A digital social care record, usually shortened to DSCR, is the electronic record of a person's care held by a care provider: their assessment, care plan, daily notes, medicines, risk assessments and the other information that used to live in a paper folder. In England, NHS England's digital social care records programme set the expectation that CQC-registered providers would hold their records this way, and by now most care homes do. This guide explains what a DSCR is, what the assured supplier list and the Data Security and Protection Toolkit actually require, and what a care home needs in place around the software for the record to stand up to a commissioner, an inspector or an information governance audit.
The short answer
There is no law that bans paper records, but CQC, local authorities and the NHS now treat a digital social care record as part of good governance, and a home still on paper should expect to be asked why. Having a DSCR means more than buying software. It means choosing a system that meets recognised standards, usually from the assured supplier list; completing the Data Security and Protection Toolkit every year; being clear that you are the data controller and the supplier is your processor, with a contract that says so; giving every member of staff their own log-in; having devices and connectivity that work throughout the building; keeping a business continuity plan for when the system is down; and knowing how you would get your data out. The rest of this article works through each of those.
At a glance: paper, a basic electronic record, and a full DSCR
The table shows how three ways of keeping records compare on the things that matter to a manager, so you can see where your own home sits.
| Question | Paper records | Basic electronic record | Full digital social care record |
|---|---|---|---|
| Who wrote this and when? | Signature and handwriting | Login, often shared | Individual login, timestamp, full audit trail |
| Can the manager see gaps today? | Only by reading every folder | Partly, if reports exist | Yes, on a dashboard the same shift |
| Can it be shared with the NHS? | By phone, fax or photocopy | By export | Structured, with a roadmap to direct sharing |
| Is the data secure and backed up? | Locked cabinet, no copy | Depends on hosting | UK hosting, tested backups, DSPT-aligned |
| Does it meet a recognised standard? | No | Rarely | Assured supplier list and PRSB standards |
| What happens if the system fails? | Nothing changes | Often no plan | Documented continuity plan and paper fallback |
What digital social care records actually means
The phrase is used loosely, so it is worth being precise. A digital social care record is the person's record, held electronically, that a care provider is required to keep under Regulation 17 and under the Care Act 2014 and data protection law. It is not the same as a rota system, a staff app or a family portal, though a DSCR may include those. The record itself covers assessment, care plan, risk assessments, daily notes and charts, medicines administration, incidents and safeguarding, consent and capacity decisions, and the communications about the person with professionals and family.
The NHS England programme, delivered through what was Digitising Social Care, set out to move providers from paper to digital records so that care information could be shared with the NHS and used to improve care. The programme funded implementations through integrated care systems, published an assured supplier list, and set adoption targets. Its practical legacy is that a DSCR is now the norm, and the expectations around it (standards, security, sharing) have become the questions commissioners and inspectors ask.
Why CQC and commissioners now expect a DSCR
CQC does not require a particular record system, but the single assessment framework rewards what a DSCR does well: evidence that can be produced quickly, records that are contemporaneous and attributable, patterns visible over time, and governance the manager can demonstrate. Inspectors routinely ask for read-only access to the electronic care recording system on the day and use it to follow residents through their records. A paper home has to produce the same evidence by hand, and the finding that the provider's systems did not identify concerns is much harder to avoid without the reports a digital system produces.
Local authority and integrated care board commissioners ask about digital records in tenders, quality monitoring visits and contract reviews, partly because of the NHS England programme and partly because they want to receive information electronically. Some contracts now state an expectation. If your home is on paper, have a plan and a timescale ready, because the question will be asked.
What a DSCR has to contain for a care home
Whatever system you use, the record needs to hold what the regulations and good practice require. For each resident: a pre-admission assessment; a care plan covering physical, mental, social, communication and cultural needs, preferences and goals, with review dates and history; risk assessments for each identified risk with scores, controls and version history; a personal emergency evacuation plan; consent and capacity records including any DoLS; daily notes and charts for food, fluid, repositioning, bowels and behaviour as needed; medicines administration records; incidents and accidents with reviews; safeguarding records; complaints; and communications with professionals and family.
