Thalix Health
Book a demo

AI and hospital operations

Do you need a DPIA for AI in the NHS?

Short answer

Yes. NHS England's information governance guidance says a Data Protection Impact Assessment (DPIA) must legally be completed before implementing AI-based technologies in health and care, to manage the likelihood and severity of harm to individuals and to show how the organisation meets UK GDPR's accountability principle and data protection by design and default.

Sources checked October 2026 · General information, not legal, regulatory or clinical safety advice

What the DPIA has to settle

  • Purpose and legal basis. Define and agree the purpose before any data is processed; the purpose drives the legal basis, and choosing it is the controller's job. Where AI informs a professional's decision about an individual's care, NHS England says UK GDPR Article 9(2)(h) (direct care) will generally apply, and consent may be implied under the common law duty of confidentiality. Research and public health uses need different bases.
  • Controllers and processors. Work out who is controller, joint controller and processor, and put contracts and data processing agreements in place. NHS England says health and care organisations should make sure they are the controller or joint controller when they contract with technology providers, because they decide the purpose.
  • Accuracy. Test rigorously, agree a clinically acceptable level of accuracy, examine suppliers' accuracy claims in procurement, check whether the system is a medical device, and make sure staff can review outputs.
  • Fairness and transparency. Check for discrimination (supported by an equality impact assessment), understand whether the system shares data with its developers, and tell people how their data is used before any new use starts.
  • Minimisation. Use the minimum data for the purpose and de-identified data where possible; NHS England mentions synthetic data as a privacy-enhancing option for early algorithm training.
  • Security. Record all movement and storage of personal data, review policies, and set out measures such as two-factor authentication, role-based access, audit logs, encryption and limits on downloads and exports.

Automated decisions and the human in the loop

NHS England describes most current health and care AI as augmented decision making: professionals make the final decision on care or treatment, taking the AI's output into account. It notes some automated uses already exist, such as staff rostering. Its guidance reminds organisations that people have a right under UK GDPR Article 22 not to be subject to automated decisions with legal or similarly significant effects, and that human review must be substantial, "not just a token gesture". Data law in this area is changing, so check the current ICO guidance with your DPO as well.

Hosted models and the DPIA

NHS England's ambient scribing guidance lists the data risks a DPIA should weigh for AI products: data leakage and compromised confidentiality in a supplier's hosted environment, difficulty governing privacy policies in externally hosted environments, and the "black-box" nature of third-party AI making impact assessments harder. It also says on-premises models carry risks of their own, to be managed with appropriate security and risk controls. A DPIA is also one of the documents a supplier may be asked to attach to a DTAC form.

What it does not mean

  • A supplier's DPIA isn't yours. The controller, which should be the health or care organisation, documents its own analysis.
  • "A clinician reviews it" isn't enough on its own. NHS England says human review must be substantial, not a token gesture.
  • Anonymised doesn't always mean anonymous. NHS England warns that combinations of details, such as a local area, a rare disease and a young age, can identify someone.

Where Thalix fits

Thalix is designed to make the DPIA simpler to write. Models run on the hospital's servers by default. Every model declares the data classes it may receive (operational, demographics, clinical; the default is operational only), and the kernel enforces that ceiling on every call, so a hosted model without a data processing agreement gets bed states and statuses but no names or results. Agents never see more than the person they act for, workflows never see names, and every read is in a hash-chained audit log. The DPIA, legal basis and transparency materials are still the hospital's to own.

Thalix is at pilot stage. Demos run on synthetic data, and a hospital deployment needs its own clinical safety case, information governance approval and security review. We don't claim any certification or assessment result the product doesn't have.

Questions people ask

Is a DPIA legally required before using AI in the NHS?

NHS England's IG guidance says a DPIA must legally be completed prior to implementing AI-based technologies in a health and care setting.

What legal basis covers AI used for direct care?

NHS England says that where data is processed to inform a health or care professional's decision about an individual's care, UK GDPR Article 9(2)(h) will generally apply, and consent may be implied under the common law duty of confidentiality.

Who should be the data controller when a trust uses an AI supplier?

NHS England says health and care organisations should ensure they are the controller or joint controller when entering agreements with technology providers, because they should be determining the purpose of the processing.

Sources

Each source below is an official page, read and checked in October 2026. Where a page and this guide differ, the official page wins.

General information only, written for hospital digital, IT, operations and clinical safety teams. It isn't legal, regulatory, information governance or clinical safety advice, and it doesn't replace your own organisation's processes or the official guidance linked above.

AI and hospital operationsOn-premises AI in hospitals: when patient data can't leave the buildingRunning AI on a hospital's own servers keeps patient data in-house but brings its own risks. What NHS guidance says about hosted and on-site models. AI and hospital operationsAI agents in hospital operations: what they can safely doAI agents can prepare, check and route hospital work while people decide. What NHS guidance says about oversight and liability, and a safe pattern. Clinical safety and assuranceThe NHS Data Security and Protection Toolkit (DSPT) explainedThe DSPT is the yearly self-assessment for organisations with access to NHS patient data and systems. Who completes it, the 2026-27 deadline and statuses. Clinical safety and assuranceIs AI software a medical device in the UK?Whether hospital AI software is a medical device depends on its intended purpose. How the MHRA's guidance draws the line, and what it means for buyers.

All guides

Thalix Health

See Thalix on a demo hospital.

A conversation with us is 45 minutes and free: the work you want to hand to agents, the systems involved, and where Thalix would and wouldn't fit. Demos run on synthetic patients.

Book a demo or email hello@thalixhealth.com