Review-control catalogue
Review-control catalogue
How to interpret the rows
GP-xxx identifiers are local review identifiers invented for this pack, never official DSIC clause IDs. The official reference column preserves verified identifiers where available. A grouped row may require several evidence links; split it into child findings if conclusions differ.
| Basis code | Meaning |
|---|---|
| M | Mandatory requirement identified in the cited baseline, subject to applicability and exact modal/conditional wording; source-verification depth is recorded separately |
| S | Verified SHOULD; departure needs contextual justification, not automatic failure |
| O | Verified optional MAY capability/Epic; mandatory only if selected/contracted or otherwise applicable |
| F | Family-level coverage check: source identified, exact normative subclauses not reproduced/fully verified |
| G | Guidance-based review topic; not independently a mandatory DSIC clause |
| R | Original engineering/safety review recommendation; do not report as a national mandate |
| D | Draft/future change; watch-list only unless separately adopted |
Short summaries preserve the subject of the requirement; scope, exceptions and proof must be considered through product and deployment context, standards baseline, finding rules and the source register. A source-level M row is not proof of applicability to every product.
Clinical safety governance and lifecycle
Owner tags: SPL supplier/manufacturer; DEP deploying health organisation; BOTH coordinated responsibilities with separate evidence.
| ID | Basis | Owner | Official reference | Screening summary | Source |
|---|---|---|---|---|---|
| GP-001 | M | SPL | S25 GP-08.4.3.01 | DCB0129 safety evidence must support deployer assessment. | 004 |
| GP-002 | M | SPL | DCB0129 §§2.1–2.4 | Document risk process; resource competent staff and CSO. | 036 |
| GP-003 | M | SPL | DCB0129 §2.5 | Assess incorporated third-party products. | 036 |
| GP-004 | M | SPL | DCB0129 §§3.1–3.6 | Maintain safety documents and required CSO approvals. | 036 |
| GP-005 | M | SPL | DCB0129 §§4–5 | Define scope, analyse hazards and evaluate initial risks; preserve individual SHOULD wording and §5.1.2. | 036 |
| GP-006 | M | SPL | DCB0129 §§6.1–6.2; §5.1.2 | Where applicable, evaluate controls, residual risks and benefit; preserve conditional triggers and §6.2.2 SHOULD. | 036 |
| GP-007 | M | SPL | DCB0129 §6.3; §5.1.2 | Where applicable, implement assigned controls and verify implementation and effectiveness. | 036 |
| GP-008 | M | SPL | DCB0129 §§6.4–7 | Review completeness, release configuration, incidents and modifications. | 036 |
| GP-009 | M | DEP | DCB0160 §§2.1–2.4 | Establish local process, competence, CSO and management accountability. | 037 |
| GP-010 | M | DEP | DCB0160 §§2.5–2.7 | Obtain supplier assurance; assess third parties; review process. | 037 |
| GP-011 | M | DEP | DCB0160 §3 | Maintain deployment safety documents and approved log/case versions. | 037 |
| GP-012 | M | DEP | DCB0160 §§4–6 | Assess local risks and applicable controls; preserve §5.1.2 exception and individual MUST/SHOULD wording. | 037 |
| GP-013 | M | DEP | DCB0160 §2.2.2; §7 | Authorise deployment accepting residual risk; monitor lifecycle changes. | 037 |
| GP-014 | G | BOTH | Implementation guidance, Hazard Log sections | Identify transferred controls and preserve evidence/action traceability. | 038, 039 |
| GP-015 | R | BOTH | Pack design | Link each control to its precise cause and implementing organisation. | concept design |
| GP-016 | R | BOTH | Pack design | Challenge “closed” hazards with unimplemented or unverified controls. | finding rules |
Manufacturer and deployer safety files remain separate even when coordinated. The supplier's safe-use assumptions are inputs to local analysis. For locally adapted software or a newly assembled system, assess whether the organisation also takes on manufacturer responsibilities; do not decide by the organisation's job title alone 034, 035.
DCB interpretation: Grouped M rows include distinct clauses; preserve each clause's modal wording and trigger. In both specifications §4.1.2 multidisciplinary analysis and §6.2.2 reappraisal use SHOULD. Under §5.1.2, §§6.1–6.3 do not apply to a hazard whose initial risk is acceptable against the approved criteria. Require the underlying assessment and retain completeness/acceptance duties; an unexplained low score is insufficient 036, 037.
