Context
NHS trust procuring a remote consultation platform. The Information Governance assessment sat on the critical path to service go-live.
Challenge
Prior bids had used generic Information Governance copy. The trust's Caldicott Guardian had rejected three bids in the previous 18 months for insufficient specificity on data flows and named accountability.
Approach
The bid response was written after a direct engagement with the trust's Caldicott Guardian, not as a generic response. The data flow diagram was sketched in the meeting and refined against the actual clinical workflow. The DPIA was drafted with the harm, mitigation and owner triad for every processing activity.
Governance
Named Caldicott engagement documented in the bid response with the actual engagement date. DPIA and ROPA current at submission. Data flow diagram signed off by the Caldicott Guardian before commercial close.
Outcome
Won. The trust used the engagement pattern as the reference for how future bidders should engage with Information Governance during pre-tender. Source: [Caldicott principles - UK Caldicott Guardian Council](https://www.gov.uk/government/publications/the-caldicott-principles).
Reference back
This case demonstrates:
- NHS data governance and IG fluency
- Clinical safety by design