worst, death Medium Major 3 Supplier’s DCB0129 hazard log rates under-triage as its top risk. In a one-week sample of 50 requests, 2 described possible red flags under an admin route. Controls: A banner at the start of the form tells patients to call 999 or 111 for red-flag symptoms. Red-flag answers stop the form from going further and direct the patient to 999 or 111. The supplier confirms in writing that changing answers after a red-flag warning is logged and flagged. Requests sent as “ask the GP a question” go straight to the duty GP, so any symptoms in them are seen quickly. Mitigations: Every request that mentions symptoms is reviewed by the duty doctor within two hours in core hours. A safety-netting message about red-flag symptoms is shown when the form is sent. CSO Form screenshots and test cases on file. Duty doctor rota and audit spreadsheet. Very low Major 2 Red-flag stop tested with"},{"u":"templates/hazard-log.html","p":"Templates › Hazard log template","h":"The risk grid","t":"Likelihood ↓ / Severity → Minor Significant Considerable Major Catastrophic Very high 3 4 4 5 5 High 2 3 3 4 5 Medium 2 2 3 3 4 Low 1 2 2 3 4 Very low 1 1 2 2 3 1 to 2: acceptable. 3: reduce if you reasonably can. 4: must reduce before go-live. 5: unacceptable. From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/hazard-workshop-pack.html","p":"Templates › Hazard workshop pack template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. Hazard identification workshop · Assess stage Hazard workshop pack Oakfield Surgery (a made-up practice) What it's for Everything you need to run a one-hour hazard workshop: who to invite, an agenda, prompt questions, a worksheet and a sign-in sheet. Who Led by the CSO. Organised by the practice manager. When Once per tool, early in the assessment. Tool Kestrel Consult Date and place 06/02/2026, practice meeting room Led by Dr Helen Marsh, CSO"},{"u":"templates/hazard-workshop-pack.html","p":"Templates › Hazard workshop pack template","h":"1. Before the workshop","t":"Invite the people who’ll use the tool: clinicians, reception, admin, and anyone with a special role such as the safeguarding lead. Bring the supplier’s hazard log and safety case report. Draw the workflow as a simple list of steps, from the patient’s first contact to the task being closed. Print this pack."},{"u":"templates/hazard-workshop-pack.html","p":"Templates › Hazard workshop pack template","h":"2. Agenda (60 minutes)","t":"Time What 5 min Why we’re here: what the tool does, and that every view counts 10 min Walk through the workflow, one step at a time 30 min At each step, ask the prompt questions and note hazards on the worksheet 10 min Agree rough scores and controls for the main hazards 5 min Actions: who writes up the hazard log, and by when"},{"u":"templates/hazard-workshop-pack.html","p":"Templates › Hazard workshop pack template","h":"3. Prompt questions","t":"Ask these at each step of the workflow. Write each problem as cause, effect, hazard and harm. What could go wrong here? What would cause it? What would go wrong with the information first: missed, delayed, wrong, or sent to the wrong patient? Who would that put at risk, and in what situation? (This is the hazard. It always names a person.) What would happen to the patient if nobody noticed? (This is the harm.) What if the system is slow, down, or updated? What would a busy or new member of staff do? Are there workarounds? Who might not be able to use this, and what happens to them? Could a safeguarding concern be missed? Which hazards in the supplier’s log apply to how we work? For AI tools: what if the input is poor (a noisy room, a bad microphone)? What if it adds or misses something? What happens when people trust it and stop checking?"},{"u":"templates/hazard-workshop-pack.html","p":"Templates › Hazard workshop pack template","h":"4. Worksheet","t":"Workflow step Cause Effect Hazard (who is at risk, and how) Harm Patient fills in the form Form doesn’t flag red-flag symptoms Urgent request sits in the routine queue Patient with red-flag symptoms not directed to an urgent assessment in time Delayed treatment; at worst death Request arrives in the queue No named owner that day Request left unopened Patient’s request never actioned Missed or delayed care Care navigator files it Parent submits for a child Filed in the wrong record The child’s request isn’t seen Missed or delayed care"},{"u":"templates/hazard-workshop-pack.html","p":"Templates › Hazard workshop pack template","h":"5. Sign-in sheet","t":"Name Role Signature Dr Helen Marsh CSO, GP partner Jo Reid Practice manager Sam Ali Care navigator Amy Clarke Practice nurse From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/incident-log.html","p":"Templates › Incident log template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. Incident and issue log · Monitor stage Incident log Oakfield Surgery (a made-up practice) What it's for One log for problems and near misses with any of your digital tools, linked back to the hazard log. Who Anyone can