<!-- Derived Markdown alternate of standards.md; canonical repository sources and registered evidence retain authority. -->


# DSIC foundations and applicability

## What DSIC means

**Digital Services for Integrated Care (DSIC)** is NHS England's model for digital care products, capabilities, standards, assurance and routes to market. It evolved from GP IT Futures and extends across care settings. It is not one clinical application or one interface. [SRC-072](https://dsic-clinical-safety.pages.dev/sources/index.md#src-072)

The model needs several different kinds of evidence:

| Layer | What to establish | Typical evidence |
|---|---|---|
| Business capability | Which clinical or administrative functions are offered? | Capability and Epic declaration; acceptance-criterion results |
| Technical and operating standard | Which cross-cutting or interface requirements apply? | Versioned requirements; assurance responses; technical tests |
| Commercial route | Is this buyer, product and purchase within an available route? | Catalogue agreement; framework/call-off and product scope |
| National service | Can this implementation act in its declared provider/consumer role? | Onboarding, permitted use, endpoint and role-specific assurance |
| Manufacturer safety | What risks and controls accompany this released system? | DCB0129 plan, hazard log, safety case and release evidence |
| Deployment safety | What happens in this organisation's actual workflows? | DCB0160 local analysis, control implementation and acceptance |

This table is a synthesis for review. A catalogue entry, supplier claim or component feature cannot answer every row. Requirements apply to a defined solution and baseline, not to a product name in the abstract. [SRC-002](https://dsic-clinical-safety.pages.dev/sources/index.md#src-002), [SRC-034](https://dsic-clinical-safety.pages.dev/sources/index.md#src-034), [SRC-035](https://dsic-clinical-safety.pages.dev/sources/index.md#src-035)

### Read the capability structure precisely

A capability describes a business need. Epics and acceptance criteria make that need assessable. All acceptance criteria for an applicable Epic matter. Additional Implementation Details are mandatory assurance inputs; Supporting Information provides guidance. A MAY Epic can become mandatory through the contracting vehicle or a Supplementary Care Standard. Check selection and scope before treating absence as a breach. [SRC-080](https://dsic-clinical-safety.pages.dev/sources/index.md#src-080)

The buyer guidance identifies six foundation capabilities: appointments, referrals, resources, patient information, prescribing and consultation recording. A non-foundation product is assessed against its own capability scope. Resource Management therefore needs explicit coverage in a foundation review, even though it received little attention in the seed. [SRC-095](https://dsic-clinical-safety.pages.dev/sources/index.md#src-095), [SRC-082](https://dsic-clinical-safety.pages.dev/sources/index.md#src-082)

### Standards and assurance boundaries

Overarching standards govern cross-cutting matters such as safety, information governance, continuity and testing. Non-overarching standards govern particular interfaces. Supplementary Care Standards group requirements for a service or setting. Different entities have independent versions and lifecycle states. A high version number, future publication or retired page is insufficient evidence of the effective baseline. [SRC-001](https://dsic-clinical-safety.pages.dev/sources/index.md#src-001), [SRC-003](https://dsic-clinical-safety.pages.dev/sources/index.md#src-003), [SRC-024](https://dsic-clinical-safety.pages.dev/sources/index.md#src-024)

Baseline Assurance is an initial risk-based stage. Remaining requirements, agreed work-off dates and assurance conditions still need inspection. Record the solution category, service type and relevant contracting vehicle rather than inferring them from product size. [SRC-002](https://dsic-clinical-safety.pages.dev/sources/index.md#src-002), [SRC-059](https://dsic-clinical-safety.pages.dev/sources/index.md#src-059)

The Tech Innovation Framework is a route for core GP EPR innovation and is extended to 30 September 2027. A planned replacement procurement is distinct from a live call-off. Reconfirm the actual buying route and contract when reviewing a product; this reference is not procurement advice or evidence of a supplier appointment. [SRC-074](https://dsic-clinical-safety.pages.dev/sources/index.md#src-074)

### Four data journeys that need separate analysis

| Journey | Trigger and record responsibility | Safety evidence to seek |
|---|---|---|
| GP2GP | Patient registration transfer between participating systems | Sending/receiving roles; degradation; integration exceptions; clinical review |
| Whole-practice migration | Replacement of the practice's operational system | Extracts, mapping, reconciliation, cutover, pending work and rollback |
| GP Connect exchange | A permitted read, document, appointment or update workflow | Role-specific specification; transport, business acceptance and clinical action |
| Shared-record aggregation | Combining or presenting information from sources | Provenance, currency, completeness, matching and responsibility for action |