Applicability route: Record statutory and contractual routes separately from internal MUST clauses. SI 2025/807 regulation 3 saves the earlier statutory framework for standards effective before 7 July 2025; this is not a blanket private-sector or Defence exemption. Inspect the applicable notice, recipient, commissioning and contract. Later notices must specify duty wording and dates under SI 2025/950 regulation 6 079, 083, 084.
Integrity, access, audit and record amendment
S30 summaries use the live canonical v7.0.0 baseline. Historical product baselines may retain earlier requirement IDs; do not silently apply a newer baseline to a past assessment. The clinical consequences and proposed tests are developed separately in the hazard scenarios.
| ID | Basis | Official reference | Screening summary | Source |
|---|---|---|---|---|
| GP-020 | M | S30 v7.0.0 GP-IG-2.3-1; 2.3-1A; 2.3-2; 2.3-3 | Apply the specified NHS authentication/identity route and assurance levels; govern alternatives and step-up authentication. | 005 |
| GP-021 | M | GP-IG-3-2; 3-8; 3-17 | Enforce role/context-specific access rights. | 005 |
| GP-022 | M | GP-IG-10-1 | Retain author, entry and organisational provenance. | 005 |
| GP-023 | M | GP-IG-10-2 | Link incoming documents and derived local entries. | 005 |
| GP-024 | M | GP-IG-11-1; 11-3 | Mark prior-entry logical deletions; retain reconstruction. | 005 |
| GP-025 | M | GP-IG-11-4 | Control exceptional physical deletion through supplier governance. | 005 |
| GP-026 | M | GP-IG-12-1; 12-5 | Identify changes, actors, times and associated events. | 005 |
| GP-027 | M | GP-IG-12-2B | Audit external exchanges. | 005 |
| GP-028 | M | GP-IG-12-3 | Reconstruct prior records, except authorised physical deletion. | 005 |
| GP-029 | M | GP-IG-12-4 | Permit authorised audit interrogation. | 005 |
| GP-030 | M | GP-IG-12-7; 12-8 | Protect audit integrity; prevent disabling. | 005 |
| GP-031 | M | GP-IG-12-9; 12-10; 12-13 | Back up, retain and link archived audits. | 005 |
| GP-032 | M | GP-IG-13-1; 13-3; 13-4 | Govern specified notifications, warning/alert levels and Privacy Officer review, including the stated notification timing. | 005 |
| GP-033 | M | GP-IG-14.2-2 | Protect stored records and logs against unauthorised modification. | 005 |
| GP-034 | M | GP-IG-15.8 | Support subject-access disclosure, including linked historical data. | 005 |
| GP-035 | G | NHS amendment guidance | Preserve readable original entries and explain retrospective correction. | 041 |
| GP-036 | M | GP Connect cross-organisation audit; adopted role/version | Audit successful/failed API activity with required identity and event context for the relevant provider/consumer role. | 033 |
| GP-037 | R | Pack design | Separate traceability, detection, notification and clinical acknowledgement. | hazard scenarios |
Data standards, terminology and reference integrity
| ID | Basis | Official reference | Screening summary | Source |
|---|---|---|---|---|
| GP-040 | M | S27 DS01; SCT11 | Apply NHS data definitions and NHS Number requirements. | 006 |
| GP-041 | M | SCT3.7; SCT3.1 | Support current UK SNOMED CT clinical coding. | 006 |
| GP-042 | M | GP-REF-2.1.2; 2.1.3 | Use prescribed legacy mappings; support corrected remapping. | 006 |
| GP-043 | M | GP-REF-2.1.8 | Preserve accessible code-mapping/migration audit history. | 006 |
| GP-044 | M | GP-03.1-01 | Use ODS organisational reference data. | 006 |
| GP-045 | M | MR2.4.01; SCT6 | Maintain required reference subscriptions and dm+d support. | 006 |
| GP-046 | M | DS03 | Deploy reference-data updates within eight weeks of release. | 006 |
| GP-047 | M | GP-03.2-09 | Prevent user amendment of national source reference data. | 006 |
| GP-048 | F | SCT1; SCT2; SCT8; applicable interface profiles | Check required classifications, AIDC, units and value sets. | 006, 013 |
| GP-049 | G | Data Safety guidance | Examine data properties across its processing lifecycle. | 040 |
| GP-050 | R | Pack design | Distinguish unknown, absent, negated, historical and resolved clinical facts. | hazard scenarios |
The data-safety guidance provides a lifecycle analysis method. Examine origin and meaning, correctness, completeness, consistency, continuity, format, precision, timeliness, availability, representation, order and destination. Also examine verifiability, priority, access restriction, suppression, history, lifetime and disposability. These are analysis dimensions rather than a new set of mandatory DSIC clauses. Apply them to imports, transformations, caches, presentation, storage and disposal. Data accessibility in this method is distinct from inclusive user-interface accessibility. A syntactically valid message can still convey clinically unsafe information 040.
