NHS DTAC Compliance: Documentation Requirements for Health Tech

If you're selling a digital health tool to the NHS, you need to pass the Digital Technology Assessment Criteria (DTAC). DTAC is the baseline assessment framework that NHS organisations use to evaluate whether digital health technologies meet minimum standards for clinical safety, data protection, technical security, interoperability, and usability.

Without DTAC compliance, your product won't appear on the NHS Digital Health Technology Catalogue, and most NHS trusts and Integrated Care Boards (ICBs) won't procure it. DTAC isn't optional — it's the gateway to the NHS market.

The assessment is documentation-heavy. You must evidence compliance across five domains with specific documents, certifications, and test results. Many health tech companies — particularly startups — underestimate the documentation burden and fail their first DTAC submission because of missing or incomplete evidence, not because their technology is inadequate.

What DTAC Assesses

The Five Domains

Clinical Safety (DCB 0129)

DCB 0129 is the clinical risk management standard for manufacturers of health IT systems. It requires:

Clinical Risk Management System:

• Documented approach to clinical risk management
• Named Clinical Safety Officer (CSO) — must hold a clinical qualification
• Clinical risk management process integrated into your development lifecycle
• Clinical risk management plan for each product

Clinical Safety Case Report:

• Description of the system and its intended clinical use
• Hazard identification and risk assessment
• Risk evaluation against the hazard risk matrix
• Risk mitigation measures
• Residual risk summary and acceptance

Hazard Log:

• Register of all identified clinical hazards
• Risk rating (likelihood × severity) for each hazard
• Mitigation measures for each hazard
• Residual risk after mitigation
• Status tracking (open, mitigated, accepted, closed)

Common failure: Companies without a clinically qualified CSO, or hazard logs that don't cover all clinical use cases. The CSO must be a registered healthcare professional with appropriate clinical experience — a software engineer cannot fulfil this role.

Data Protection

DTAC requires comprehensive UK GDPR compliance documentation:

Common failure: DPIAs that are generic templates rather than specific to the product's data processing. NHS reviewers expect DPIAs that describe the actual data flows, the specific health data processed, the specific risks of the particular technology, and the specific mitigation measures.

Technical Security

Common failure: Penetration test reports that cover the company's general infrastructure but not the specific product being assessed. DTAC requires testing of the product itself.

Interoperability

The NHS has specific data standards requirements:

Common failure: Products that use proprietary data formats without FHIR capability, or that record clinical terms in free text rather than coded SNOMED CT concepts.

Usability and Accessibility

Common failure: Companies that claim WCAG compliance based on automated scanning alone. DTAC reviewers expect evidence of manual accessibility testing, including testing with assistive technologies.

Where Health Tech Companies Fail DTAC

1. No Clinical Safety Officer

DCB 0129 requires a named CSO with clinical qualifications. Startups without a clinically qualified team member need to appoint an external CSO — and this person must be genuinely involved in the clinical risk management process, not just a name on a document.

2. Incomplete Hazard Logs

Hazard logs that:

• Only cover obvious hazards (system downtime) but miss clinical hazards (incorrect dosage calculation, misidentification of a patient)
• Don't cover all clinical use cases
• Don't include residual risk after mitigation
• Haven't been reviewed after product changes
• Don't use the DCB 0129 risk matrix correctly

3. Generic DPIAs

DPIAs copied from templates that don't describe the specific product:

• No data flow diagram specific to the product
• Risks assessed generically, not for the specific health data processed
• Mitigation measures not specific to the product's architecture
• No consideration of special category health data risks
• No consultation with the DPO or data subjects

4. Expired Certifications

Cyber Essentials Plus certificates that expired before the DTAC assessment, or penetration test reports that are older than 12 months. DTAC requires current, valid evidence.

5. Missing Interoperability Evidence

Products that claim FHIR compliance but can't demonstrate it with:

• A FHIR conformance statement
• API documentation showing FHIR resources supported
• Test results from FHIR conformance testing
• Evidence of SNOMED CT coded data where clinical terms are used

Building a DTAC Preparation Process

Step 1: Gap Analysis

Map your current documentation against every DTAC requirement:

Step 2: Prioritise by Domain

1. Clinical Safety — most common reason for DTAC failure; requires specialist input (CSO)
2. Data Protection — extensive documentation needed; DPIAs take time to do properly
3. Technical Security — certifications and pen tests have lead times (4-8 weeks for Cyber Essentials Plus, 2-4 weeks for pen testing)
4. Interoperability — technical work may be needed if FHIR isn't implemented
5. Usability — accessibility testing can often be conducted relatively quickly

Step 3: Create Evidence Packs per Domain

Organise your evidence into domain-specific packs, each containing all required documents:

Clinical Safety Pack:

• Clinical Risk Management System document
• Clinical Risk Management Plan (product-specific)
• Clinical Safety Case Report
• Hazard Log (current version)
• CSO appointment letter and qualifications
• Evidence of clinical risk management process in SDLC

Data Protection Pack:

• DPIA (product-specific)
• Data flow diagrams
• Records of Processing Activities
• Privacy notice
• Data processing agreements
• International transfer documentation (if applicable)
• Breach notification procedure

Technical Security Pack:

• Cyber Essentials Plus certificate (current)
• Penetration test report (within 12 months)
• Security architecture document
• Vulnerability management policy
• Incident response plan

Step 4: Implement Ongoing Maintenance

DTAC isn't one-and-done. You need to maintain compliance:

