Stage 2: Governance Assurance for NIR

An Information Security Management System (ISMS) is defined as that part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security.

This should be in line with ISO / IEC 27001 Information Security Management but does not require certification against this standard. Guidance is also provided within CIS 20.

Find out more about personal data.
Yes, Excludes Special Category Data
Yes, Includes Special Category Data
No, Excludes Special Category Data
No, includes Special Category Data

Find out more about personal data

If No 'NOT A MEDICAL DEVICE' please provide justification in the additional comments section in line with the Medicines and Healthcare (products) Regulatory Agency (MHRA) interactive guidance available here

If Yes please indicate the classification from the list below to confirm that MHRA requirements have been fully complied with:

• Class I
• Class IIa
• Class IIb
• Class III

The Manufacturer/Supplier MUST make available each Clinical Safety Case Report to a receiving organisation, which may be a Health Organisation or another Manufacturer

As a manufacturer/supplier of healthcare software, you must have a clinical risk management process that conforms to the DCB0129 standard. You must confirm and ensure that your CSCR and current Hazard Log are made available to all receiving organisations so they can complete their mandatory local DCB0160 assessments or another manufacturer for their clinical safety compliance. Additionally, NHSE reserves the right to request your CSCR and current Hazard Log at any time. By onboarding, you agree to make these documents available to NHSE upon request for compliance and auditing purposes.

Find out more about the DCB0129 standard for clinical risk management and its application in the manufacture of health IT systems.

As part of your clinical risk analysis and evaluation, you must evidence potential:

• causes (contributory conditions)
• patient harm outcomes
• mitigation plans against those harms

These must be described to determine severity, likelihood and an overall risk classification.

NHSE reserves the right to request your current Hazard Log at any time. By onboarding, you agree to make this document available upon request for compliance and auditing purposes.

We require this confirmation to ensure that end-users at your connected organisations are fully equipped to use the National Imaging Registry safely and effectively from Day 1. Updating your training documentation is a critical component of clinical risk management (aligning with DCB0129) and helps drive beneficial, real-world utilisation of the service.

Secure connection to the NIR relies on mutual TLS (mTLS) authentication. It is the supplier's responsibility to manage the entire lifecycle of these security certificates.

Because the NIR enforces strict zero-trust security controls, there is no grace period for expired or revoked certificates. If your certificate lapses, your system will be immediately disconnected, causing a hard outage that prevents local clinicians from querying or retrieving patient data. You must have proactive monitoring and renewal processes in place to prevent these clinical disruptions.

We require this confirmation to ensure that your organisation, acting as a Data Controller, maintains robust Information Governance (IG) and data management controls over any patient data interacting with the National Imaging Registry (NIR).

While the NIR facilitates the national exchange of diagnostic data, your organisation remains legally and operationally responsible for how that data is handled by your local systems (such as your local PACS, RIS or VNA).

We require this confirmation to verify that your organisation has thoroughly assessed and mitigated any privacy or Information Governance (IG) risks associated with connecting your local systems to the National Imaging Registry (NIR). Your DPIA must specifically evaluate the data flows, processing activities, and data sharing arrangements related to your chosen NIR integration scope (whether acting as a Provider, Consumer, or Both). To ensure executive accountability for information risk, this assessment must be fully signed off by your Trust's Senior Information Risk Owner (SIRO) or your Caldicott Guardian prior to submission.

To assist your Information Governance team with this submission, you can utilise the standard NIR DPIA template, which outlines the core national data flows and baseline risks. Furthermore, your local assessment and processing activities should be reviewed in conjunction with the overarching Data Sharing Agreement (DSA) under the DIP directive, which governs the legal basis and terms for sharing diagnostic data for direct care.

Under UK GDPR and data protection laws, patients have the right to know who has accessed their medical records. Your Trust must have processes in place to audit local user activity and extract these logs if a patient submits a Subject Access Request (SAR) regarding their NIR data. Confirming this ensures your Information Governance (IG) team is prepared to handle these legal requests using your local system's auditing capabilities.

