Cyber Essentials for NHS and healthcare suppliers

If you sell to the NHS or handle patient data, you may need Cyber Essentials, Cyber Essentials Plus, the Data Security and Protection Toolkit, or all three.

Cyber Essentials in NHS contracts

Government procurement policy (PPN 014, which replaced PPN 09/23 and 09/14) applies to NHS bodies as well as central government. It lets buyers require Cyber Essentials or Cyber Essentials Plus where a contract involves handling personal data or providing certain IT services. Many trusts and integrated care boards now ask for Cyber Essentials Plus for suppliers with access to NHS systems or patient data.

The Data Security and Protection Toolkit (DSPT)

• The DSPT is an online self-assessment that organisations with access to NHS patient data and systems must complete each year. It's a requirement of the NHS Standard Contract.
• The annual submission deadline is 30 June.
• Larger suppliers (generally 50+ staff and £10m+ turnover) fall into a category that needs an independent audit.
• Holding Cyber Essentials doesn't exempt you from the DSPT, but a lot of the evidence overlaps, so do them together.

Who this applies to

• Software and IT suppliers, including small health-tech firms.
• Care providers, pharmacies, dental and optical practices with access to NHS systems.
• Any supplier processing NHS patient data under contract.

Where to start

1. Check the tender or contract for exactly what's required: Cyber Essentials, Plus, DSPT status, or ISO 27001.
2. Get Cyber Essentials first. It's quick and underpins the rest.
3. Book the Plus audit within three months, if it's required.
4. Register for the DSPT early. Don't leave it until June.