Glossary

Clinic AI, in plain English

The product terms, compliance frameworks and documentation concepts UK practice owners run into when buying clinic AI — defined without the jargon.

Compliance & governance

6 terms

DTAC

DTAC — the Digital Technology Assessment Criteria — is the NHS's baseline assessment for digital health technologies. It checks five areas: clinical safety, data protection, technical security, interoperability, and usability/accessibility. NHS organisations use it when procuring digital tools; private clinics increasingly borrow it as a ready-made due-diligence checklist.

Read definition

DSPT

The DSPT — Data Security and Protection Toolkit — is an annual online self-assessment against the National Data Guardian's security standards. Any organisation with access to NHS patient data or systems must complete it each year. For private clinics, a vendor's current DSPT status is a quick, checkable signal of data-security maturity.

Read definition

Cyber Essentials

Cyber Essentials is a UK government-backed certification, run by the National Cyber Security Centre, showing an organisation has five baseline technical controls in place: firewalls, secure configuration, access control, malware protection, and security update management. Cyber Essentials Plus adds independent hands-on testing of the same controls.

Read definition

UK data residency

UK data residency means data is stored and processed on servers physically located in the United Kingdom, under UK jurisdiction. For clinics it's shorthand for a bigger question: which country's laws and authorities can reach your patients' data, and whether international transfers — with their extra UK GDPR safeguards — are happening at all.

Read definition

Consent and capacity (for clinic AI)

In clinic AI, consent and capacity refers to two linked requirements: the patient must give informed consent before a consultation is recorded by an AI scribe, and where a patient may lack the capacity to consent — covered in England and Wales by the Mental Capacity Act 2005 — the clinic needs a defined process rather than an assumption.

Read definition

CQC Regulation 17

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 — 'Good governance' — requires CQC-registered providers to operate effective systems for quality and risk, and to maintain an accurate, complete and contemporaneous record for every service user. It's the regulation clinic documentation practices are most often judged against.

Read definition