These documents demonstrate that GP Automate meets the clinical safety and technical security standards expected of a digital health technology processing NHS patient data, including lab results.

Compliance and safety documents

These documents demonstrate that GP Automate meets the clinical safety, information governance, and security standards expected of a digital health technology processing NHS patient data, including lab results.

DTAC (Digital Technology Assessment Criteria)

Last updated: 11 September 2026

What it is: An NHS framework used to assess digital health technologies before procurement. It covers five areas: clinical safety, data protection, technical security, interoperability, and usability/accessibility.

Relevance to GP practices: ICBs and practices use DTAC as a standard checklist when deciding whether to adopt or continue using a supplier's product. An up to date DTAC submission shows GP Automate meets the minimum NHS criteria across all five domains, reducing procurement friction and supporting local information governance sign-off.

DCB0129

Last updated: 11 September 2026

What it is: The NHS clinical risk management standard for manufacturers of health IT systems. It requires GP Automate to run a formal clinical risk assessment, maintain a hazard log, and appoint a Clinical Safety Officer accountable for the product's clinical safety.

Relevance to GP practices: GP Automate's core function is processing normal and abnormal lab results, where a hazard (for example a missed abnormal result) could cause direct patient harm. DCB0129 evidence shows practices that clinical risks in this process have been identified, assessed, and mitigated, which practices typically need to see before deploying or continuing to use the product safely.

MHRA Class I Medical Device Registration

Last updated: 26 October 2026

What it is: a Class I Medical Device is a low-risk health product or tool regulated under the UK Medical Devices Regulations 2002. See the link below for GP Automate's registration for lab reporting automation.

Relevance to GP practices: Class I MHRA registration is a baseline regulatory requirement for medical device or software providers to operate in the UK. Practices can be assured that GP Automate adheres to MHRA's stringent standards.

https://pard.mhra.gov.uk/manufacturer-details/119488

Cyber Essentials

Last updated: 14 September 2026

What it is: A UK government-backed certification scheme that verifies an organisation has basic technical controls in place against common cyber threats, covering areas such as firewalls, access control, malware protection, patch management, and secure configuration.

Relevance to GP practices: GP Automate renews Cyber Essentials certification annually and maintains cyber insurance cover, giving practices ongoing assurance that baseline security controls are reviewed and maintained year on year.

Penetration test reports

Last updated: 04 September 2026

What it is: An independent security assessment where testers simulate real-world cyber attacks against GP Automate's systems to identify exploitable vulnerabilities before malicious actors can.

Relevance to GP practices: Practices connect GP Automate to systems handling patient data, including lab results. Pen test reports give practices and their IT leads assurance that the platform has been tested against unauthorised access and data breach risks, supporting their own DSPT (Data Security and Protection Toolkit) compliance.

Availability: The full pen test report is available on request by contacting support@gpautomate.com.