Migration, continuity, hosting and operations
| ID | Basis | Official reference | Screening summary | Source |
|---|---|---|---|---|
| GP-060 | M | S26 DMI01 | Provide migration approach for source/target roles. | 007 |
| GP-061 | M | DMI02 | Supply interpretable Documented Data Extract. | 007 |
| GP-062 | M | DMI05 | Prepare source data to agreed quality. | 007 |
| GP-063 | M | DMI06 | Provide sample and final extracts, at minimum. | 007 |
| GP-064 | M | DMI07 | Securely transfer complete, usable records without undue flattening. | 007 |
| GP-065 | M | DMI27 | Meet applicable data-transfer cross-functional requirements. | 007 |
| GP-066 | F | Remaining S26 and migration-process obligations | Confirm reconciliation, acceptance, cutover and supplier handover detail. | 007 |
| GP-067 | R | Pack design | Compare patient-level clinical meaning, attachments and outstanding work after migration. | hazard scenarios |
| GP-070 | M | S24 BC-DR-1 | Maintain accountable continuity management with recovery objectives. | 008 |
| GP-071 | M | BC-DR-16 | Exercise business continuity at least annually. | 008 |
| GP-072 | M | BC-DR-16A | Test disaster recovery annually against RTO/RPO. | 008 |
| GP-073 | M | BC-DR-20 | Reconcile data collected or missed during disruption. | 008 |
| GP-074 | R | Pack design | Exercise clinical downtime, restoration and worklist reconciliation end to end. | hazard scenarios |
| GP-075 | F | S29 CH1.0 and cloud-risk process | Identify/classify data and assess hosting risks. | 009 |
| GP-076 | F | S29 hosting route | Identify cloud, colocation, provider or local hosting assurance boundary. | 009 |
| GP-077 | M | S29 SEC1.0, if applicable | Obtain restricted datacentre-security requirements and evidence. | 009 |
| GP-078 | R | Pack design | Assess network, identity, device and time-source failure dependencies. | hazard scenarios |
| GP-080 | M | S65 SM005/SM005a, as applicable | Follow applicable service-management documents. | 010 |
| GP-081 | M | SM006/SM006a, as applicable | Measure applicable service levels. | 010 |
| GP-082 | M | SM007/SM007a, as applicable | Manage planned downtime under relevant schedules. | 010 |
| GP-083 | F | S65 remaining requirements | Verify incident, change, problem and support obligations. | 010 |
| GP-084 | M | S63 GP-NFQ-RS-5 | Provide component-failure impact analysis. | 014 |
| GP-085 | M | GP-NFQ-RS-3 | Evidence resilience and data-integrity design. | 014 |
| GP-086 | F | S63 remaining question families | Check capacity/performance/dependency evidence for actual deployment. | 014 |
Hosting boundary: Public cloud is a preference within the cited framework, not proof that every record system must be internet-hosted. S29 says locally hosted services are not formally assured by the Catalogue/contracting vehicles and buyers must address the risks. Do not assume supplier cloud assurance covers a materially different closed-network deployment 009.
S26 concerns migration of multiple records between Catalogue/Contracting Vehicle solutions. It is distinct from individual GP2GP transfers. Its introduction excludes a migration where one or more participating solutions is not registered on the Catalogue or Contracting Vehicle; this does not remove an onboarding supplier’s obligation to demonstrate compliance. Other safety, information-governance and contractual duties still need separate applicability decisions 007.
DMI26 is explicitly labelled SHOULD for including applicable audit trails in extracts; DMI09 is MUST for agreed run-off access to source data and audit trails. Do not combine these as a single unqualified mandatory extract rule. Obtain the adopted contract and migration-process obligations where scope or wording differs 007.
