Skip to content

DSIC foundations and applicability

What DSIC means

Digital Services for Integrated Care (DSIC) is NHS England's model for digital care products, capabilities, standards, assurance and routes to market. It evolved from GP IT Futures and extends across care settings. It is not one clinical application or one interface. 072

The model needs several different kinds of evidence:

Layer What to establish Typical evidence
Business capability Which clinical or administrative functions are offered? Capability and Epic declaration; acceptance-criterion results
Technical and operating standard Which cross-cutting or interface requirements apply? Versioned requirements; assurance responses; technical tests
Commercial route Is this buyer, product and purchase within an available route? Catalogue agreement; framework/call-off and product scope
National service Can this implementation act in its declared provider/consumer role? Onboarding, permitted use, endpoint and role-specific assurance
Manufacturer safety What risks and controls accompany this released system? DCB0129 plan, hazard log, safety case and release evidence
Deployment safety What happens in this organisation's actual workflows? DCB0160 local analysis, control implementation and acceptance

This table is a synthesis for review. A catalogue entry, supplier claim or component feature cannot answer every row. Requirements apply to a defined solution and baseline, not to a product name in the abstract. 002, 034, 035

Read the capability structure precisely

A capability describes a business need. Epics and acceptance criteria make that need assessable. All acceptance criteria for an applicable Epic matter. Additional Implementation Details are mandatory assurance inputs; Supporting Information provides guidance. A MAY Epic can become mandatory through the contracting vehicle or a Supplementary Care Standard. Check selection and scope before treating absence as a breach. 080

The buyer guidance identifies six foundation capabilities: appointments, referrals, resources, patient information, prescribing and consultation recording. A non-foundation product is assessed against its own capability scope. Resource Management therefore needs explicit coverage in a foundation review, even though it received little attention in the seed. 095, 082

Standards and assurance boundaries

Overarching standards govern cross-cutting matters such as safety, information governance, continuity and testing. Non-overarching standards govern particular interfaces. Supplementary Care Standards group requirements for a service or setting. Different entities have independent versions and lifecycle states. A high version number, future publication or retired page is insufficient evidence of the effective baseline. 001, 003, 024

Baseline Assurance is an initial risk-based stage. Remaining requirements, agreed work-off dates and assurance conditions still need inspection. Record the solution category, service type and relevant contracting vehicle rather than inferring them from product size. 002, 059

The Tech Innovation Framework is a route for core GP EPR innovation and is extended to 30 September 2027. A planned replacement procurement is distinct from a live call-off. Reconfirm the actual buying route and contract when reviewing a product; this reference is not procurement advice or evidence of a supplier appointment. 074

Four data journeys that need separate analysis

Journey Trigger and record responsibility Safety evidence to seek
GP2GP Patient registration transfer between participating systems Sending/receiving roles; degradation; integration exceptions; clinical review
Whole-practice migration Replacement of the practice's operational system Extracts, mapping, reconciliation, cutover, pending work and rollback
GP Connect exchange A permitted read, document, appointment or update workflow Role-specific specification; transport, business acceptance and clinical action
Shared-record aggregation Combining or presenting information from sources Provenance, currency, completeness, matching and responsibility for action

These are review distinctions derived from the source set and local research. Success in one journey does not establish success in another. NHS migration guidance supports planning and responsibilities, but is not a complete project plan. S26 has a narrower Catalogue/contracting-vehicle scope that must be decided separately. 007, 026, 027, 028, 032, 073

Scope beyond England NHS general practice

Apply DSIC obligations through the relevant contract, capability, interface and jurisdiction. A Defence or devolved-nation deployment can use a DSIC requirement as a comparison without automatically being bound by every England commissioning rule. Keep statutory applicability, contractual adoption, national-service eligibility and voluntary safety practice separate. The local research synthesis explains how prior work informed these distinctions.

Plain-language glossary

Term Meaning in this review
Baseline The exact product build, configuration, deployment and adopted source versions being reviewed.
Hazard A potential source of harm; analyse the hazardous situation, causes and patient consequences separately.
Control A measure intended to prevent, detect or reduce a risk; its existence and effectiveness need evidence.
Verification Evidence that a stated requirement or control has been met within defined conditions.
Safety case A structured argument supported by evidence; a hazard log is one input, not the complete argument.
Traceability A recorded relationship between requirement, hazard/cause, control, evidence and decision.
CATR Clinical Authority to Release; establish its issuer and scope. It does not accept a deployment's local residual risk.
Provenance Who created or changed information, where it came from, and the relevant time and context.
Onboarding Service-specific assessment and setup for a permitted implementation role.
Nonconformance Evidenced contradiction of an applicable requirement, including process obligations where proved.

