NHS & Healthcare IT Disposal: Patient Data Destroyed with Evidence
Retired clinical and administrative devices carry some of the most sensitive data held anywhere in the UK. We destroy patient data with per-serial evidence, on hospital sites where required, and hand your information governance team a pack built for DSPT submissions, Caldicott sign-off and inspection day.
Who provides IT asset disposal for NHS and healthcare organisations?
Nanosoft sanitises and destroys patient-data devices for NHS trusts, GP practices, clinics and care providers across the UK, to NIST 800-88, with witnessed destruction available on hospital sites. Every serial number is certificated individually, and the audit pack is built to slot into DSPT submissions and information governance reviews.
What the rules require, and how we evidence it
The regimes below are the ones your auditors and regulators actually cite. For each, here is what it requires of your organisation and the evidence we put in your hands.
NHS Data Security and Protection Toolkit (DSPT) 2025-26
DSPT 2025-26 is version 8, aligned to the NCSC Cyber Assessment Framework (CAF): objectives A to D plus the NHS-specific Objective E, with a publication deadline of 30 June 2026. Secure disposal of data-bearing assets sits inside the evidence base your organisation must publish against.
How we evidence it
Per-serial destruction certificates, chain-of-custody records and a reconciled asset inventory that slot directly into your DSPT submission as disposal evidence, mapped to the assets your IG team declares.
The eight Caldicott Principles
Confidential patient information must be protected across its whole lifecycle, disposal included. The eighth principle, added in December 2020, requires organisations to inform patients about how their confidential information is used, which presumes the organisation can account for it to the end.
How we evidence it
An unbroken, documented chain from ward or office to verified destruction, so your Caldicott Guardian can sign off that confidentiality was preserved through disposal and account for every device that held patient information.
CQC inspection evidence
The CQC regulates health and social care providers, not their disposal contractors: an ITAD cannot be CQC-registered. What inspected providers must be able to show is that patient records and data-bearing devices were disposed of securely.
How we evidence it
Audit-ready disposal evidence your team can present at CQC inspections: serialised inventories, destruction certificates and custody records, organised so they can be produced on the day without preparation.
UK GDPR special-category data
Health data is special-category data under UK GDPR, carrying heightened security obligations and a duty to demonstrate that personal data on retired devices has been irreversibly destroyed, not merely deleted.
How we evidence it
NIST 800-88 sanitisation or physical destruction for every device, evidenced serial by serial, so your records show exactly what was destroyed, when, how and by whom.
Deliverables on every nhs & healthcare engagement
- Per-serial certificates of data destruction for every drive and device
- Witnessed destruction on hospital sites, with certificates issued before we leave
- Crews briefed on clinical-equipment handling and embedded storage in medical devices
- A consolidated audit pack delivered to your IG team within 10 working days
- Chain of custody with numbered tamper-evident seals from your site to our processing floor
What goes wrong without evidence
Unaccounted drives from retired clinical devices
Imaging workstations, diagnostic equipment and clinical terminals often hold storage that a standard IT inventory misses. A single unaccounted drive containing patient data is a reportable incident waiting to be found, years after the device left the building.
Subcontracted couriers breaking custody
Many disposal firms hand collections to courier networks the moment they leave your site. Every handoff is a gap in the custody record, and it is your organisation, not the courier, that answers to the ICO and your patients if media goes missing in transit.
Batch certificates failing IG audits
A certificate saying "40 drives destroyed" cannot prove that any specific drive was among them. Information governance audits increasingly ask for per-serial evidence, and batch-level paperwork discovered at audit time cannot be repaired retrospectively.
Frequently asked by nhs & healthcare clients
Ready to dispose of NHS & Healthcare IT equipment with the evidence built in?
Same-day quote, no obligation. Tell us what you have and where it is, and we confirm a collection slot and a fixed price the same day.