Testing, training, interoperability and commercial continuity
| ID | Basis | Official reference | Screening summary | Source |
|---|---|---|---|---|
| GP-090 | M | S69 TEST-1 | Maintain organisational and project test processes. | 011 |
| GP-091 | M | TEST-2; TEST-3; TEST-4 | Plan, execute, manage and report testing. | 011 |
| GP-092 | M | TEST-ENV-1 | Supply applicable national-service assurance test instances. | 011 |
| GP-093 | R | Pack design | Trace safety controls to tests including fault and regression paths. | hazard scenarios |
| GP-094 | M | S28 TR-1.1, where exemption sought | Obtain Authority approval for training exemption. | 012 |
| GP-095 | M | TR-2.1; TR-2.2 | Use synthetic patient training data; retain supplier accountability. | 012 |
| GP-096 | F | S28 remaining training requirements | Confirm role-specific training plan, material and delivery evidence. | 012 |
| GP-097 | R | Pack design | Validate competence and practical safe use after workflow changes. | hazard scenarios |
| GP-100 | M | S32 ISNFR01 | Maintain directed interface-specification uplifts. | 013 |
| GP-101 | M | ISNFR03; ISNFR04 | Provide interface documentation and development/test mocks. | 013 |
| GP-102 | M | ISNFR06; ISNFR07 | Correct documentation discrepancies; provide equitable interface behaviour. | 013 |
| GP-103 | S | ASNFR01 | Make committed non-API changes available promptly through APIs. | 013 |
| GP-104 | M | ASNFR02 | Make committed API updates available through APIs in real time. | 013 |
| GP-105 | R | Pack design | Validate retries, duplicates, ordering, incomplete results and error visibility. | hazard scenarios |
| GP-106 | F | S31 catalogue/commercial rules | Review data access, interface licence and exit obligations. | 015 |
| GP-107 | R | Pack design | Keep contractual gaps separate unless a patient-harm pathway is identified. | finding rules |
Clinical record, documents and workflows
| ID | Basis | Official reference | Screening summary | Source |
|---|---|---|---|---|
| GP-110 | M | C9 E00409 | Support permitted document addition/viewing and integrity-preserving conversion. | 018 |
| GP-111 | M | C9 E00410 | Support document/patient matching and unmatching. | 018 |
| GP-112 | O | C9 E00411; E00412 | Manage document metadata and associated coding if selected. | 018 |
| GP-113 | O | C9 E00413 | Manage annotations if selected. | 018 |
| GP-114 | O | C9 E00418; E00419 | Compare documents/view previous versions if selected. | 018 |
| GP-115 | R | Pack design | Test attachment replacement separately from metadata, annotation and coding changes. | hazard scenarios |
| GP-116 | M | C13 E00163 | Manage patient registration lifecycle. | 019 |
| GP-117 | F | C13 patient identity/EPR functions | Examine demographic accuracy, matching and record presentation. | 019 |
| GP-118 | F | C13 citizen-service functions | Verify patient/proxy access configuration and identity workflows. | 019 |
| GP-119 | R | Pack design | Test duplicate records, mistaken merges, temporary patients and identifier changes. | hazard scenarios |
| GP-120 | M | C15 E00135; baseline U02 | Record consultation context and clinical information. | 020 |
| GP-121 | M | C15 E00137; E00138; U02 | Implement applicable ADR/Yellow Card and fit-note functions. | 020 |
| GP-122 | O | C15 E00139; U02 | Manage consultation templates if selected. | 020 |
| GP-123 | R | Pack design | Distinguish encounter time, entry time and retrospective amendment. | hazard scenarios |
| GP-124 | M | C14 E00092 | Provide dm+d-aligned prescribable items and relevant clinical information. | 021 |
| GP-125 | M | C14 E00093 | Manage prescriber type and applicable prescribing rights. | 021 |