Using AI to Review DTAC Documentation

What AI Can Check

• Completeness — verify each evidence pack contains all required documents and elements
• Consistency — cross-reference data flows in the DPIA against the security architecture document
• Currency — flag expired certifications, outdated references, and stale dates
• Hazard log quality — check that hazards are described specifically, risk ratings use the correct matrix, and mitigation measures are documented
• DPIA quality — check that the DPIA is product-specific (not a generic template), covers all data flows, and includes specific risk mitigation
• Terminology — verify correct use of NHS and DCB terminology

What AI Cannot Replace

• Clinical safety assessment requiring healthcare professional expertise
• Penetration testing and security assessment
• Accessibility testing with assistive technologies
• FHIR conformance testing
• Clinical judgement on hazard severity and likelihood
• NHS reviewer assessment of overall compliance

Practical Example

In TeamBench, you could configure a reviewer for DTAC documentation:

Reviewer name: NHS DTAC Documentation Reviewer

System prompt:

You are a DTAC documentation reviewer for NHS digital health technology assessments. Review clinical safety documentation (DCB 0129), DPIAs, security architecture documents, and interoperability evidence against DTAC requirements. For clinical safety: check that the hazard log covers all clinical use cases, risk ratings use the DCB 0129 matrix correctly, mitigation measures are specific, and residual risk is documented. For data protection: check that the DPIA is product-specific (not a generic template), covers all data flows, identifies specific risks for health data, and includes specific mitigation measures. For security: check that evidence is current and covers the specific product. Flag generic or template-based content that hasn't been customised to the specific product. Use British English.

Evaluation criteria:

• Completeness (weight: 3) — All DTAC-required elements present per domain
• Specificity (weight: 3) — Documentation is specific to the product, not generic templates
• Currency (weight: 2) — Certifications valid, evidence recent, references current
• Consistency (weight: 2) — Information aligns across documents and domains
• Quality (weight: 1) — Well-structured, clearly written, professionally presented

Quality gate: Minimum score: 85.

Upload DCB 0129, DTAC criteria documentation, and NHS interoperability standards into a Knowledge Base.

Frequently Asked Questions

Is DTAC mandatory for selling to the NHS?

DTAC is the baseline assessment that most NHS organisations use when procuring digital health technologies. While it's not legally mandated for all procurements, most NHS trusts and ICBs require DTAC compliance as a procurement condition. Without it, your product won't appear on the NHS Digital Health Technology Catalogue, effectively blocking NHS sales.

How long does DTAC preparation take?

For a well-prepared company with most technical requirements already met: 2-4 months for documentation preparation. For companies starting from scratch (no CSO, no Cyber Essentials, no DPIA): 4-8 months. The longest lead items are typically CSO appointment and clinical safety case development, Cyber Essentials Plus certification, and penetration testing.

Do we need a Clinical Safety Officer?

Yes — DCB 0129 requires a named CSO with clinical qualifications (a registered healthcare professional). If you don't have a clinically qualified team member, you'll need to contract an external CSO. The CSO must be genuinely involved in clinical risk management, not just a token appointment.

What version of Cyber Essentials do we need?

Cyber Essentials Plus (not basic Cyber Essentials). Plus includes an external vulnerability assessment and internal security testing, which provides a higher assurance level. The certificate must be current (valid) at the time of DTAC assessment.

How specific does the DPIA need to be?

Very specific. A generic DPIA template that hasn't been customised for your product will fail. The DPIA must describe your specific data flows, the specific types of health data your product processes, the specific risks arising from your product's architecture and use cases, and the specific technical and organisational measures you've implemented to mitigate those risks.

Do we need HL7 FHIR compliance?

If your product exchanges clinical data with NHS systems, FHIR compliance is expected. The NHS is moving toward FHIR as the standard for health data exchange. Even if FHIR isn't strictly required for your initial DTAC assessment, implementing it strengthens your submission and positions your product for broader NHS adoption.

What happens after DTAC approval?

DTAC approval is the baseline — it opens the door to NHS procurement. Individual NHS organisations may have additional requirements. You'll also need to maintain compliance: keep certifications current, update clinical safety documentation after product changes, and review your DPIA when data processing changes.

Can we self-assess against DTAC?

Yes — DTAC is designed as a self-assessment that NHS organisations then verify. You complete the assessment, provide the evidence, and NHS reviewers evaluate your submission. Self-assessment gives you the opportunity to identify and close gaps before formal submission.

Key Takeaways

• DTAC is the gateway to selling digital health tools to the NHS. Without it, most NHS trusts and ICBs won't procure your product.
• Five domains are assessed: clinical safety (DCB 0129), data protection (UK GDPR), technical security (Cyber Essentials Plus), interoperability (FHIR, SNOMED CT), and usability/accessibility (WCAG 2.1 AA).
• Clinical safety is the most common failure point. You need a qualified CSO, a product-specific clinical safety case, and a comprehensive hazard log.
• Generic template documentation fails. DPIAs, clinical safety cases, and security documents must be specific to your product — not off-the-shelf templates.
• Certifications have lead times. Cyber Essentials Plus takes 4-8 weeks. Penetration testing takes 2-4 weeks. Start early.
• Gap analysis first — map your current documentation against every DTAC requirement before starting preparation.
• DTAC isn't one-and-done. Maintain compliance with ongoing reviews: hazard log updates after product changes, annual pen tests, annual Cyber Essentials renewal.
• AI-assisted review can check completeness, specificity, currency, and consistency across your evidence packs, but cannot replace clinical safety assessment, security testing, or accessibility testing.

---

This article provides general information about NHS DTAC requirements and is not regulatory or clinical safety advice. Always consult NHS Digital for current DTAC criteria and seek specialist advice for clinical safety (DCB 0129) compliance.