Glossary descriptions are editorial aids. The applicable standard's definitions govern formal decisions.

Standards baseline and applicability map

DSIC model

DSIC means Digital Services for Integrated Care. It groups functional business needs into Capabilities, technical/non-functional obligations into Overarching Standards, interface obligations into Non-Overarching Standards, and setting/service obligations into Supplementary Care Standards. A Capability contains MUST and MAY Epics. All acceptance criteria for an applicable Epic must pass its assessment. Additional Implementation Details are mandatory; Supporting Information is guidance. A Contracting Vehicle or Supplementary Care Standard can mandate a MAY Epic. Draft, Published, Effective, Deprecated and Retired are separate lifecycle states; publication alone does not prove present applicability 001, 080.

The Baseline Assurance Standard (BAS) is an onboarding milestone, with further requirements and timeframes depending on the contracting vehicle and solution category. Do not equate BAS completion or catalogue visibility with all applicable requirements being closed. Confirm the scope and evidence of assurance 002, 059.

Observed overarching standard versions

These are retrieved public-page metadata, not a promise that every supplier contract adopts the same version. Reconfirm against the approved product baseline before a formal compliance finding.

Standard Observed version / status Observed effective date Source
Clinical Safety S25 1.0.12 / Effective 19 October 2026 004
Information Governance S30 7.0.0 / Effective; U01 metadata conflict resolved 23 October 2026 005, 058
Data Standards S27 2.0.13 / Effective 19 October 2026 006
Data Migration S26 2.1.10 / Effective 19 October 2026 007
Business Continuity and Disaster Recovery S24 1.2.11 / Effective 19 October 2026 008
Hosting & Infrastructure S29 2.0.10 / Effective 19 October 2026 009
Service Management S65 3.0.11 / Effective 19 October 2026 010
Testing S69 1.0.12 / Effective 19 October 2026 011
Training S28 1.5.13 / Effective 19 October 2026 012
Interoperability S32 18.2.9 / Effective 23 October 2026 013
Non-Functional Questions S63 2.1.13 / Effective 19 October 2026 014
Commercial S31 2.2.7 / Effective 19 October 2026 015
Accessibility S109 1.0.2 / Effective, displayed scope: Digital Pathways Solution Registry 5 August 2026 016
Accessibility S109 proposed GP extension 2.0.0 / Draft; roadmap RM315 Draft TBC 017
Baseline Assurance Standard S108 1.0.6 / Effective; displayed vehicles: Community Pharmacy, Digital Pathways Registry, Digital Primary Care 19 October 2026; confirm applicable vehicle 059

Version history U01 — resolved metadata conflict: On 28 October 2026 the live canonical Confluence content API returned S30 v7.0.0, Effective 23 October 2026. The canonical page was updated on 26 October 2026. Cached web extraction still displayed v6.0.3, while the separate v6.0.4 page is Retired. Use the live public-page baseline for this reference; obtain the product’s adopted contractual baseline before a formal finding 005, 058.

Accessibility distinction: Do not apply the draft GP extension as an already effective contractual DSIC requirement. Existing accessibility law, accessible-information duties and clinical safety considerations still require assessment independently 016, 017, 050.

