Keelforge
Health and social careAnonymisedWonFresh

The Caldicott Guardian's questions answered before the meeting

Every remote consultation bid the trust had seen used the same generic-risk paragraph. This one named the harm, named the mitigation and named the Caldicott Guardian by role and by attendance date.

NHS trust, remote consultation platform · £1-10m · 6-12 months · Published 14/08/2026

Context

NHS trust procuring a remote consultation platform. The Information Governance assessment sat on the critical path to service go-live.

Challenge

Prior bids had used generic Information Governance copy. The trust's Caldicott Guardian had rejected three bids in the previous 18 months for insufficient specificity on data flows and named accountability.

Approach

The bid response was written after a direct engagement with the trust's Caldicott Guardian, not as a generic response. The data flow diagram was sketched in the meeting and refined against the actual clinical workflow. The DPIA was drafted with the harm, mitigation and owner triad for every processing activity.

Governance

Named Caldicott engagement documented in the bid response with the actual engagement date. DPIA and ROPA current at submission. Data flow diagram signed off by the Caldicott Guardian before commercial close.

Outcome

Won. The trust used the engagement pattern as the reference for how future bidders should engage with Information Governance during pre-tender. Source: [Caldicott principles - UK Caldicott Guardian Council](https://www.gov.uk/government/publications/the-caldicott-principles).

Reference back

This case demonstrates:

  • NHS data governance and IG fluency
  • Clinical safety by design