Ensure it has registered with the UK Information Commissioners Office (ICO), where applicable. You use the ICO’s registration self-assessment tool to determine whether your organisation needs to register.

Provide details of a nominated Data Protection Officer (DPO) if your organisation is required to have one. Also, if your organisation (or its products) routinely processes patient identifiable information, then it is likely to require a DPO.

Comply with the NHS Data Security and Protection Toolkit (NHS DSP Toolkit).

Conduct and submit a Data Protection Impact Assessment (DPIA). The DPIA should clearly demonstrate that your organisation has taken the nature, scope, context and purposes and processing and the sources of any data protection risks, into account, assessed the risks, and treated risks in proportion to the threat they may pose.

Also, ensure that any data your organisation may process outside of the UK is processed in line with current legislation.

Be Cyber Essentials or Cyber Essentials Plus

Provide evidence of external penetration testing of your organisations product/(s). The penetration test must include a review of Open Web Application Security Project (OWASP) Top 10 vulnerabilities from within the previous 12-month period and the assessment report must demonstrate that there are no vulnerabilities that score 7.0 or above using the Common Vulnerability Scoring System (CVSS).

Confirm that all custom code has been security reviewed.

Verify all privileged accounts have Multi-Factor Authentication enabled.

Validate that logging and reporting requirements are clearly defined.

Guarantee that your organisations product/(s) have been load-tested.

The APIs, with particular regard to any API connections – setting out the healthcare standards for interoperability that are met (e.g., Health Level Seven International (HL7) / Fast Healthcare Interoperability Resources (FHIR).

Adherence to Government Digital Services Open API Best Practice.

The documentation and free availability of APIs.

Reasonable access for third party connectivity.

The use of the NHS number to identify patient data, NHS Login to establish a user’s verified NHS number, unless the product does not identify patient record data or there is a legitimate rationale for not using the NHS number/Login.

Your products your capability for read/write operations with electronic health records (EHRs) using industry secure interoperability standards (e.g. OAuth 2.0, TLS 1.2 or greater).

Your products compliance with ISO/IEEE 11073 Personal Health Data (PHD) Standards if it is a wearable or device.

Engage users in the development of your product/(s) and consider user needs in product development lifecycles – 10%

Map all key user journeys to ensure the whole user problem is solved (or it is clear to users how it fits into their pathway or journey) – 10%

Undertake user acceptance testing – 10%

Ensure Web Content Accessibility Guidelines (WCAG) 2.1 level AA compliance – 20%

Publish an accessibility statement – 10%

Operate a multidisciplinary team – 2.5%

Adopt agile ways of working in product development – 2.5%

Ensure continuous product improvement – 5%

Have a benefits case that includes your organisations objectives and the benefits it will be measuring – 10%

Be aligned with the NHS Cloud First strategy and policy – 5%

Use and contribute to open standards, common components, and patterns – 5%

Operate a reliable service with Service Level Agreements for all customers – providing customers with reports regarding support and product performance and availability. – 10%