Hi
Apologies for the delayed response to your query.
Building an APP and running a pilot in a GP setting involves understanding and planning around frameworks such as DTAC and the DSP Toolkit, both of which ensure that digital solutions meet NHS England’s standards for clinical safety, data protection, security, interoperability, and usability.
While a fully signed-off DTAC is not always required before a small-scale pilot, App developers should show that they can meet its criteria and ensure robust data governance, particularly if real patient data is used. This means aligning early with the DSP Toolkit, conducting a DPIA (Data Protection Impact Assessment) if necessary, and following clinical risk management standards (DCB0129 and DCB0160) if the app influences patient care or clinical decisions. More details at : https://digital.nhs.uk/services/clinical-safety/clinical-risk-management-standards
Before launching a pilot, it is essential to secure agreements with the GP practice or practices involved, check with local and regional bodies such as the ICB and NHS England (especially if the pilot requires use of national infrastructure), and document all aspects of clinical safety, risk management, and data protection.
The GP leadership team and local IG or DPO resources should be consulted for any necessary permissions, data-sharing agreements, or formal approvals. Successful pilots require clear scoping of the app’s functionality and scale, proper technical setup, and robust documentation of outcomes, risks, and security measures, enabling smoother progression toward full DTAC approval and wider rollout.
Some additional resources to support your work can be found here:
https://digital.nhs.uk/developer/guides-and-documentation/building-healthcare-software/general-practice
https://digital.nhs.uk/developer/getting-started
You might also want to take a look at our introduction to healthcare technology and our building healthcare software guides
Thanks,
NHS England API Platform team
Please note: The API Platform team can only address queries relevant to the NHS England API platform, including security, rate limiting, logging, monitoring and alerting. For any API specific queries, please reach out the relevant API teams.