Changes to DSPT guidance for E3.a and E4.a and Audit guidance for Objective E

The DSPT team have made some changes to the guidance for E3.a and E4.a to provide a steer for auditors on the information they need to request from organisations and to provide practical guidance on how organisations could reasonably comply with the DSPT requirements. We have revised the DSPT general guidance and audit guidance to provide a practical steer on all these areas.

Ideally we would not amend guidance mid-year but wanted to address the issues raised by NHS organisations and auditors.

Summary of all changes

Amendments to CAF Independent Assessment Framework

Objective E, E3.a Information sharing for direct care
- Wording for a) and b) under step 1 of ‘E3.a Information sharing for direct care’ changed to provide more straightforward information about what auditors should assess.

A statement about how organisations who have assessed all their organisation’s uses of information and determined that none of the uses are relevant to direct care should respond on the DSPT.

E4.a Managing records
- Step 3 ‘Records at the end of retention period’ and Step 6 ‘Retention disposal process’ have now been combined into Step 3 ‘Appraisal process’ which outlines the approach we have discussed as being practical and sensible for organisations to follow for appraisal and removal, leaving less room for ambiguity.
- Step 5 ‘Record keeping system’ relates to having some evidence beyond a records management policy to show how crucial elements of the records management policy are being practically applied by organisations. The text has been revised following our discussion to make what the DSPT is looking for more narrowly focused and straightforward than asking for a “sample” of the organisation’s “record keeping system”.

24-25 CAF-aligned DSPT guidance - Outcome E4.a

New section added on Record locations - Explains what organisations can do to prevent misfiles (reflecting our conversation regarding initial concerns about misfiles in November 2024).

New section added on Records appraisal - Outlines the reasonable efforts approach to records appraisal which we discussed with frontline colleagues and agreed would be more practical.

New section added on Records disposal - Clarifies that disposal could mean a wider range of things than just permanent deletion.

New ‘interpreting indicators of good practice’ definition added - Provides reassurance that organisations will not fail on account of NA.1 due to simple human error – it’s about taking action where organisations become aware of records held in incorrect locations.

A statement about how auditors should audit organisations who have assessed all their organisation’s uses of information and determined that none of the uses are relevant to direct care.

Where can the changes be seen?

The changes have been reflected in the guidance at https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/2024-25-caf-aligned-dspt-guidance.

To show the specific changes clearly, we have uploaded a tracked changes version in a Word format to show the changes. An email highlighting this change to guidance is being sent out to DSPT administrators and auditors for NHS Trusts, CSUs, ICBs and ALBs.

Thanks
DSPT Team