NHS DSPT readiness, patient data GDPR compliance, and cyber resilience for clinical systems — find out where you stand and fix what matters most.
The data security challenges healthcare organisations face
NHS DSPT annual submission
The Data Security and Protection Toolkit requires annual evidence submission across 10 data security standards. The gap between assertion and evidence is where organisations fail.
Patient data GDPR obligations
Health data is special category under GDPR Article 9 — it carries stricter obligations. ICO enforcement in healthcare is growing, and the 72-hour breach reporting window is unforgiving.
Ransomware is targeting healthcare
Healthcare organisations are among the highest-targeted sectors for ransomware. Backup maturity, network segmentation, and incident response readiness are not optional.
AI-guided conversations — no forms, no jargon. A personalised PDF with your findings and a prioritised action plan sent to your inbox.
Health data is special category — it requires an explicit lawful basis, a data protection impact assessment for high-risk processing, and stricter controls than standard personal data. Find out exactly where you stand.
Free · No sign up required
Backup and recovery maturity, network segmentation, access controls, and business continuity — the DSPT-aligned areas that ransomware attackers exploit in healthcare organisations.
Free · No sign up required
Cyber Essentials Plus Audit
Portal add-onRequired by NHS Digital for access to national systems
Cyber Essentials Plus is a DSPT requirement for NHS organisations accessing certain national systems. AI-guided audit with per-control evidence capture.
Requires a Fortify portal subscription (from £49/person/mo) · CE+ audit add-on £99/mo · 12-month subscription
DSPT-aligned findings, evidence vault, incident logs, and policy library — everything an NHS organisation or health tech company needs to demonstrate data security maturity.
Findings & Action Plan
DSPT-aligned gap analysis with a prioritised action plan. Track remediation progress and demonstrate improvement for each annual submission.
Evidence Vault
Attach configuration exports, training records, and policy evidence. Everything organised and traceable — ready for DSPT submission or an ICO investigation.
Incident Management
Structured data breach and cyber incident logging with CAPA tracking. Supports the 72-hour ICO reporting decision process with a documented evidence trail.
Policy Library
Draft data security, information governance, and acceptable use policies. AI fills templates from your organisation profile — covering the DSPT policy requirements.
Vendor & Supplier Risk
Track every third-party supplier handling patient data. Manage DPA status, vendor questionnaires, and security certifications — meeting DSPT data security standard 9.
Portal plans
Free
With any assessment
£49 / person / mo
Lite — roadmap & evidence
£99 / person / mo
Pro — policies, vendors & incidents
+ £99 / mo
DSPT or CE+ audit add-on
Expert-quality data security — without the waiting list, the NHS procurement process, or the expensive IG consultant.
The digital resilience assessment covers the areas that map directly to the NHS Data Security and Protection Toolkit — identify gaps before your next annual submission.
Health data processing under GDPR Article 9 carries strict requirements. The GDPR assessment covers lawful basis, data processing agreements, retention, and breach response.
Backup maturity, network segmentation, and incident response readiness are all covered in the digital resilience check — the areas healthcare attackers exploit most.
Built-in incident management with structured playbooks for data breaches, including documentation of your ICO reporting decision — critical if you are ever investigated.
DSPT data security standard 9 requires you to manage third-party supplier risk. The vendor register tracks Data Processing Agreements, security certifications, and questionnaire responses for every supplier handling patient data.
Assessment responses are never used to train AI models, never sold, and never shared with third parties. Do not include patient data in your responses.
Fortify uses the Anthropic Claude API. Anthropic does not train on API data. Your responses generate your report and nothing else.
Your assessment responses and contact details are never sold to third parties or shared with any external organisation.
Assessments ask about your processes and controls — not individuals. Never include patient names, NHS numbers, or clinical data in your responses.