These are review distinctions derived from the source set and local research. Success in one journey does not establish success in another. NHS migration guidance supports planning and responsibilities, but is not a complete project plan. S26 has a narrower Catalogue/contracting-vehicle scope that must be decided separately. [SRC-007](https://dsic-clinical-safety.pages.dev/sources/index.md#src-007), [SRC-026](https://dsic-clinical-safety.pages.dev/sources/index.md#src-026), [SRC-027](https://dsic-clinical-safety.pages.dev/sources/index.md#src-027), [SRC-028](https://dsic-clinical-safety.pages.dev/sources/index.md#src-028), [SRC-032](https://dsic-clinical-safety.pages.dev/sources/index.md#src-032), [SRC-073](https://dsic-clinical-safety.pages.dev/sources/index.md#src-073)

### Scope beyond England NHS general practice

Apply DSIC obligations through the relevant contract, capability, interface and jurisdiction. A Defence or devolved-nation deployment can use a DSIC requirement as a comparison without automatically being bound by every England commissioning rule. Keep statutory applicability, contractual adoption, national-service eligibility and voluntary safety practice separate. The [local research synthesis](https://dsic-clinical-safety.pages.dev/local-research/index.md) explains how prior work informed these distinctions.

### Plain-language glossary

| Term | Meaning in this review |
|---|---|
| Baseline | The exact product build, configuration, deployment and adopted source versions being reviewed. |
| Hazard | A potential source of harm; analyse the hazardous situation, causes and patient consequences separately. |
| Control | A measure intended to prevent, detect or reduce a risk; its existence and effectiveness need evidence. |
| Verification | Evidence that a stated requirement or control has been met within defined conditions. |
| Safety case | A structured argument supported by evidence; a hazard log is one input, not the complete argument. |
| Traceability | A recorded relationship between requirement, hazard/cause, control, evidence and decision. |
| CATR | Clinical Authority to Release; establish its issuer and scope. It does not accept a deployment's local residual risk. |
| Provenance | Who created or changed information, where it came from, and the relevant time and context. |
| Onboarding | Service-specific assessment and setup for a permitted implementation role. |
| Nonconformance | Evidenced contradiction of an applicable requirement, including process obligations where proved. |

Glossary descriptions are editorial aids. The applicable standard's definitions govern formal decisions.


## Standards baseline and applicability map

### DSIC model

DSIC means **Digital Services for Integrated Care**. It groups functional business needs into **Capabilities**, technical/non-functional obligations into **Overarching Standards**, interface obligations into **Non-Overarching Standards**, and setting/service obligations into **Supplementary Care Standards**. A Capability contains MUST and MAY Epics. All acceptance criteria for an applicable Epic must pass its assessment. **Additional Implementation Details are mandatory**; **Supporting Information is guidance**. A Contracting Vehicle or Supplementary Care Standard can mandate a MAY Epic. Draft, Published, Effective, Deprecated and Retired are separate lifecycle states; publication alone does not prove present applicability [SRC-001](https://dsic-clinical-safety.pages.dev/sources/index.md#src-001), [SRC-080](https://dsic-clinical-safety.pages.dev/sources/index.md#src-080).

The Baseline Assurance Standard (BAS) is an onboarding milestone, with further requirements and timeframes depending on the contracting vehicle and solution category. Do not equate BAS completion or catalogue visibility with all applicable requirements being closed. Confirm the scope and evidence of assurance [SRC-002](https://dsic-clinical-safety.pages.dev/sources/index.md#src-002), [SRC-059](https://dsic-clinical-safety.pages.dev/sources/index.md#src-059).

