Freedom of Information Request – Ref: FOI 501-2025
Thank you for your recent Freedom of Information request. Please find our response below.
You asked:
1. A list of all external suppliers, contractors, or partner organisations who currently fall within the remit of the NHS Data Security & Protection Toolkit (DSPT) for your organisation.
This includes any supplier that handles patient data, accesses NHS systems, or provides digital, software, cloud, data-processing, or cyber-security services requiring DSPT compliance.
Our response:
- Gloucestershire Hospitals NHS Foundation Trust
- Gloucestershire ICB
- Gloucestershire County Council
- South Western Ambulance Service Foundation Trust
- South West Provider Collaborative
EPR System – Supplier
- SystmOne – TPP
- RiO – Access
- S4D – Systems 4 Dentists
- Lilie – IDOX
- IAPTus – Mayden
- Modus – Paloma
You asked:
2. A list of any new, incoming, or planned suppliers (contracted or due to go live within the next 12 months) who will fall within the DSPT remit for the same reasons.
Our response:
None planned.
You asked:
3. For each supplier identified in Q1 or Q2, please confirm (if recorded):
a. Whether they are required to maintain a “Standards Met” DSPT submission
b. The date you last checked or verified their DSPT status (or expected verification date for new suppliers)
Our response:
a. Where suppliers are contracted to provide a service then this will form part of the contract. All system partners are required to comply with DSPT.
b. We check at the point of contract award, for system partners the Trusts DPO checks annually (August/September)
You asked:
4. Does your organisation maintain an internal register or log of DSPT-relevant suppliers (including planned or onboarding suppliers)?
– If yes, please provide the relevant extract.
– If no, please confirm that no such register exists.
Our response:
No – The Trust does not maintain such a register.
Next steps:
Should you have any queries in relation to our response, please do not hesitate to contact us. If you are unhappy with the response you have received in relation to your request and wish to ask us to review our response, you should write to:
Louise Moss
Head of Legal Services / Associate Director of Corporate Governance
c/o Gloucestershire Health and Care NHS Foundation Trust
Edward Jenner Court
1010 Pioneer Avenue
Gloucester Business Park
Brockworth, GL3 4AW
E-mail: louise.moss@ghc.nhs.uk
If you are not content with the outcome of any review, you may apply directly to the Information Commissioner’s Office (ICO) for further advice/guidance. Generally, the ICO will not consider your case unless you have exhausted your enquiries with the Trust which should include considering the use of the Trust’s formal complaints procedure. The ICO can be contacted at: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.