Industries
Healthcare software development in the UK
In healthcare, a software bug can do more than annoy someone, and the buyers know it. Selling to the NHS means meeting standards that many development teams have never heard of.
Health tech projects often fail to reach the NHS for reasons unrelated to how good the product is. Procurement teams want to see evidence on clinical safety, data protection, security, interoperability and usability, and those requirements are expensive to retrofit into a finished product. It’s much better to know about them before the first line of code is written.
Not every health-adjacent product is covered in the same way. A wellbeing app, a clinic booking system and a tool that suggests a diagnosis sit in very different regulatory positions. Software with a medical purpose may count as a medical device, which brings MHRA regulation and much more demanding requirements. Working out where your product sits is one of the first things to settle, and that’s a question for regulatory specialists as well as developers.
Data needs extra care
Health data is special category data under UK GDPR, so you need both a lawful basis and an additional condition for processing it. A data protection impact assessment is generally expected for this sort of processing. Consider access controls, audit trails and retention from the start, and check with suppliers where data is stored, including any AI services involved.
Our role
We design and build the software with these requirements in mind, and we can produce the technical evidence that assessments ask for. Clinical safety officers, regulatory consultants and legal advisers are specialist roles that you’ll need to bring in, either in-house or externally, and we’re happy to work alongside them.
Standards to plan for
DTAC
The Digital Technology Assessment Criteria is the NHS’s baseline assessment for digital health technologies, covering clinical safety, data protection, technical security, interoperability, and usability and accessibility.
Data Security and Protection Toolkit
Organisations with access to NHS patient data and systems use the DSPT to self-assess against data security standards.
DCB0129 and DCB0160
Clinical risk management standards for manufacturers of health IT systems and for the organisations deploying them, and they involve a named Clinical Safety Officer.
Medical device rules
Software intended for diagnosis or treatment may be regulated as a medical device by the MHRA, which has a major effect on scope and cost.
Interoperability
NHS systems increasingly expect standards such as FHIR and NHS login, and connecting to the Spine has its own onboarding requirements.
What we can build
Patient portals and apps
Appointment booking, results, messaging and remote monitoring.
Clinic management systems
Scheduling, records and billing for private clinics and groups.
Staff tools
Rostering, referral workflows and audit tools that reduce admin.
Integrations
Connecting to practice systems and NHS services where access is approved.
Related services
Healthcare questions
Do we need to complete DTAC to sell to the NHS?
Is our app a medical device?
Can you act as our Clinical Safety Officer?
Building for healthcare?
Tell us what the software has to do. We will read it properly and reply by email with sensible next steps.