### Observed overarching standard versions

These are **retrieved public-page metadata**, not a promise that every supplier contract adopts the same version. Reconfirm against the approved product baseline before a formal compliance finding.

| Standard | Observed version / status | Observed effective date | Source |
|---|---|---|---|
| Clinical Safety S25 | 1.0.12 / Effective | 19 October 2026 | [SRC-004](https://dsic-clinical-safety.pages.dev/sources/index.md#src-004) |
| Information Governance S30 | 7.0.0 / Effective; U01 metadata conflict resolved | 23 October 2026 | [SRC-005](https://dsic-clinical-safety.pages.dev/sources/index.md#src-005), [SRC-058](https://dsic-clinical-safety.pages.dev/sources/index.md#src-058) |
| Data Standards S27 | 2.0.13 / Effective | 19 October 2026 | [SRC-006](https://dsic-clinical-safety.pages.dev/sources/index.md#src-006) |
| Data Migration S26 | 2.1.10 / Effective | 19 October 2026 | [SRC-007](https://dsic-clinical-safety.pages.dev/sources/index.md#src-007) |
| Business Continuity and Disaster Recovery S24 | 1.2.11 / Effective | 19 October 2026 | [SRC-008](https://dsic-clinical-safety.pages.dev/sources/index.md#src-008) |
| Hosting & Infrastructure S29 | 2.0.10 / Effective | 19 October 2026 | [SRC-009](https://dsic-clinical-safety.pages.dev/sources/index.md#src-009) |
| Service Management S65 | 3.0.11 / Effective | 19 October 2026 | [SRC-010](https://dsic-clinical-safety.pages.dev/sources/index.md#src-010) |
| Testing S69 | 1.0.12 / Effective | 19 October 2026 | [SRC-011](https://dsic-clinical-safety.pages.dev/sources/index.md#src-011) |
| Training S28 | 1.5.13 / Effective | 19 October 2026 | [SRC-012](https://dsic-clinical-safety.pages.dev/sources/index.md#src-012) |
| Interoperability S32 | 18.2.9 / Effective | 23 October 2026 | [SRC-013](https://dsic-clinical-safety.pages.dev/sources/index.md#src-013) |
| Non-Functional Questions S63 | 2.1.13 / Effective | 19 October 2026 | [SRC-014](https://dsic-clinical-safety.pages.dev/sources/index.md#src-014) |
| Commercial S31 | 2.2.7 / Effective | 19 October 2026 | [SRC-015](https://dsic-clinical-safety.pages.dev/sources/index.md#src-015) |
| Accessibility S109 | 1.0.2 / Effective, displayed scope: Digital Pathways Solution Registry | 5 August 2026 | [SRC-016](https://dsic-clinical-safety.pages.dev/sources/index.md#src-016) |
| Accessibility S109 proposed GP extension | 2.0.0 / Draft; roadmap RM315 Draft | TBC | [SRC-017](https://dsic-clinical-safety.pages.dev/sources/index.md#src-017) |
| Baseline Assurance Standard S108 | 1.0.6 / Effective; displayed vehicles: Community Pharmacy, Digital Pathways Registry, Digital Primary Care | 19 October 2026; confirm applicable vehicle | [SRC-059](https://dsic-clinical-safety.pages.dev/sources/index.md#src-059) |

**Version history U01 — resolved metadata conflict:** On 28 October 2026 the live canonical Confluence content API returned S30 v7.0.0, Effective 23 October 2026. The canonical page was updated on 26 October 2026. Cached web extraction still displayed v6.0.3, while the separate v6.0.4 page is Retired. Use the live public-page baseline for this reference; obtain the product’s adopted contractual baseline before a formal finding [SRC-005](https://dsic-clinical-safety.pages.dev/sources/index.md#src-005), [SRC-058](https://dsic-clinical-safety.pages.dev/sources/index.md#src-058).

**Accessibility distinction:** Do not apply the draft GP extension as an already effective contractual DSIC requirement. Existing accessibility law, accessible-information duties and clinical safety considerations still require assessment independently [SRC-016](https://dsic-clinical-safety.pages.dev/sources/index.md#src-016), [SRC-017](https://dsic-clinical-safety.pages.dev/sources/index.md#src-017), [SRC-050](https://dsic-clinical-safety.pages.dev/sources/index.md#src-050).

