NHS Data Security and Protection Toolkit (VitalHub UK)
What is the DSP Toolkit?
The NHS DSP Toolkit, formerly known as the Data Security and Protection Toolkit, is an online self-assessment tool designed by NHS Digital to help HHSPs assess and improve their data security and information governance practices. It outlines a set of standards and best practices to ensure the secure handling and protection of patient data within healthcare organizations.
It is also an annual assessment. As data security standards evolve, the requirements of the DSP Toolkit are reviewed and updated to ensure they are aligned with current best practice. Organizations with access to NHS patient data must therefore review and submit their annual assessment each year before the deadline. The DSP Toolkit also provides organizations with a means of reporting security incidents and data breaches.
At VitalHub, we prioritize securing safeguarding sensitive patient information and promoting trust in digital healthcare delivery through our many software platforms for healthcare organizations. Our compliance with the NHS Digital Security and Protection (DSP) Toolkit, proves that we provide robust and secure environments for healthcare organizations, ensuring that our solutions meet the highest standards of data security and protection.
Why complete a DSP Toolkit assessment?
All organizations that have access to NHS patient information must provide assurances that they have the proper measures in place to ensure that this information is kept safe and secure. Completion of the DSP Toolkit is therefore a contractual requirement specified in the NHS England Standard Conditions contract and it remains Department of Health and Social Care policy that all bodies that process NHS patient information for whatever purpose provide assurances via the DSP Toolkit.
For Health and Human service providers, compliance with the NHS DSP Toolkit offers several benefits:
Protecting Patient Data: Compliance with the toolkit's standards helps organizations safeguard patient data against unauthorized access, breaches, and cyber threats, ensuring patient confidentiality and privacy.
Legal and Regulatory Compliance: The toolkit aligns with legal and regulatory requirements, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, helping organizations meet their obligations and avoid potential penalties for non-compliance.
Enhancing Trust and Confidence: By demonstrating compliance with the NHS DSP Toolkit, organizations build trust and confidence among patients, partners, regulators, and other stakeholders, showcasing their commitment to data security and protection.
Improving Information Governance Practices: The toolkit encourages organizations to adopt best practices for information governance, including data handling, storage, sharing, and disposal, promoting transparency, accountability, and integrity in data management.
Cyber Resilience and Incident Response: Compliance with the toolkit's cybersecurity requirements helps organizations enhance their cyber resilience and incident response capabilities, minimizing the impact of security incidents and ensuring continuity of care for patients.
The Standards of the NHS DSP Toolkit:
The National Data Guardian’s Review of Data Security, Consent and Opt-Outs has set out ten data security standards clustered under three leadership obligations to address people, process and technology issues:
Leadership Obligation 1: People: ensure staff are equipped to handle information respectfully and safely, according to the Caldicott Principles.
Data Security Standard 1: All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes
Data Security Standard 2: All staff understand their responsibilities under the National Data Guardian’s Data Security Standards, including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches.
Data Security Standard 3: All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit.
Leadership Obligation 2: Process: ensure the organisation proactively prevents data security breaches and responds appropriately to incidents or near misses.
Data Security Standard 4: Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access to personal confidential data on IT systems can be attributed to individuals.
Data Security Standard 5: Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.
Data Security Standard 6: Cyber-attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection.
Data Security Standard 7: A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.
Leadership Obligation 3: Technology: ensure technology is secure and up-to-date. Data Security Standard
Data Security Standard 8: No unsupported operating systems, software or internet browsers are used within the IT estate. Data Security Standard Overall Guide.
Data Security Standard 9: A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually.
Data Security Standard 10: IT suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s Data Security Standards.