| GP-126 | F | C14 medication/prescription functions | Verify acute/repeat, issue, change, cancellation and review workflows. | 021 |
| GP-127 | F | C14 warnings and decision-support scope | Confirm exact mandatory/optional warning baseline before judging absence. | 021 |
| GP-128 | R | Pack design | Test allergy, dose, strength, route, interactions, reconciliation and duplicate issuing. | hazard scenarios |
| GP-129 | R | Pack design | Distinguish prescribing, administration, dispensing, stock and historical medication states. | hazard scenarios |
| GP-130 | M | C11 E00148; E00149 | Create referral information and applicable e-RS requests. | 022 |
| GP-131 | F | C11 other selected referral integrations | Verify applicable community-pharmacy/referral payload requirements. | 022 |
| GP-132 | R | Pack design | Confirm urgency, destination, receipt, rejected referrals and follow-up ownership. | hazard scenarios |
| GP-133 | M | C5 E00219 | Manage booking, viewing, amendment and cancellation. | 023 |
| GP-134 | R | Pack design | Test cancellations, double bookings and cross-system appointment state. | hazard scenarios |
| GP-135 | M | C50 E00267 | Support task creation, viewing, amendment and deletion. | 060 |
| GP-136 | O | C50 E00269; E00270 | Assignment and overdue flagging are selected optional Epics. | 060 |
| GP-137 | R | Pack design | Trace clinically important work to accountable ownership and completion evidence. | hazard scenarios |
| GP-138 | M | Scanning E00406 | Support single- and multi-page scanning. | 061 |
| GP-139 | O | Scanning E00407 | Image enhancement is optional. | 061 |
| GP-140 | F | Clinical Decision Support C6 | Obtain adopted rules, data-input and presentation criteria. | 062 |
| GP-141 | R | Pack design | Validate calculator/rule versions, missing inputs, units and override behaviour. | hazard scenarios |
| GP-142 | F | Communication Management | Obtain selected communication and delivery-status criteria. | 063 |
| GP-143 | R | Pack design | Test address changes, failed delivery, proxy disclosure and urgent messages. | hazard scenarios |
| GP-144 | F | Digital Diagnostics | Obtain order/result workflow and integration baseline. | 064 |
| GP-145 | R | Pack design | Verify results reach a responsible reviewer and amendments remain visible. | hazard scenarios |
| GP-146 | F | Online Patient Consultation | Obtain adopted triage, submission and workflow criteria. | 065 |
| GP-147 | R | Pack design | Test urgent symptoms, abandoned submissions, queues and unavailable services. | hazard scenarios |
| GP-148 | F | View Record – Citizen | Obtain adopted access, display and withholding criteria. | 066 |
| GP-149 | R | Pack design | Examine child/proxy transitions, safeguarding and withheld-information leakage. | hazard scenarios |
| GP-150 | F | Unified Care Record | Obtain aggregation, provenance and display baseline. | 067 |
| GP-151 | R | Pack design | Avoid presenting an incomplete/shared copy as the complete authoritative GP record. | hazard scenarios |
The current C8 page contains mandatory E00432 (investigation-request information) and E00433 (view received results). Result-to-request reconciliation E00434 is MAY. E00431 was not present in the current canonical page and must not be imported as a current mandatory requirement from an older local note. Even where E00434 is not selected, clinical safety analysis must still consider missing results and accountable follow-up 064.
Interface and national-service checks
These rows identify required implementation routes or conditional review topics. Use the interface applicability inventory to establish scope. Detailed FHIR profiles, cardinalities, code lists, HL7 structures and service-specific hazard logs must come from approved local copies where a finding depends on them.
