7 March 2025
How to Get Your Product Into the Healthcare Market: Navigating the GDPR Compliance Hurdle
By Jess Pembroke, Director of Information Law Services
Breaking into the healthcare market can be a daunting task. The industry is notoriously regulated, and rightfully so, given the sensitive nature of the data. However, compliance doesn’t have to be a barrier; it can be a powerful selling point. In this post, I’ll explore the necessary steps to help your product [NK1] meet healthcare compliance standards and the strategic advantages of doing so.
My journey in health started in the NHS in the 2000s, when information governance started to become more of a priority. NHS Digital started rolling out the Data Security and Protection Toolkit (DSTP) (then known as the Information Governance Toolkit) to help the NHS measure performance against the National Data Guardian’s 10 data security standards. Some of this rollout was in response to several high-profile data breaches by the public sector, as well as increasing public concern about the volume of data being processed and shared to deliver healthcare services.
Today, the healthcare market has evolved to include a variety of digital products, such as apps and games. These innovations have tremendous potential, but they also require a robust compliance strategy to gain traction.
1. Develop a Comprehensive Privacy Policy
Your privacy policy is your first opportunity to showcase your company’s data protection maturity. Ensure that your privacy policy is readily accessible to users, ideally on your website and written in plain language.
2. Train your Staff
Be prepared to evidence that everyone in your organisation understands their role in protecting data. Conduct regular training sessions for your staff and have staff policies on data protection. The Information Commissioners Office (ICO)[1] has free training courses, or there are a range of e-learning solutions on the market.
3. Design your products with Data Protection in mind
Integrate data protection into the design and development of your products from the outset. This proactive approach, known as Privacy by Design, involves considering privacy at every stage of development. By doing so, you can anticipate potential issues and address them before they become problematic.
In data protection compliance, a key document is called a Data Protection Impact Assessment (DPIA). This is sometimes legally required by the GDPR and is something customers with good compliance awareness may ask you for a copy of.
A DPIA helps you identify and mitigate data protection risks. By conducting a DPIA, you demonstrate to potential buyers that you have thoroughly considered the privacy implications of your product. If you make this DPIA available to buyers, it can showcase your commitment to data protection.
4. Ensure Data Security and Protection Toolkit Compliance (if necessary)
For products being considered for use within the NHS, compliance with the DSTP is critical. The DSTP provides a framework for ensuring that your product meets the NHS’s data security standards. For more information see: https://www.dsptoolkit.nhs.uk/
5. Be Proactive in Communication
Don’t wait for potential buyers to ask about your data protection practices. Take the initiative to highlight your compliance efforts and the measures you’ve put in place to protect user data. This proactive approach will instil confidence in your buyers and differentiate your product in the market.
Many NHS and public sector organisations will ask you to complete compliance questionnaires, so having these answers to hand is essential.
By understanding the history of information governance in the NHS and adopting best practices for data protection, you can position your product as a trusted and compliant solution.
Naomi Korn Associates can assist you in proactively demonstrating your compliance, so that you can show your commitment to data protection and build trust with potential buyers. We offer a range of practical services to help your business with Data Protection, Copyright and IP.
Naomi Korn Associates are thrilled to be new UKIE members and are offering UKIE members 15% off our comprehensive CPD accredited training courses. For more information, find us in the UKIE Directory of Member Benefits or email our Training Manager at info@naomikorn.com.