For learning disability and mental health services the record also needs easy-read plans, health action plans, communication passports, positive behaviour support plans and ABC records. The care records module of any system you consider should be able to show all of these for a single resident on one screen, not spread across separate products.
The assured supplier list and what it does and does not mean
NHS England maintains an assured solutions list of digital social care record suppliers that have demonstrated they meet a set of standards covering functionality, information governance, security, and a roadmap towards sharing information with NHS systems. Funding through the DSCR programme was tied to choosing a supplier from the list, which is why most care homes have one.
The list is a useful baseline. It tells you the product has been checked for a core set of capabilities and for security posture, and that the supplier has committed to interoperability. It does not tell you that the product suits a learning disability home, that staff will use it on a night shift, or that the supplier's support will answer at the weekend. Treat the list as a filter, then test the product in your own home. Ask any supplier not on the list to explain why, and what standards they meet instead; there are legitimate reasons, but the question should be asked.
The Data Security and Protection Toolkit
The Data Security and Protection Toolkit, DSPT, is the annual self-assessment that health and care organisations complete to show they handle personal data properly. Care homes are expected to complete it, commissioners and the NHS ask for it, and access to NHSmail, GP Connect and shared care records depends on it. There are two levels for social care providers, Approaching Standards and Standards Met, and the aim is Standards Met.
The DSPT asks about your policies, staff training in data security, access control, device security, backups, business continuity, incident management and the systems you use. A DSCR supplier should be able to give you the information you need to answer the questions about their product: where data is hosted, how it is encrypted, how backups work, what certifications they hold. Keep the DSPT submission date in the governance calendar, because letting it lapse cuts off NHS services and raises questions at the next quality visit. The Digital Care Hub publishes guidance written for care providers that makes the toolkit manageable.
UK GDPR, special category data and the DPIA
Care records are special category data under UK GDPR because they concern health, and often other protected characteristics. Processing them lawfully requires a lawful basis under Article 6 and a condition under Article 9, which for care providers is usually the provision of health or social care. You need a privacy notice for residents and families that says what you hold, why, who you share it with and for how long, in a format people can understand, with an easy-read version where appropriate.
Moving to a digital record is a change in processing that is likely to require a data protection impact assessment. A DPIA is not a long document; it records what you are doing, the risks to people's data, and the measures you take. The DSCR supplier should be able to supply the technical information for it. Keep the DPIA with the DSPT evidence and review it when you add modules or change suppliers. Our guide to digital records versus paper covers the practical side of the transition.
Controller, processor and the contract
Under UK GDPR your organisation is the data controller for residents' records and the software supplier is your processor. That relationship needs a written contract or data processing agreement that sets out what the processor may do with the data, the security measures, the use of sub-processors such as hosting companies, what happens on a breach, and what happens to the data when the contract ends. Most suppliers have a standard agreement; read it, particularly the sections on termination and export.
Ask about sub-processors by name and by country. The data should be hosted in the UK. Ask whether the supplier ever uses your data for anything other than providing the service to you, including product development or analytics, and whether that is optional. A supplier that cannot answer these clearly is not ready to hold special category data on your behalf.
Hosting, separate databases and backups
Where and how the data is held is a practical question with regulatory weight. UK hosting keeps you clear of international transfer rules. A separate database for each provider organisation, rather than every customer's data in one shared database, reduces the blast radius of any error and makes export and deletion clean. Backups should be automatic, frequent, held separately from the live system, encrypted, and restored successfully on a test at least once a year.
Ask the supplier when they last restored from backup and how long it took. Ask what their recovery time objective is and whether it is in the contract. Ask what happens to your data if the supplier ceases trading; escrow arrangements exist and are worth asking about for a small supplier. Kiwi, for example, keeps a separate database per organisation on a UK server with nothing installed on your devices, and other suppliers will have their own answers. What matters is that you know yours.
Access control: every person, their own log-in
The single most common information governance failure in care homes is shared log-ins. A tablet at the nurses' station logged in as senior all day means every entry is unattributable, the audit trail is meaningless, and a leaver still has access. Every member of staff, including bank, agency and volunteers who record anything, needs their own account with permissions set for their role and removed the day they leave.