raise an entry. The CSO reviews and closes each one. When Whenever something goes wrong or nearly does. Reviewed at clinical meetings. This is a spreadsheet. Download the Excel version to use it: the drop-down lists are built in. Ref Date Tool What happened Harm Immediate action Hazard log link Change made Reported to Closed by and date I1, I2... When it happened From the technology register Facts, no names of patients To the patient Near miss / No harm / Low / Moderate / Severe / Death What was done at the time Which hazard, or new hazard added To stop it happening again Supplier, LFPSE, Yellow Card, DSPT CSO I1 12/03/2026 Kestrel Consult A request mentioning a new breast lump was filed as routine Near miss Spotted by the duty doctor within the hour. Patient called and assessed the same day. H1: controls in place but the red-flag wording missed ’tight chest’ Supplier asked to add the phrase; care navigators briefed Supplier; LFPSE Dr Helen Marsh, 20/03/2026 From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. Clinical Safety Case Report (DCB0160) · Approve stage Safety case report Oakfield Surgery (a made-up practice) What it's for The short summary the CSO signs to say the tool is acceptably safe to use, with the controls in place. Two to six pages is plenty. Who Written and signed by the CSO. The partners accept the remaining risk. When Before go-live. Updated after reviews and significant changes. Practice Oakfield Surgery Tool and version Kestrel Consult, version 4 Supplier Kestrel Health Ltd Report version and date 1.0, 23/02/2026 Clinical Safety Officer Dr Helen Marsh, GP partner"},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"1. Summary","t":"Our conclusion in two or three sentences With the controls in our hazard log in place, the CSO considers Kestrel Consult acceptably safe to introduce for admin and clinical requests in core hours. Five hazards were found. After controls, all are scored 2 (acceptable)."},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"2. The tool and how we’ll use it","t":"Description and scope Patients send requests through our website and the NHS App. Care navigators sort them; the duty doctor reviews anything clinical. In scope: adult and parent-on-behalf-of-child requests in core hours. Out of scope: video consultations and automatic booking."},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"3. How we assessed it","t":"Method Review of the supplier’s DCB0129 safety case report and hazard log. A one-hour hazard workshop on 06/02/2026 with clinical and care navigation staff, including a salaried GP who regularly does duty doctor sessions, walking through a request from start to finish."},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"4. Main hazards and controls","t":"Summarise. The full detail is in the hazard log. ID Hazard Risk before Key controls and mitigations Risk after H1 A patient with red-flag symptoms is not directed to an urgent assessment in time 3 Red-flag stop on the form; duty doctor reviews symptom requests within two hours 2 H2 A patient whose problem needs an earlier or different assessment waits for a routine appointment 3 Auto-booking limited to admin and clearly routine requests; free text read the same day 2 H3 A patient’s request is not actioned when it needs to be, while they believe the practice is dealing with it 3 Symptom requests in core hours only; named queue owner; end-of-day check 2 H4 The right patient isn’t assessed, and decisions are made using the wrong patient’s record 3 Patient details checked before filing; second check for requests made on someone’s behalf 2 H5 A patient who can’t use the form, because of age, disability, language or no internet, is assessed later than they need to be 3 Same-day appointments reserved for phone and walk-in; reception can complete the form 2"},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"5. Supplier assurance","t":"What we received and checked DCB0129 safety case report and hazard log (January 2026), DTAC, confirmation that the product is not a medical device. The supplier’s CSO is named in their report."},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"6. Remaining risk","t":"Why the remaining risk is acceptable All hazards score 2 after controls. The controls are in place and staff have been trained. The partners accepted the remaining risk at the practice meeting on 23/02/2026."},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"7. Conditions for go-live","t":"Anything that must be in place first Symptom requests in core hours only. Red-flag stop tested before go-live. Auto-booking limited to admin and clearly routine requests. Phone and walk-in route kept, with reserved same-day appointments."