In short: Cyber security training for healthcare helps GP practices, dental practices, pharmacies, care homes and other providers meet the Data Security and Protection Toolkit (DSPT) expectation that all staff have an appropriate understanding of information governance and cyber security. It combines a training needs analysis, role-based modules, phishing simulation and records.
What the DSPT expects on staff training
The Data Security and Protection Toolkit is the annual self-assessment that organisations with access to NHS patient data and systems complete. The 2026-27 edition (version 9) was published in October 2026.
The training expectation has changed over recent years:
- The old fixed requirement for 95% of staff to complete annual training was removed from the 2023/24 edition
- Organisations now need to show that all staff have an appropriate understanding of information governance and cyber security
- The practical way to show that is a training needs analysis: what each role needs to know, how it is delivered and how often
- Larger NHS organisations, such as trusts and integrated care boards, now complete a version aligned to the NCSC's Cyber Assessment Framework (CAF); other organisations complete versions proportionate to their size
Check the current DSPT edition and guidance for your organisation type, as assertions and evidence items change from year to year.
A training needs analysis in practice
A training needs analysis does not need to be complicated. For each group of staff, record what they handle and what they need:
| Staff group | Typical exposure | Training focus |
|---|---|---|
| Reception and admin | Patient calls and emails, appointment systems, payments | Phishing, verifying callers, sending information to the right recipient |
| Clinicians | Clinical systems, shared workstations, mobile devices | Locking screens, smartcard and account security, safe messaging |
| Practice and care home managers | Payroll, suppliers, system admin rights | Payment fraud, business email compromise, admin account security |
| Care workers | Care records on tablets or phones, often away from a desk | Short mobile-friendly lessons, device security, reporting lost devices |
| Pharmacy staff | Prescription and patient systems, customer enquiries | Phishing, identity checks, data handling at the counter |
Review the analysis each year, after any incident and when systems change, and keep it with your DSPT evidence.
Topics that matter in health and care
Alongside the core cyber security awareness training curriculum, health and care staff benefit from content on:
- Patient data under UK GDPR: health data is special category data, and staff should understand the Caldicott principles in plain terms; see GDPR training for staff
- Misdirected information: checking email addresses and recipients before sending results, letters or referrals
- Shared workstations: logging out, locking screens and never sharing smartcards or passwords
- Phishing and fake supplier invoices, which target practice managers and finance staff
- Social engineering by phone: callers claiming to be a patient, relative or another clinician; see social engineering training
- Lost or stolen devices and how to report them quickly
- Ransomware: what staff should do if a system starts behaving strangely; see ransomware awareness training
GP, dental, pharmacy and care home considerations
Smaller providers rarely have in-house security staff, so the programme needs to be low-admin.
- GP practices: often part of a primary care network with shared staff, so agree who enrols whom and keep records for each practice
- Dental practices: mixed NHS and private work, card payments and patient imaging; include the whole team, not just clinicians
- Pharmacies: counter staff turn over frequently, so automatic enrolment for new starters is essential; see security induction training
- Care homes and home care: many staff work shifts or away from a desk, so choose short lessons that work on a phone
A platform that syncs with your Microsoft 365 or Google Workspace tenant can enrol staff automatically and produce completion reports you can use as DSPT evidence.
Evidence for the DSPT
Keep together:
- Your training needs analysis and the date it was last reviewed
- Completion records per person and per course, exported from your platform
- Phishing simulation results and trends, to show understanding as well as attendance
- Policy acknowledgement records, for example through usecure uPolicy
- Notes of any incidents and the extra training that followed
See measuring security awareness training for the measures that show real understanding rather than just completion, and is security awareness training a legal requirement in the UK? for the wider regulatory picture.
How we help health and care providers
We help you write the training needs analysis, choose a platform from the vendors we supply, assign role-based content, run phishing simulations and produce the records you need for the DSPT. Our managed security awareness training service means practice and home managers do not have to run it themselves.
Contact us to plan DSPT-ready training for your team.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is the 95% DSPT training target still in place?
No. The fixed 95% annual training requirement was removed from the 2023/24 edition. Organisations now need to show that all staff have an appropriate understanding of information governance and cyber security. A training needs analysis is the practical way to plan and evidence that.
What is a training needs analysis for the DSPT?
A record of what each staff group needs to know about data security and cyber security, how the training is delivered and how often. It should be reviewed regularly and kept with your DSPT evidence.
Do care homes need to complete the DSPT?
Care providers that access NHS patient data or systems, such as NHSmail or shared care records, are generally expected to complete it. Check the current DSPT guidance for your organisation type.
Can phishing simulation be used in healthcare settings?
Yes, with care. Avoid lures that could disrupt patient care or cause real distress, agree the approach with management first, and focus on reporting rather than blame.