Principal functional capabilities

Capability Retrieved baseline Review scope Source
Patient Information Maintenance – GP C13 10.0.3 / Effective, 13 October 2026 Registration, demographics, EPR organisation, citizen access 019
Consultation Management – GP C15 1.3.1 / Effective, 13 October 2026; live canonical API confirmed Consultation context, clinical recording, fit notes and ADR reporting; product adoption still to establish 020
Prescribing – GP C14 3.0.5 / Effective, 16 September 2026 Prescribable items, prescribing rights and medication workflows 021
Referral Management – GP C11 2.1.0 / Effective, 22 September 2026 Referral information and applicable referral integrations 022
Appointments Management – GP C5 1.5.0 / Effective, 26 February 2026 Appointment/resource management and relevant integrations 023
Document Management C9 1.1.1 / Effective, 8 September 2026 Filing, matching, conversion; selected optional metadata/annotation/version features 018
Task Management C50 1.1.0 / Effective, 26 February 2026 Task lifecycle; assignment/overdue functions are selected optional Epics 060
Scanning Public capability inspected; pin adopted version locally Single/multiple-page capture and optional enhancement 061
Clinical Decision Support C6 Public capability inspected; pin adopted version locally Clinical recommendations and configured decision support 062
Communications / Digital Diagnostics / Online Patient Consultation Public capability pages identified; detailed acceptance criteria not fully transcribed Activate when supplied; use family-level checks 063–065
View Record – Citizen / Unified Care Record Public capability pages identified; detailed acceptance criteria not fully transcribed Patient/proxy access or shared-care aggregation 066–067

Other capabilities need a separate applicability decision when offered: advice and guidance, care plans, care navigation, caseloads, workforce/resource management, custom workflows, dictation, dispensing, medicines optimisation, medical reports, emergency alerts, remote monitoring, risk stratification, population health, reporting, extract verification, patient requests, prescription ordering, appointment check-in, video consultations, social prescribing, domiciliary care and personal health records/budgets. Their presence is a trigger to obtain the applicable capability/Epic baseline, not a claim that this file reproduces each one 068.

The current relationship guide groups six foundation capabilities: Appointments Management – GP, Consultation Management – GP, Patient Information Maintenance – GP, Prescribing – GP, Referral Management – GP and Resource Management. Resource Management C12 covers organisation sites and staff records; it is broader than appointment scheduling. The 2020 buyer guide provides historical context, while current individual capability pages govern adopted requirements 025, 081, 082.

Standard/guidance Observed reference Applicability and caution Source
DCB0129 Amd 24/2018; specification v4.2, 2 May 2018 Manufacturer development/maintenance; current release listed despite ongoing review 034, 036
DCB0160 Amd 25/2018; specification v3.2, 2 May 2018 Deployment, use, maintenance, decommissioning; separate local assurance 035, 037
Clinical Risk Management Data Safety v2.0, 27 September 2018 Supporting data-safety method; not a new mandatory standard 040
DTAC Updated form/guidance in 2026; previous form retired from 6 April 2026 Product assessment framework; does not replace other approvals 044
DSPT 2026/27 version 9; published 2 October 2026 Correct organisation category matters; IT supplier category 2, GP category 4 045
GP Digital Services Operating Model Exact v6.02 / 3 September 2026 seed metadata not independently reconfirmed; U03 Official search located v6 May 2026 and related agreements; detailed obligations require approved documents 043
DAPB1605 Accessible Information v4.0, release 30/2025 Accessible communication/information needs; distinct from WCAG UI testing 050
DAPB4019 Reasonable Adjustment Digital Flag Linked requirements Amd 41/2025 v2.0 Final, 30 November 2025; published 19 December 2025; landing page still says Amd 24/2025 PDF §9 gives phase-two/full conformance 30 September 2026; establish organisation and API/NCRS route; U10 051, 078
DAPB3051 identity verification/authentication v3.1, Amd 59/2025; full conformance 31 December 2026 Identity/proxy authorisation; transition date distinguished from existing duties 052
PRSB Core Information Standard v2.01 displayed Shared-care information semantics; apply by use case/adoption 053
Records Management Code of Practice 2021 code with live updates; downloadable PDF marked out of date Obtain current record-specific retention/disposal rules and holds; no exact schedule audited here 042
UK data protection / confidentiality UK GDPR and DPA 2018 as amended; ICO says DUAA data-protection provisions in force by 19 June 2026 Obtain current legal/IG interpretation; some detailed guidance remains under review; consent and opt-outs are purpose-specific 047–049, 054
Medical-device regulation MHRA software guidance Determine intended purpose per module; ordinary record storage and diagnostic functionality may differ 046

Future/change watch: Prescribing C14 v4.0.0 was Published with effective date 4 December 2026; Patient Information Maintenance C13 v14.0.0 was Published with effective date 20 April 2027. Treat as forward requirements until adopted/effective in the relevant baseline. DCB standards being reviewed is not evidence that a replacement has already taken effect 056, 057, 034, 035.