NHS & HealthTech Assurance
Turn fragmented safety, privacy, security and procurement requirements into one defensible assurance position.
IG-Smart helps digital-health suppliers and health and care organisations understand what applies, close assurance gaps and build the evidence needed for safer deployment, NHS procurement and continuing oversight.
From DTACThe Digital Technology Assessment Criteria — a common NHS approach for assessing digital-health technologies across clinical safety, data protection, technical security, interoperability, and usability and accessibility. and digital clinical safety to DSPTThe Data Security and Protection Toolkit — organisational assurance over data security and information governance. It does not substitute for product-specific assessment., privacy, cyber security and procurement evidence, we connect the requirements instead of treating each as a separate compliance exercise.
HealthTech governance consultancy helps digital-health suppliers and healthcare organisations identify, manage and evidence the safety, privacy, cyber, clinical and procurement requirements that affect NHS adoption and use. IG-Smart connects requirements such as DTAC, DCB0129The NHS standard for clinical risk management in the manufacture of health IT systems — it applies to suppliers and manufacturers., DCB0160The companion standard for clinical risk management by health and care organisations deploying and using health IT. Related to DCB0129, but not interchangeable. and relevant NHS assurance into a coherent evidence and governance programme.
When organisations engage us
The product is ready, but the assurance position is fragmented or incomplete.
Responses exist, but supporting evidence or controls need strengthening.
DCB0129, DCB0160, hazard management or CSO capability is required.
Evidence needs prioritising without creating unsupported claims.
The care organisation must assess supplier evidence and local clinical risk.
New functionality, integrations, AI or context may affect existing assurance.
Teams need one view of overlapping safety, privacy, cyber and procurement requirements.
Leadership needs to see what is complete, outstanding and accepted as residual risk.
What we help solve
Organisations rarely struggle because documentation is missing. More often:
The underlying issue
The problem is rarely one missing document. It is fragmented assurance across requirements that depend on each other.
A DTAC response, safety case or DSPT return has more value when it reflects a functioning governance system rather than a procurement deadline.
What the engagement involves
Prepare evidence across the relevant DTAC domains and close gaps before NHS buyer scrutiny.
Assess existing evidence against DTAC expectations and convert gaps into a prioritised remediation plan.
Coordinate privacy, clinical safety, cyber, governance and other relevant assurance requirements around the technology and its intended deployment.
Prepare buyer-ready evidence for NHS tenders, procurement reviews, due diligence and assurance questions.
Strengthen the clinical-risk management processes, governance and evidence supporting safer digital-health development and deployment.
Support manufacturers and suppliers with proportionate clinical-risk management and DCB0129 evidence.
Support health and care organisations with clinical-risk governance when deploying and using health IT.
Provide access to specialist Clinical Safety Officer capability for clinical-risk management, hazard review, safety evidence and governance.
HealthTech assurance map
Digital health technology
DCB0129 / DCB0160 where applicable
UK data-protection requirements, DPIAs, information governance
Technical security, supplier assurance, relevant DSPT / NHS requirements
Standards, integration, data exchange and implementation dependencies
User needs, accessibility and safe practical use
DTAC responses, tender evidence, assurance packs and remediation
Where intended purpose brings the product within applicable regulation
Where AI or algorithmic functionality adds governance, safety or regulatory considerations
Two assurance pathways
Supplier and deploying-organisation obligations are related, but not interchangeable.
Typical questions
Typical questions
DTAC
The Digital Technology Assessment Criteria provide a common approach for assessing digital-health technologies across five areas:
DTAC is an assessment framework, not an accreditation badge. Completing a response does not remove the need to determine which underlying legal, clinical, security or organisational requirements apply.
Digital clinical safety
01Supplier / developer
Clinical risk management in the manufacture and development of health IT systems. Relevant evidence may include:
03Deploying NHS / care organisation
Clinical risk management when health and care organisations deploy and use health IT systems. Relevant areas may include:
Supplier clinical-safety evidence does not automatically discharge the deploying organisation's own clinical-risk responsibilities.
Organisational assurance
The Data Security and Protection Toolkit is organisational assurance. It does not substitute for product-specific DTAC or clinical-safety work.
The CAFThe NCSC Cyber Assessment Framework — a structured set of cyber-security and resilience outcomes used to assess organisations.-aligned DSPT integrates cyber-security and information-governance outcomes for relevant health and care organisations. Not every HealthTech supplier is assessed through the same process as an NHS trust.
