The Data Security and Protection Toolkit (DSPT) is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards.
All organisations that have access to NHS patient data and systems must use this toolkit to provide assurance that they are practicing good data security and that personal information is handled correctly.
Moore ClearComm has been supporting care providers with their DSPT, in a project management capacity, since 2020, with outstanding levels of success. In addition, we work closely with NHS Trusts, Integrated Care Boards (ICB, formerly Clinical Commissioning Groups CCG) and regional care provider associations – either via funded 121 support or in group workshop settings – to raise DSPT publication levels as well as increasing care provider awareness of their data protection and cyber security responsibilities, and the most effective ways to reduce their risk.
NHS DSPT Project Management
Working on a one-to-one basis, our expert team takes full ownership of the care homes` NHS DSPT project, working within the online assessment as the Administrator, leading “live” project sessions (Teams or Zoom) and taking a “Plain English” approach in respect of all communication (email, telephone, and meetings).
Our objective is to lead care homes through to a successfully published NHS Data Security & Protection Toolkit to (initially) Approaching Standards, and then to Standards Met, with minimal impact on their time and workload – while maintaining a firm sense of client ownership of the project.
| Onboarding | Our consultant will meet with the client to set the scene and explain how the process will work over the coming weeks. During this “live” session on Teams/Zoom we will guide the care home through both DSPT registration process and setting Moore ClearComm up as the Admin within DSPT online assessment. |
| Project Meetings | We will host (at least) two “live” project meetings (Teams/Zoom) to work through the Mandatory evidence items within the DSPT. In advance (usually 7 days+) our Consultant will provide a plain-English list of questions/information that will be covered during the next project meeting, to ensure the client has time to prepare |
| Polices & Procedures | Many of the Mandatory requirements with DSPT come with the need to attach evidence, usually in the form of policies and/or procedures. If the client does not yet have these in place, we will create them (bespoke) as a core provision with the project delivery. |
| Liasing with IT Providers | Where there is a need to gather information in respect of IT set up and technical controls, our Consultant will liaise with advanced notice, and permission given by the client. |
| Publication | When all Manadatory requirements have been met our Consultant will conduct a full review of the DSPR, before publishing the assessment – and then sending confirmation to the client. |
NHS DSPT Workshops
Working directly with NHS Trusts, Integrated Care Boards (ICB, formerly Clinical Commissioning Groups CCG) and regional care provider associations, Moore ClearComm can deliver on-site workshops – specifically designed to achieve the following outcomes:
- Support care providers to progress as far as possible, with their DSPT, on the day
- To host and deliver a workshop that adds value beyond the immediate and specific requirements of the DSPT, and focuses on raising awareness of data protection and cyber security – from the health and social care perspective
- For care providers to leave at the end of the day feeling happy and more confident in their NHS DSPT journey, and to have gained valuable insights and practical guidance that they can implement in the care environment
- To provide follow up virtual meetings, on a one-to-one basis, with each attendee – based on the objective of supporting them through the DSPT process, to a successfully published toolkit
The workshops rely on some key factors in order to ensure their viability and success potential, with the following table showing an example workshop day:
| Venue | Modern and suitable for accommodating groups of 5 to 20 attendees. |
| Schedule | 09:30 to 16:00 |
| Connectivity | A high speed internet connection, with multiple users able to work online at the same time. |
| NH DSPT Progress | Every attendee to have in place/bring with them on arrival: – their NHS DSPT registered – their NHS DSPT log-in details – required evidence documents for upload to the NHS DSPT |
| Pre-Event Resources | We ask each attendee to collate key “technical” information prior to the event, as a range of DSPT requirements require technical responses (usually required from their IT team or managed service provider) in advance of the on-site event. |
| Pre-Event Webinar | We invite each attendee to join us in a live webinar, usually 1 week prior to the onsite event, as this allows the opportunity for them to: • ask general questions or share concerns • request support if they need to register their NHS DSPT • make us aware of any specific requirements within the NHS DSPT that either concern them or might not be achievable The pre-event webinar also includes an overview of how the workshop schedule, and for the Moore ClearComm team to introduce themselves and easy any general concerns that the care providers may have. |
| Post-Event Support | We provide post event (usually 2-3 weeks afterwards) 1-2-1 support sessions, via Teams or Zoom, for each workshop attendee – designed to support them through any remaining Mandatory Evidence Items – and to a published NHS DSPT |
Feedback from Integrated Care Boards (ICBs):
- Unanimous positive views expressed about the day and its usefulness to them
- All found it extremely helpful to have a day away from the office (where they can be distracted) ‘I open it [DSPT] up and then something happens and I don’t look at it again for 6 months’
- All said it was really helpful to be with others and the discussions this generated
- It was clear that they all ‘got’ the way DSPT impacted their business, if not at the start then definitely by the end – I think the context given by the Moore ClearComm team, and the practical examples, were key in achieving this
- One commented it was better because everyone was an independent provider and they are very different from national providers
Feedback from workshop attendees:
“The support has been amazing. The DSPT is daunting and this gives you the idea of what to do”
“It has been useful and focused the mind”
“I came here petrified. I feel so much better now. I’d be lost without it [the day]”
“The more you know the importance of this the more you want to know and put the best system in place to protect them [those cared for]”
“I’ve done more in a day than in 2 years”