| ID | Basis | Official reference | Screening summary | Source |
|---|---|---|---|---|
| GP-160 | M | S43 GP2GP00–GP2GP09, route dependent | Apply correct legacy/new GP2GP route and management information duties. | 026 |
| GP-161 | M | GP2GP02; GP2GP03 | Document interpretability and support receiving suppliers. | 026 |
| GP-162 | F | GP2GP dependent specifications | Verify structured data, attachments, redactions, degradation and integration behaviour. | 026 |
| GP-163 | F | S99 GP Connect Access Record Structured | Confirm provider/consumer specification and clinical scope. | 027 |
| GP-164 | M | S102 GPCUR01; GPCUR02 | Implement role-specific Update Record specification. | 028 |
| GP-165 | F | Update Record dependencies | Check ITK3, MESH and patient-demographic dependencies. | 028 |
| GP-166 | M | S36 EPSP01/EPSP02, route dependent | Apply appropriate EPS FHIR or existing HL7 requirements. | 029 |
| GP-167 | M | S36 EPSP05 | Sign EPS prescriptions using SHA-256. | 029 |
| GP-168 | F | S34 DDP05 or direct implementation route | Apply pathology-adaptor or direct-messaging requirements. | 030 |
| GP-169 | M | S34 DDP03, applicable direct route | Restrict acknowledgement retransmission to receiving-organisation requests. | 030 |
| GP-170 | F | S47 IM1 provider/consumer requirements | Confirm interface scope, authorisation, versioning and response monitoring. | 031 |
| GP-171 | G | GP Connect product service notice | Distinguish specified functions from available onboarding routes. | 032 |
| GP-172 | R | Pack design | Treat transport success, business acceptance, filing and clinical review as separate states. | hazard scenarios |
| GP-173 | R | Pack design | Test wrong-patient messages, partial payloads, duplicates and rejected updates. | hazard scenarios |
| GP-174 | R | Pack design | Verify local extracts, caches and consumers retain adequate provenance and currency. | hazard scenarios |
Specific boundaries: GP2GP currently has different routes for existing HL7 implementations and new/FHIR-adaptor implementations. The retrieved S43 baseline was 6.0.2, effective 6 October 2026. EPS S36 was 4.0.3, effective 23 October 2026. Pathology S34 explicitly limits its described legacy result-messaging scope; it must not be treated as universal coverage of all diagnostic ordering or all laboratory disciplines 026, 029, 030.
The GP Connect service page states that new developers no longer have an onboarding route through GP Connect for Update Record, Send Document and Appointment Management, while existing consumer suppliers can onboard end users. This does not remove the need to assess an existing integration or establish the applicable supplier role. Record route availability as a separate procurement/interface dependency 032.
Related legal, organisational and semantic assurance
| ID | Basis | Reference | Screening summary | Source |
|---|---|---|---|---|
| GP-180 | G | Controller/processor guidance | Identify legal roles per processing activity and required agreements. | 048 |
| GP-181 | G | DPIA guidance | Assess likely high-risk processing through an appropriate DPIA. | 047 |
| GP-182 | F | UK GDPR/DPA, as amended | Obtain current legal basis, confidentiality, rights and security assessment. | 047, 048, 054 |
| GP-183 | G | Records Management Code | Apply record-specific retention, disposal and hold arrangements. | 042 |
| GP-184 | G | National data opt-out policy | Distinguish direct care from in-scope research/planning disclosures. | 049 |
| GP-185 | G | DTAC | Obtain current product-specific assessment and associated evidence. | 044 |
| GP-186 | G | DSPT 2026/27 v9 | Check correct organisation category, evidence year and publication status. | 045 |
| GP-187 | M | S25 GP-MW-2.1-1; MHRA guidance | Declare medical-device status and provide supporting evidence. | 004, 046 |
| GP-188 | F | GP Digital Services Operating Model | Establish commissioner, support-provider and practice responsibilities. | 043 |
| GP-189 | F | DAPB1605 | Identify, record, flag, share, meet and review accessible-information needs. | 050, 076, 077 |
| GP-190 | F | DAPB4019; phase/route dependent | Assess local adjustment recording, visibility, sharing and review, plus applicable national-flag use through API or NCRS. | 051, 078 |
| GP-191 | F | DAPB3051 | Verify identity, authentication and applicable proxy-authorisation arrangements. | 052 |
| GP-192 | G | Core Information Standard | Preserve shared-care meaning, provenance and appropriate views. | 053 |
| GP-193 | M | S109 ACS001–ACS005; scope restricted | Assess current scoped accessibility obligations. | 016 |
| GP-194 | D | S109 v2.0.0 / RM315 | Track proposed GP accessibility extension; effective date TBC. | 017 |
| GP-195 | D | C14 v4.0.0 | Track published prescribing change for December 2026. | 057 |
| GP-196 | D | C13 v14.0.0 | Track published patient-information change for April 2027. | 056 |
| GP-197 | R | Pack design | Maintain separate compliance and safety decisions for the same issue. | finding rules |
Neither GDPR consent nor the national data opt-out is a universal switch governing every use of a clinical record. Distinguish purpose, lawful basis, confidentiality permission, record-access entitlement and relevant objection/opt-out policy. Obtain IG advice where the supplied documentation does not settle the distinction 047–049.
