Security and trust, NHS DSPT
The NHS DSPT, and how wai supports your assurance
The Data Security and Protection Toolkit is the self-assessment every organisation with access to NHS patient data must complete, and NHS buyers ask their suppliers for the evidence behind it. wai shares its security, hosting and clinical safety position for your intended use, each with a status and a date, in a scoped assurance review.
Updated .
Where wai stands today
- DSPT position
- Shared with NHS buyers in a scoped assurance review, with a status and a date.
- Clinical safety, DCB0129 and DCB0160
- The materials for your intended use reviewed with your clinical safety team before deployment, including any open work.
- Encryption
- AES-256 at rest and TLS 1.3 in transit.
What the DSPT and the clinical safety standards ask
The DSPT measures an organisation against the National Data Guardian's 10 data security standards, and all organisations that have access to NHS patient data and systems must use it.1 The outcomes, assertions and evidence items for the 2026 to 2027 version were published on 2 October 2026, and its audit guidance is being aligned to the Cyber Assessment Framework.1
Beside it, DCB0129 asks manufacturers of health IT to manage the clinical risk of their products, and DCB0160 asks the organisations that deploy them to do the same for their own setting. Both are published under section 250 of the Health and Social Care Act 2012.2
What wai does
- 01
Shares its DSPT position, security controls and subprocessors for your intended use in a scoped review, each with a status and a date.
- 02
Reviews the clinical safety materials for your proposed use with your clinical safety team before deployment.
- 03
Encrypts data with AES-256 at rest and TLS 1.3 in transit, and enforces role-based access in the database.
- 04
Writes every message, draft, approval and signature to an event log your organisation can export.
- 05
Runs a scoped pilot on one pathway, with success measures and an exit plan agreed with your clinical and digital leads before live use.
What stays with your organisation
- Your organisation's own DSPT submission.
- Your DCB0160 work and your clinical safety officer's review for your setting.
- Your DPIA, and the information governance sign-off for the pathway.
The agreements we sign
As of 16 October 2026, wai acts as processor for UK and EU clinics under a written data-processing agreement, and signs a business associate agreement with US practices before go-live. We send the evidence for your intended use in writing, each item with a status and a date.
Questions
Does a private clinic need the DSPT?
If it has access to NHS patient data or systems, yes. A purely private clinic usually does not, though many follow the same standards for their NHS partners and insurers.
What do you share in the assurance review?
The evidence relevant to your intended use, our security controls, hosting and subprocessors, the clinical safety materials and any open items, each with a status and a date.
How does an NHS organisation start?
With one pathway and its success measures, agreed with your clinical and digital leads before any live use, as the page for NHS integrated care boards and trusts sets out.
Further reading
Security and trust- Read nextFor NHS integrated care boards and trusts
- Read nextPublic sector
- Read nextUK GDPR
- Read nextThe DSPT and your scribe supplier
- SecurityHIPAA, and how wai protects your practice's patient data
- SecurityUK GDPR, and how wai handles your clinic's patient data
- SecurityData residency, and where wai keeps your clinic's records
- SecuritySOC 2 Type II, and the controls behind it
Bring your security questions to a demo.
A 15 minute video call on your own clinic, with your NHS DSPT questions answered in writing afterwards, control by control. Prices for clinics, groups and hospitals are on the pricing page.