We require this confirmation to ensure that your local clinical leadership is fully aware of how the NIR will alter existing diagnostic pathways. Formal clinical sign-off ensures that any workflow changes, user interface updates, or new clinical risks (identified under your DCB0160 assessment) have been reviewed, mitigated, and accepted by your organisation's clinical authorities prior to Go-Live.

This standard applies to the Healthcare Organisation that implements and uses the software to deliver patient care. They must complete a DCB0160 assessment to prove that the way the system is set up, configured, integrated, and used within their specific local clinical workflows is safe. We require this confirmation to ensure your Trust has formally assessed, mitigated, and accepted the clinical risks associated with deploying and using the National Imaging Registry (NIR) within your local clinical workflows.

NHS England reserves the right to request copies of your DCB0160 documentation (Clinical Safety Case Report or Hazard Log) at any time to verify ongoing compliance and support national safety assurance activities.

We require confirmation that your Trust has completed a comprehensive Clinical Safety Hazard Log that identifies potential risks (e.g., misidentification of patients, delayed retrieval of external images, or system downtime) and details the local mitigations your Trust has put in place.

NHS England reserves the right to request copies of your Hazard Log at any time to verify ongoing compliance and support national safety assurance activities.

This question focuses on Incident Management process and is separate from your formal Clinical Safety (DCB0160) risk management, though the two must closely interact.

Because your system will be connected to a national infrastructure, your local incident management must align with the broader NHS England framework. We require this information to ensure that any service disruptions, technical faults, or clinical safety incidents related to the NIR integration are managed safely and transparently. Because your system will be connected to a national infrastructure, your local incident management must align with the broader NHS England framework.

We require the incident management process to cover:

Categorisation & SLAs: How you classify incidents (e.g., Severity/Priority 1 to 4) and your target response/resolution times.

Communication: Your process for notifying connected End User Organisations (EUOs) about planned maintenance, degraded service, or unexpected outages.

National Escalation: How your support team will escalate critical API connectivity issues to the NHS England National Service Desk (e.g., via ServiceNow).

Clinical Safety: How technical incidents that pose a potential risk to patient care are flagged, triaged, and managed in alignment with your DCB0129 obligations.

You do not need to include a full policy here. However, NHS England reserves the right to request copies of your policy documentation at any time to verify ongoing compliance and support national safety assurance activities.

To use the National Imaging Registry (NIR), your organisation should have a publicly available privacy notice. It is recommended that the content of your privacy notice follows the guidance provided by the Information Commissioner's Office on what should be included.

Please ensure that you update your privacy notice to include reference to the NIR. You may wish to add the following suggested text to your privacy notice, or you may draft your own if you prefer.

You can find the NIR Privacy Notice here

We require this confirmation to ensure that once your connection to the NIR goes live, your organisation is fully prepared to manage and support it operationally on a day-to-day basis.

While incident management covers unexpected outages, your Standard Operating Procedures (SOPs) should cover your 'Business As Usual' (BAU) activities.

Sending incorrect data to the NIR introduces severe clinical risk. You must ensure that all patient demographics (such as NHS numbers), clinical metadata, and technical payloads are strictly validated locally before they are exposed to the national network. This prevents patient misidentification, maintains national data integrity, and minimises API rejections.

The National Imaging Registry (NIR) is architected entirely around the NHS Number as the sole unique identifier to securely locate, link, and retrieve patient diagnostic records across different healthcare organisations. The NIR can only retrieve data via the NHS number.

Using unvalidated, temporary, or missing NHS numbers introduces clinical safety risk, such as failing to discover critical diagnostic history. By confirming this, you assure that your organisation has robust processes in place to verify patient identities locally. You must ensure that only officially validated NHS numbers are used when querying the NIR or exposing local data to the national network. Local hospital numbers or temporary IDs are not permitted for NIR transactions.