Broader security, privacy and supply-chain coverage
These checks prevent a clinical hazard-log review from overlooking security/IG dependencies. G rows summarise regulator guidance; F rows require the actual applicable clauses; R rows are original challenge prompts. Security assurance covers confidentiality, integrity, availability, resilience, recovery and effectiveness testing, with measures appropriate to the processing risk. It applies to organisational and physical arrangements as well as technical systems 069.
| ID | Basis | Reference | Screening summary | Source |
|---|---|---|---|---|
| GP-200 | G | ICO security guidance / UK GDPR Article 32 | Assess risk-appropriate security and test its effectiveness. | 069 |
| GP-201 | G | ICO encryption guidance | Review encryption policy, current standards and key management. | 070 |
| GP-202 | F | S30 remaining assurance/security obligations; adopted DSPT | Obtain scoped certification, penetration-test and security-assurance requirements. | 005, 045 |
| GP-203 | G | CAF-aligned DSPT transition | Confirm organisation-specific framework/category; do not assume identical assessment routes. | 071 |
| GP-204 | R | Pack design | Examine legitimate relationships, emergency overrides and non-active patient access. | hazard scenarios |
| GP-205 | R | Pack design | Test leavers, session expiry/locking, service accounts and privileged-role separation. | hazard scenarios |
| GP-206 | R | Pack design | Examine malware, vulnerability remediation, unsupported components and secure configuration. | hazard scenarios |
| GP-207 | R | Pack design | Trace supplier/subprocessor dependencies, updates and software supply-chain changes. | hazard scenarios |
| GP-208 | R | Pack design | Test exports, removable media, data residency, key recovery and secure disposal. | hazard scenarios |
| GP-209 | R | Pack design | Link security detection/response to clinical downtime and recovery arrangements. | hazard scenarios |
Confirm scoped certification/testing obligations against S30; inspect actual coverage and evidence, not certificate names alone. DSPT changes are organisation-specific 005, 045, 071.
Additional controls from the source refresh and local synthesis
These retain the original identifiers and extend coverage. They do not imply that a product has been assessed.
| ID | Basis | Official reference | Screening summary | Source |
|---|---|---|---|---|
| GP-220 | M | C12 E00153; E00154 | Manage organisation-site and staff records, including required organisation identifiers and professional identifiers. | 082 |
| GP-221 | M | C13 E00165 AC1–3 | Support EPR viewing/updating and a view of historical information relating to the patient’s care. | 019 |
| GP-222 | M | C13 E00177; GP2GP dependency | Support transfer, automatic integration and viewing of transferred EPRs under the applicable GP2GP route. | 019, 026 |
| GP-223 | M | S27 GP-12.6-01; GP-12.6-02 | Preserve original units; make comparative units consistent, identify conversions and retain access to original values and units. | 006 |
| GP-224 | M | S27 GP-13-01 | Identify which reference-data version was in use at a given time. | 006 |
| GP-225 | M | S26 DMI09; source-supplier scope | Retain agreed run-off access to source data, audit trails and support in human-readable form. | 007 |
| GP-226 | M | S26 DMI17–DMI23; target-supplier scope | Provide trial validation, issue resolution and refreshed comparison reports; load transformed data following service-recipient approval. | 007 |
| GP-227 | M | C8 E00432; E00433 | Manage investigation-request information and view received results; satisfy the stated pathology and screening dependencies. | 064 |
| GP-228 | O | C8 E00434 | Reconcile received results to recorded investigation requests when this optional Epic is selected or mandated. | 064 |
| GP-229 | M | S30 GP-IG-14.1-1; 14.1-2; 14.1-3 | Apply specified clock synchronisation and UTC messaging; base audit and timed record entries on the synchronised time system. | 005 |
| GP-230 | M | DCB0129 §2.6.1 | Manufacturer: formally review the clinical risk management process at planned regular intervals. | 036 |
| GP-231 | M | DCB0129/DCB0160 §§3.3.2–3.3.3 | For each responsible organisation, verify CSO approval of each hazard-log version and an issued log accompanying each safety case report. | 036, 037 |
| GP-232 | R | Applied data-safety challenge; Table 2 guidance | Test whether suppression, prioritisation, history retention and disposal preserve the clinical information needed for the intended care workflow. | 040 |
| GP-233 | R | Reference audit method | Record source-verification depth separately from obligation basis, applicability, hazard coverage and control verification; do not infer clause verification from a working URL. | concept design, finding rules, source register |