why...to pass the DTAC

The following pointers should also help to make your DTAC assessment a smooth ride:

● Adopt an exam technique to all the paperwork. It helps to organise your documentation against the specific requirements – and only include relevant information. Some sort of indexing system or evidence tracker will be immensely helpful, given all the paperwork.

● Be aware of differing lead times for any evidence which must be externally validated and ensure the evidence is indeed still valid and not outside of expiry dates.

● Expect the initial DTAC process to take two to three months. If it has taken longer than six months, that should be a warning bell that certain aspects are not in place.

● Then view the process – and the compliance it achieves - as a moving beast. Your digital product is being benchmarked against many regulations, which may change, and you may update your product or documents might expire and need to be re-submitted.

Finally – a simple bit of admin, but one which often causes delays in the DTAC process. Anybody who has access to administrative features, including the software developers, must be able to demonstrate multi-factor authentication. This involves having two separate pieces of identification logged.

Shortly after the launch of the DTAC, ORCHA was commissioned by developer Wellmind Health to achieve certification for two of its products – Pathway Through Pain and Be Mindful.

Commercial director Sarah Germaney said: “We were looking for something that would differentiate the quality of our apps, so that we could demonstrate that they had been assessed against accessibility, usability and data security.”

The Wellmind Health team had some background in NHS requirements as their products had featured on the NHS app library before the library was taken down. However, whilst they had many aspects covered, the DTAC brought in more requirements, particularly relating to privacy and quality, data sharing and cyber security. A cyber essentials assessment was required, and a data protection impact assessment.

Germaney said: “This was a real partnership with ORCHA, with much back and forth over several months. There are a lot of processes you have to have in place which rely on other factors.

“Overall, I would say to developers that this process is tough – it isn’t easy –because there’s a very robust examination of all your processes. They may be proved compliant, but many details still require thorough scrutiny. Our rationale for going through this was that we wanted anyone in the NHS to be confident that our products met all their criteria.”

As the Wellmind Health team has reflected, the DTAC gives valuable third-party validation, and this should give confidence when speaking with individual NHS organisations and reduce potential delays in the demonstrating compliance.

Getting through the process will take staying power but there are numerous support offerings available to digital health suppliers. These range from substantial offers where third-party organisations assume responsibility for certain sections of the DTAC to external quality assurance programmes which offer unlimited re-reviews aligned to your product roadmap. In all instances, do your homework and ensure that the solution you opt for is right for your business and reflective of your skills and competences.