Change Font Size
Data Security Protection Toolkit (DSPT)
If you have never completed the DSPT you need to take the following action.
The DSPT is an online toolkit which you are required to complete if you have access to any NHS data systems (including NHS Mail). As we increasingly work in a digital world the NHS intends to further open its systems to Adult Social Care providers. By having access to the NHS’s digital systems, it will transform the way we deliver care but in order to do this, providers must be able to demonstrate that they have adequate Data Protection policies in place. This is where the Toolkit comes in.
The DSPT is a free, online self-assessment of health and social care providers’ data security and protection policies, procedures and processes.
It is not just about technology and digital records – it is about any information that care providers hold about any person – staff, clients, funders, partners or visitors – including paper records.
By answering a series of questions, care providers can demonstrate that they are compliant with data protection legislation, the health and social care data security standards, and good practice.
The DSPT for social care is specifically designed for adult care providers.
For more information on the DSPT and on how to register, please see the links:
Data Security and Protection Toolkit – Digital Care Hub
Register, login or change DSPT registration – Digital Care Hub
Before you start – Digital Care Hub
Answer DSPT questions – Digital Care Hub
How to Complete Standards Met on the DSPT
Please see the link here for a guide on how to complete Standards Met on the DSPT.
Why do I need to do this?
Adult Social Care and the Health Services are inextricably linked, and this is being demonstrated by the increasing importance and use of digital care and health systems.
The NHS encouraged care providers to sign up to NHS Mail and this has resulted in much more streamlined sharing of records and data.
The NHS does not want to lose what we have gained, and it wants to further expand the data and systems that it can share with Adult Social Care.
The DSPT underpins all this as it shows that you have good data protection and security protections in place.
The DSPT is an extremely useful tool because it covers many areas of GDPR compliance that you as a Care Provider are required to implement, such as having up to date policies and ICO registration, ensuring you are operating within the law.
It is a contractual requirement with ICB’s and if you have access to NHS data systems.
CQC will increasingly expect a good provider to comply with the Data Security and Protection Toolkit (DSPT) or equivalent, as a minimum. This also applies where you use a combination of digital and paper record systems.
DSPT is now a requirement under the new Single Assessment Framework under “Well Led” Governance, management and sustainability.
Central and local government bodies, local authority and ICB commissioners, the Care Quality Commission and the National Data Guardian recognise it as the official tool to evaluate your compliance with legal requirements, data security standards and good practice.
If you have services funded by the NHS, for example under continuing healthcare, there is a contractual requirement to complete the DSPT every year.
All adult social care services in England, including residential and nursing homes, supported living, homecare, extra care, shared lives and day services, are strongly recommended to complete the DSPT. It’s increasingly what local authorities, ICB and the Care Quality Commission will expect to see.
It can help protect you from cyber attacks.
It is likely to become mandatory in the future, so it is worth doing now to get used to its requirements.
Find out more here About the DSPT | Digital Care Hub
What help is available?
The DSPT has been rewritten to make it simpler to understand and many of the questions are now more care specific. Completing the DSPT is not a 5-minute job and requires some preparation beforehand, so a program of support is available to help you successfully complete the Toolkit, both at a national level and locally.
At a national level the Digital Social Care website has lots of online resources and templates you can access, and they are also delivering a series of webinars to give you more information about the DSPT.
Locally the Care Group and Central Bedfordshire Council has information on what you need to complete the Toolkit on this website and we’ve also put together a program of FREE webinars you can attend, where we can talk you through the Toolkit, allowing you to complete it – with our help – while you are on the webinar. You can find full details of both these resources by clicking the buttons below.
Resources
DSPT support and resources
Please see the link to DSPT support and resources on “How to Complete Standards Met for Small to Medium Sized Care Providers” here.
Find out moreWebinars
If you feel you need additional help we have put together a series of FREE webinars where we offer more intensive help and can answer your questions. Details can be found by clicking the button below.
Find out moreDocuments/policies needed to complete to Standards Met:
The policies and documents need to complete the DSPT are broadly the same as before with a few new additions:
ICO Registration Number
All companies that handle data in any form must be registered with the ICO (Information Commissioners Office). It is an offence if you hold or process data and are not registered.
Registration is easy and is done online at https://ico.org.uk/. For most organisations there is a £40 fee but it can vary
The ICO Registration number is a requirement of the DSP Toolkit and you cannot complete the Toolkit without it.
If you are registered but cannot find your ICO number you can search for it here https://ico.org.uk/esdwebpages/search
Data Privacy Policy
Click for detailsStaff Data Policy
Click for detailsData Register
Click for detailsStaff Bring Your Own Device Policy
Click for detailsAdditional Information Needed for Standards Met
To complete the Toolkit to Standards Met you will also need the following:
- A Training Needs Analysis of Data Protection/Security needs
- Systems Administers need to sign an agreement holding them to higher standards
- A document highlighting any unsupported software you use and the business need and risk (if you have unsupported software)
Make sure you have the information stated above to hand before you begin the assessment questions as this will save you a lot of time.
Completing the Assessment
The Toolkit comprises a list of 43 questions.
You will initially be presented with 26 questions. These are referred to as the Approaching Standards questions. If you have previously completed to Entry Level these will need to be checked to ensure they are still current. Approaching Standards questions are confusingly marked as Mandatory but the full list of questions is required to be completed to get to Standards Met.
You cannot publish at Approaching Standards unless you upload an action plan on how you plan to address the issues stopping you from publishing at Standards Met The action plan is provided as a downloadable spreadsheet from the DSPT assessment page and identifies the additional evidence required.
To complete to Standards Met you will need to complete a further 17 questions using the information you have collected above.
Once you have done this successfully you can publish your Toolkit.
Once published the Toolkit results are normally valid for 12 months. The current DSPT toolkit year will run until 30 June.
What are the benefits?
Once you have completed the DSPT you can potentially have access to these NHS services:
- NHS Mail – allows you to exchange information with other parts of the health service such as GPs and Pharmacies securely and quickly. It includes Microsoft Teams video conferencing which is being used by doctors to do virtual consultations when they are unable to visit the home.
- Proxy Access – with proxy access you can order medication on behalf of your service users.
- Improved service to Patients and Residents through enabling the home to manage their resident’s repeat medications more effectively.
- Creates a more effective working relationship between the GP practice and the care home.
Impact of Cyber Crime
Please see some more information on the impact of cyber crime here.
Contact Us
If you need help you can contact us at SCHHServicedevelopment@centralbedfordshire.gov.uk