},{"u":"templates/safety-case-report.html","p":"Templates › Safety case report template","h":"8. Review","t":"When we’ll review this After three months (June 2026), then yearly, or sooner after an incident or a significant product change. Role Name Signature Date Clinical Safety Officer Partner, accepting the remaining risk on behalf of the practice From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates/technology-register.html","p":"Templates › Technology register template","h":"","t":"Draft for review by a Clinical Safety Officer. Adapt it to your practice before use. Health IT system inventory · Prepare stage Technology register Oakfield Surgery (a made-up practice) What it's for A list of every digital tool the practice uses, and where each one stands on clinical safety and data protection. Who Practice manager keeps it. CSO and DPO check it. When Set up once. Update whenever a tool is added, changed or switched off. Review yearly. This is a spreadsheet. Download the Excel version to use it: the drop-down lists are built in. Tool Supplier What we use it for Who bought it Clinical use? Supplier safety documents held? Our clinical safety status DPIA status Medical device? Practice owner Last reviewed Next review Notes Name of the product or service Company that provides it In plain words Practice, PCN, ICB or NHS England Practice / PCN / ICB / NHS England Could it affect patient care? Yes / No DCB0129 safety case and hazard log Yes / Requested / No / Not needed DCB0160 work for our practice Not started / In progress / Signed off / Not needed (reason in notes) Data protection impact assessment Not started / In progress / Signed off / Not needed (reason in notes) Yes, with class, or No Named person Date Date Anything else, including why a step isn’t needed Kestrel Consult Kestrel Health Ltd Patients send admin and clinical requests through our website and the NHS App Practice Yes Yes Signed off Signed off No Jo Reid (practice manager) 02/03/2026 02/06/2026 Three-month review then yearly GP clinical system Clinical system supplier The patient record ICB Yes Yes Signed off Signed off No Jo Reid (practice manager) 15/01/2026 15/01/2027 Safety case held by the ICB; our local hazards added Text messaging service Example Messaging Ltd Appointment reminders and results messages ICB Yes Yes Signed off Signed off No Jo Reid (practice manager) 10/09/2025 10/09/2026 Wren Scribe (AI scribe) Wren Health Ltd Drafting consultation notes and referral letters Practice Yes Yes Signed off Signed off Yes, Class I Dr Helen Marsh (CSO) 14/10/2026 14/01/2027 Trained clinicians only. Three-month review, then yearly Linnet Voice (AI phone receptionist) Linnet Ltd Answering calls and booking appointments Practice Yes Requested In progress In progress Ask supplier Jo Reid (practice manager) Not to be used until signed off. Decision due January 2027 Rota software Example Rota Ltd Staff rotas Practice No Not needed Not needed (reason in notes) Signed off No Jo Reid (practice manager) 01/04/2026 01/04/2027 No patient data or clinical use From the Clinical Safety Toolkit by Dr Niraj Samani, STH AI & Digital Health Ambassador. Written for this toolkit; you're free to copy and adapt it. Not legal advice. Your Clinical Safety Officer signs off your practice's own documents."},{"u":"templates.html","p":"Templates","h":"","t":"Home / Templates Templates Every document in the toolkit in one place. Read it here, open it in its own tab, print it, or download it as Word or Excel. Each has a blank version and one filled in for Oakfield Surgery. Prepare Technology register Open ↗ Prepare Clinical risk management system Open ↗ Prepare Clinical risk management plan (CRMP) Open ↗ Assess Hazard workshop pack Open ↗ Assess Hazard log Open ↗ Approve Safety case report Open ↗ Monitor Incident log Open ↗ Assess Data protection impact assessment (DPIA) Open ↗ Prepare AI policy Open ↗ Technology register Open in new tab ↗ Oakfield example Download Excel The AI policy is explained on the Your policy page. For how the documents fit together, see clinical safety templates ."},{"u":"whats-changing.html","p":"What’s changing","h":"","t":"National changes that affect this toolkit, newest first. Date Change What it means for practices Jul 2026 MHRA and NHS England publish guidance on when AI scribes count as medical devices Ask suppliers about their product’s device status. Explainer Mar 2026 NHS England publishes a template DPIA for AI scribes Use it as the starting point for AI scribe data protection work Jan 2026 NHS England lists 19 suppliers on its self-certified AI scribe registry ( HTN ) Being listed isn’t an approval; you still do your own checks. Explainer Nov 2025 National safety investigator finds electronic record systems still contribute to missed and delayed care ( HSSIB ) Set-up, defaults and training matter as much as the product Oct 2025 A national study finds 70% of digital tools in NHS trusts and ICBs have no documented clinical safety assurance ( JMIR ) Expect more scrutiny of safety paperwork, including from CQC. Why it matters Oct 2025 National study finds most NHS digital tools lack evidence of safety compliance ( JMIR ) Expect more scrutiny of safety paperwork Ongoing NHS England is reviewing DCB0129 and DCB0160 The process may change; this toolkit will be updated Sources on this page last checked 3 November 2026."}]