Health and care deals: patient data, the DSP Toolkit and the data room

A buyer looking at a care group, a GP-adjacent clinic or a health software company wants two kinds of comfort. One is that the business handles patient information properly. The other is that it will not hand the buyer a data protection problem on day one. Strangely, the quickest way to fail the second test is to over-deliver on the first by uploading patient files to prove the point.

What is the DSP Toolkit, and why does a buyer care about it?

The Data Security and Protection Toolkit is an online self-assessment run by NHS England. Organisations that have access to NHS patient data and systems use it to show that they meet the National Data Guardian’s ten data security standards, covering areas such as staff responsibilities, training, access controls, incident management, continuity planning and supplier management. Each submission produces a published status, and it is repeated every year.

For a buyer, the toolkit is useful for a simple reason: it is a structured, dated, externally visible statement by management about how the business protects data. It turns a vague question (“is information governance any good here?”) into a document that can be read, tested against the evidence behind it and compared with previous years.

Which organisations must complete it depends on their relationship with the NHS. NHS bodies do, and so, in general, do providers holding NHS contracts or using NHS systems, which brings in many care homes, domiciliary care agencies, independent clinics and suppliers of health software. NHS England has also been moving larger NHS organisations onto a version of the toolkit aligned with the NCSC’s Cyber Assessment Framework. Check which version the target completes and why, and confirm the requirement against its actual contracts rather than assuming it.

What does a buyer read in the DSP Toolkit evidence?

The headline status is the start, not the answer. The published categories are Standards Exceeded, Standards Met, Approaching Standards and Standards Not Met. A buyer’s advisers will want to know:

• The current status and the history. A business that has met the standards for several years tells a different story from one that has just recovered from Approaching Standards.
• The improvement plan. A status of Approaching Standards usually comes with an action plan. The room should hold it, with progress against each item.
• The evidence behind the answers. Self-assessment is only as good as its evidence. Expect requests for the policies, training records, access reviews and incident logs that support the submission.
• Who signed it off. Usually a senior information risk owner, a Caldicott Guardian or a director. Their continued involvement after the sale may matter.

You can show the published status through the toolkit’s own organisation search, but put a dated copy of the submission and its supporting evidence in the room as well, so the buyer’s view is fixed at a point in time.

Which documents belong in the room, and in what form?

The useful rule is distance from the patient. The further a document is from an identifiable person’s care, the more freely it can go in.

CQC inspection reports are public on the Care Quality Commission website, but put copies in the room anyway, with the provider’s own action plans and correspondence, which are not. A buyer will also look at how the business responded to any rating below Good.

Why should patient records stay out of the room?

Three overlapping layers of law and duty apply to identifiable patient information.

First, health data is special category data under UK GDPR. Processing it needs both a lawful basis and an Article 9 condition, and a disclosure to a prospective buyer is hard to fit within any of them when de-identified information would answer the buyer’s question. The ICO’s guidance for organisations sets out the conditions, and necessity runs through all of them.

Second, the common law duty of confidentiality applies to information given in confidence for care. It sits alongside data protection law, not beneath it, so a lawful basis under UK GDPR does not by itself make a disclosure to a bidder acceptable.

Third, the Caldicott principles, which health and care organisations are expected to follow, ask whether each use of confidential information is justified, whether identifiable data is needed at all, and whether access is limited to those who need it. A Caldicott Guardian asked to approve patient files going into a bidders’ room would be right to refuse.

If a buyer’s question can be answered with a count, a percentage or a redacted sample, it should be. Names are almost never the point.

How can a buyer test clinical quality without seeing records?

Some buyers, especially those acquiring a regulated provider, need more than summaries. There are workable ways to give them that assurance without uploading files:

• Supervised review on site. A small number of the buyer’s clinical advisers review a sample of records at the premises, under a confidentiality undertaking, with nothing copied. Your Caldicott Guardian or DPO decides whether and how this can be done.
• Seller-commissioned audit. An independent clinical or information governance audit commissioned by the seller, with only the report going into the room.
• Clean team access. A restricted group of named individuals, separate from the buyer’s commercial team, sees a limited set of de-identified material in a locked folder.

Whatever route is chosen, record the decision and the reasoning in writing. It is the kind of judgement a regulator or a patient might later ask about.

What changes between a share sale and an asset sale?

The regulatory consequences differ, and that affects the timetable more than the room.

Check the current CQC process with your advisers: registration applications take time, and an asset sale cannot complete until the buyer can lawfully run the service. Our guide to share sale and asset sale due diligence covers the general differences in the room.

How should you set up the data room for a health or care sale?

1. Appoint an information governance owner for the deal

   Usually the Caldicott Guardian, DPO or senior information risk owner. They approve what goes into the room and in what form.

2. Map documents to the three rings

   Sort every requested item into as is, de-identified or kept out, before anything is uploaded.

3. Prepare de-identified versions

   Strip names, dates of birth, NHS numbers and room numbers from incident, complaint and safeguarding material. Check that small numbers do not make individuals identifiable.

4. Upload the assurance pack first

   DSP Toolkit submissions and history, CQC reports and action plans, and information governance policies give buyers context before they ask detailed questions.

5. Lock down permissions by group

   Keep clinical summaries and workforce data in folders limited to named advisers, with view-only access and watermarking.

6. Agree a route for clinical testing

   Decide early whether supervised on-site review or an independent audit will answer the buyer's clinical questions.

On the room itself, the controls that matter most here are granular folder permissions, view-only access with dynamic watermarking, a complete audit trail, two-factor login and the ability to revoke access to downloaded files where the provider supports it. Ask each provider where it stores data and under which transfer safeguards if that is outside the UK; our provider data does not record hosting regions, so get the answer in writing.

What do buyers most often find wrong?

Patterns repeat across UK health and care deals. Policies that were adopted but not reviewed for years. A DSP Toolkit submission that claims staff training completion the training records do not support. An incident log that stops in the middle of a year. A CQC action plan with no evidence of the actions being completed.

None of these kills a deal on its own. Each one becomes a price chip, a specific indemnity or a condition, and each is cheaper to fix before the room opens than to explain afterwards. Read your own submission as a buyer would, line by line, and ask whether the evidence in the room proves it.