### Principal functional capabilities

| Capability | Retrieved baseline | Review scope | Source |
|---|---|---|---|
| Patient Information Maintenance – GP C13 | 10.0.3 / Effective, 13 October 2026 | Registration, demographics, EPR organisation, citizen access | [SRC-019](https://dsic-clinical-safety.pages.dev/sources/index.md#src-019) |
| Consultation Management – GP C15 | 1.3.1 / Effective, 13 October 2026; live canonical API confirmed | Consultation context, clinical recording, fit notes and ADR reporting; product adoption still to establish | [SRC-020](https://dsic-clinical-safety.pages.dev/sources/index.md#src-020) |
| Prescribing – GP C14 | 3.0.5 / Effective, 16 September 2026 | Prescribable items, prescribing rights and medication workflows | [SRC-021](https://dsic-clinical-safety.pages.dev/sources/index.md#src-021) |
| Referral Management – GP C11 | 2.1.0 / Effective, 22 September 2026 | Referral information and applicable referral integrations | [SRC-022](https://dsic-clinical-safety.pages.dev/sources/index.md#src-022) |
| Appointments Management – GP C5 | 1.5.0 / Effective, 26 February 2026 | Appointment/resource management and relevant integrations | [SRC-023](https://dsic-clinical-safety.pages.dev/sources/index.md#src-023) |
| Document Management C9 | 1.1.1 / Effective, 8 September 2026 | Filing, matching, conversion; selected optional metadata/annotation/version features | [SRC-018](https://dsic-clinical-safety.pages.dev/sources/index.md#src-018) |
| Task Management C50 | 1.1.0 / Effective, 26 February 2026 | Task lifecycle; assignment/overdue functions are selected optional Epics | [SRC-060](https://dsic-clinical-safety.pages.dev/sources/index.md#src-060) |
| Scanning | Public capability inspected; pin adopted version locally | Single/multiple-page capture and optional enhancement | [SRC-061](https://dsic-clinical-safety.pages.dev/sources/index.md#src-061) |
| Clinical Decision Support C6 | Public capability inspected; pin adopted version locally | Clinical recommendations and configured decision support | [SRC-062](https://dsic-clinical-safety.pages.dev/sources/index.md#src-062) |
| Communications / Digital Diagnostics / Online Patient Consultation | Public capability pages identified; detailed acceptance criteria not fully transcribed | Activate when supplied; use family-level checks | [SRC-063](https://dsic-clinical-safety.pages.dev/sources/index.md#src-063)–[SRC-065](https://dsic-clinical-safety.pages.dev/sources/index.md#src-065) |
| View Record – Citizen / Unified Care Record | Public capability pages identified; detailed acceptance criteria not fully transcribed | Patient/proxy access or shared-care aggregation | [SRC-066](https://dsic-clinical-safety.pages.dev/sources/index.md#src-066)–[SRC-067](https://dsic-clinical-safety.pages.dev/sources/index.md#src-067) |

Other capabilities need a separate applicability decision when offered: advice and guidance, care plans, care navigation, caseloads, workforce/resource management, custom workflows, dictation, dispensing, medicines optimisation, medical reports, emergency alerts, remote monitoring, risk stratification, population health, reporting, extract verification, patient requests, prescription ordering, appointment check-in, video consultations, social prescribing, domiciliary care and personal health records/budgets. Their presence is a trigger to obtain the applicable capability/Epic baseline, not a claim that this file reproduces each one [SRC-068](https://dsic-clinical-safety.pages.dev/sources/index.md#src-068).

The current relationship guide groups six foundation capabilities: Appointments Management – GP, Consultation Management – GP, Patient Information Maintenance – GP, Prescribing – GP, Referral Management – GP and Resource Management. Resource Management C12 covers organisation sites and staff records; it is broader than appointment scheduling. The 2020 buyer guide provides historical context, while current individual capability pages govern adopted requirements [SRC-025](https://dsic-clinical-safety.pages.dev/sources/index.md#src-025), [SRC-081](https://dsic-clinical-safety.pages.dev/sources/index.md#src-081), [SRC-082](https://dsic-clinical-safety.pages.dev/sources/index.md#src-082).