The DSPT continues to evolve, including expectations on resilience, essential-function scoping and recovery. The relevant model depends on organisation type and current NHS requirements.
NHS procurement readiness
NHS and health-sector buyers may require evidence across several disciplines during procurement or onboarding.
The objective is not polished answers that cannot be evidenced. It is to make the underlying assurance position procurement-ready.
A buyer-ready pack may draw from
Regulatory intersections
Some software and AI used in health and care may qualify as medical devices, depending on intended purpose and classification rules. Where relevant, medical-device regulation sits alongside — not in place of — NHS assurance such as DTAC or clinical safety. Definitive classification requires appropriate specialist expertise.
MHRA: software and AI as a medical device (opens in a new tab)
NICE's Evidence Standards Framework for digital health technologies may be relevant to developers, evaluators and commissioners assessing effectiveness and value. Meeting it does not mean NICE endorsement or regulatory approval.
AI-enabled HealthTech may raise further questions around:
AI governance should integrate with clinical safety rather than run as a separate policy exercise. See AI Governance & Assurance.
Operating model
The objective is not another committee. It is ensuring each requirement has an accountable owner and that material risks converge into one decision-making process.
How we deliver
Identify the technology, intended use, deployment context, applicable assurance requirements, existing evidence, accountable owners and material gaps.
Develop the governance, safety, privacy, cyber, procurement and evidence components needed to address the agreed scope.
Coordinate assurance activity, evidence ownership, risks, actions, governance cadence and changes across relevant disciplines.
Review whether requirements and controls are sufficiently evidenced and whether outstanding risks are clear to decision-makers and buyers.
Close findings, update evidence and adapt the assurance position as the technology, deployment and NHS requirements change.
Improvement feeds the next assessment cycle, keeping HealthTech evidence current rather than rebuilding it for every procurement exercise.
What you receive
Depending on product, role, deployment and scope, outputs may include:
Scope
Where the requirement needs specialist medical-device, legal, clinical or technical expertise beyond the agreed IG-Smart scope, the appropriate delivery model is identified during scoping and responsibilities are made explicit in the proposal.
Relevant evidence
Published engagements involving national NHS information governance advice, DSPT readiness and health and care data governance.
Public Sector, Information Governance · Data Privacy & DPO
NHS England
A national health body needed privacy embedded in digital transformation, new care models and national publications.
Read the case studyHigher Education / Research, Information Governance · NHS & HealthTech
UCL
A research-intensive school handling sensitive health data needed to understand its readiness for the NHS Data Security and Protection Toolkit.
The client reports the audit report helped shape and focus its final DSPT submission.
Read the case studyHealthcare / NHS, Information Governance · NHS & HealthTech
South West London Better Care Fund
Health organisations and local authorities across South West London needed a common, lawful basis for sharing care records.
Read the case studyCommon engagement models
Defined-scope DSPT or DTAC readiness work: gap assessment, evidence review and a prioritised plan. IG-Smart does not award NHS approval or DTAC certification.
Suits
Suppliers and care organisations preparing for NHS procurement or annual assurance.
Support with DCB0129 or DCB0160 clinical-risk management and evidence, scoped to the product or deployment.
Suits
Manufacturers and deploying organisations that need proportionate clinical-safety evidence.
Ongoing governance support or an independent review of the assurance position across DSPT, DTAC, clinical safety and data protection.
Suits
Organisations that need continuing senior support or an independent view before a key decision.
Typical investment
Starting investment: £7,500 + VAT
Typical investment: £10,000–£25,000+ + VAT
Model: Defined-scope engagement
Starting investment: £7,500 + VAT
Typical investment: £7,500–£10,000 + VAT
Depending on scope and existing evidence
Model: Defined-scope engagement
Scope, deliverables, assumptions and fees are agreed in writing before work begins. What changes the fee is set out on the investment page; the exact fee is confirmed after scoping.
How engagements and investment workFAQ
NHS and regulatory references reviewed September 2026. This page is reviewed every 3 months.
Discuss a HealthTech assurance requirement
Whether the requirement starts with DTAC, clinical safety, NHS procurement, deployment assurance or several overlapping frameworks, begin with the evidence and decisions you need to demonstrate.