### DCB and related baseline

| Standard/guidance | Observed reference | Applicability and caution | Source |
|---|---|---|---|
| DCB0129 | Amd 24/2018; specification v4.2, 2 May 2018 | Manufacturer development/maintenance; current release listed despite ongoing review | [SRC-034](https://dsic-clinical-safety.pages.dev/sources/index.md#src-034), [SRC-036](https://dsic-clinical-safety.pages.dev/sources/index.md#src-036) |
| DCB0160 | Amd 25/2018; specification v3.2, 2 May 2018 | Deployment, use, maintenance, decommissioning; separate local assurance | [SRC-035](https://dsic-clinical-safety.pages.dev/sources/index.md#src-035), [SRC-037](https://dsic-clinical-safety.pages.dev/sources/index.md#src-037) |
| Clinical Risk Management Data Safety | v2.0, 27 September 2018 | Supporting data-safety method; not a new mandatory standard | [SRC-040](https://dsic-clinical-safety.pages.dev/sources/index.md#src-040) |
| DTAC | Updated form/guidance in 2026; previous form retired from 6 April 2026 | Product assessment framework; does not replace other approvals | [SRC-044](https://dsic-clinical-safety.pages.dev/sources/index.md#src-044) |
| DSPT | 2026/27 version 9; published 2 October 2026 | Correct organisation category matters; IT supplier category 2, GP category 4 | [SRC-045](https://dsic-clinical-safety.pages.dev/sources/index.md#src-045) |
| GP Digital Services Operating Model | Exact v6.02 / 3 September 2026 seed metadata not independently reconfirmed; U03 | Official search located v6 May 2026 and related agreements; detailed obligations require approved documents | [SRC-043](https://dsic-clinical-safety.pages.dev/sources/index.md#src-043) |
| DAPB1605 Accessible Information | v4.0, release 30/2025 | Accessible communication/information needs; distinct from WCAG UI testing | [SRC-050](https://dsic-clinical-safety.pages.dev/sources/index.md#src-050) |
| DAPB4019 Reasonable Adjustment Digital Flag | Linked requirements Amd 41/2025 v2.0 Final, 30 November 2025; published 19 December 2025; landing page still says Amd 24/2025 | PDF §9 gives phase-two/full conformance 30 September 2026; establish organisation and API/NCRS route; U10 | [SRC-051](https://dsic-clinical-safety.pages.dev/sources/index.md#src-051), [SRC-078](https://dsic-clinical-safety.pages.dev/sources/index.md#src-078) |
| DAPB3051 identity verification/authentication | v3.1, Amd 59/2025; full conformance 31 December 2026 | Identity/proxy authorisation; transition date distinguished from existing duties | [SRC-052](https://dsic-clinical-safety.pages.dev/sources/index.md#src-052) |
| PRSB Core Information Standard | v2.01 displayed | Shared-care information semantics; apply by use case/adoption | [SRC-053](https://dsic-clinical-safety.pages.dev/sources/index.md#src-053) |
| Records Management Code of Practice | 2021 code with live updates; downloadable PDF marked out of date | Obtain current record-specific retention/disposal rules and holds; no exact schedule audited here | [SRC-042](https://dsic-clinical-safety.pages.dev/sources/index.md#src-042) |
| UK data protection / confidentiality | UK GDPR and DPA 2018 as amended; ICO says DUAA data-protection provisions in force by 19 June 2026 | Obtain current legal/IG interpretation; some detailed guidance remains under review; consent and opt-outs are purpose-specific | [SRC-047](https://dsic-clinical-safety.pages.dev/sources/index.md#src-047)–[SRC-049](https://dsic-clinical-safety.pages.dev/sources/index.md#src-049), [SRC-054](https://dsic-clinical-safety.pages.dev/sources/index.md#src-054) |
| Medical-device regulation | MHRA software guidance | Determine intended purpose per module; ordinary record storage and diagnostic functionality may differ | [SRC-046](https://dsic-clinical-safety.pages.dev/sources/index.md#src-046) |

**Future/change watch:** Prescribing C14 v4.0.0 was Published with effective date 4 December 2026; Patient Information Maintenance C13 v14.0.0 was Published with effective date 20 April 2027. Treat as forward requirements until adopted/effective in the relevant baseline. DCB standards being reviewed is not evidence that a replacement has already taken effect [SRC-056](https://dsic-clinical-safety.pages.dev/sources/index.md#src-056), [SRC-057](https://dsic-clinical-safety.pages.dev/sources/index.md#src-057), [SRC-034](https://dsic-clinical-safety.pages.dev/sources/index.md#src-034), [SRC-035](https://dsic-clinical-safety.pages.dev/sources/index.md#src-035).