Agency staff need a solution that is quick enough to be used: an account created for today's shift, giving access to the residents that worker is supporting and nothing else, expiring automatically. Permissions should be granular, so that a care worker can record but not change a care plan, a senior can administer medicines, and only the manager can delete or audit. The system should log every view as well as every change, so you can answer the question of who looked at a record and when.
Devices, connectivity and offline working
A DSCR is only as good as the device in the carer's hand. Plan for enough devices that staff are not queuing, for charging, for wipeable cases, for mobile device management that can lock or wipe a lost device, and for a policy on personal phones. Wifi needs to reach every bedroom, the garden and the car if you record community activity; survey the building before go-live and expect to add access points.
Where signal cannot be guaranteed, the system needs to work offline and synchronise when it reconnects, without losing or duplicating entries. Test this deliberately during the pilot by walking to the worst corner of the building and recording a full round. Browser-based systems with nothing to install are easier to manage across a mixed fleet of devices, but check how they behave offline before assuming.
Business continuity when the system is down
Every DSCR home needs a written plan for the hours or days when the system is unavailable, whether because of the supplier, the internet connection or a power cut. The plan should say how staff record care on paper in the meantime, where the paper templates are kept, who decides to invoke the plan, how the paper records are entered into the system afterwards and by whom, and how medicines are administered safely without the eMAR, including a printed MAR for each resident that is refreshed at a set interval.
Print or export a summary of each resident's essential information (medicines, allergies, key risks, PEEP) at a regular interval so it exists outside the system. Test the plan once a year by running a shift on paper and entering the results afterwards. Inspectors ask about this, and the DSPT asks about it, and a home that has rehearsed it is in a very different position from one that has a policy on a shelf.
Sharing with the NHS: GP Connect, shared care records and NHSmail
One of the aims of the DSCR programme was to let care information flow between care homes and the NHS. In practice this means several things a care home can use now. NHSmail gives secure email for sending and receiving clinical information. GP Connect lets authorised care home staff view parts of a resident's GP record, including medicines and allergies, which changes the quality of admissions and medicines reconciliation. Shared care records run by integrated care systems let care homes see, and in some areas contribute to, a wider record.
Access to all of these depends on the DSPT being at Standards Met. Ask your DSCR supplier what their roadmap for direct integration looks like and what is live today. Even without direct integration, a system that can export a structured summary for a hospital transfer, in the form of a hospital passport, is the practical minimum.
Record standards: the PRSB and About Me
The Professional Record Standards Body publishes standards for what a digital social care record should contain and how it should be structured so that information means the same thing in every system. The About Me standard captures what matters to the person in their own words, and is the digital cousin of the one-page profile familiar in learning disability services. Standards for the core record, for medicines and for transfers of care exist alongside.
You do not need to read the standards yourself, but you should ask whether your supplier follows them, because it affects whether your records can be shared and whether they will still make sense in ten years. A system whose care plan includes About Me, and whose hospital passport follows the transfer standard, is showing that it has taken this seriously.
Training, digital skills and confidence
A DSCR changes what every member of staff does several times an hour, and the training has to reflect that. Skills for Care's digital skills framework sets out the levels of competence expected across care roles, from using a device safely to understanding data protection. Practical training should be short, on shift, repeated, and delivered by champions from within the team rather than in a single classroom day.
Data security training is a DSPT requirement and needs refreshing annually. Beyond the mandatory content, the training that matters is: how to write a good note quickly, how to record an incident properly, how to use the resident's plan on screen while giving care, and what to do when the device will not connect. Confidence follows practice, and the homes that succeed protect the first fortnight with extra support on every shift.
Retention, export and the right to leave
Care records must be kept for the retention period set out in your records policy, with the NHS Records Management Code of Practice as the usual reference for adult social care, and they must remain readable for that whole period. That means your DSCR needs to give you a full export, in a format you can open without the supplier's software, both routinely and when you leave. Ask for a sample export during procurement and check that it includes notes, plans, medicines records, incidents and attachments such as photographs and body maps, with the audit trail.
Ask what export costs, how long it takes, and how long the supplier keeps your data after the contract ends before deleting it. Our guide to switching systems without losing records walks through the process in detail. A supplier that makes leaving difficult is telling you something about the relationship.
A procedure for putting a DSCR in place
The steps below cover the governance and infrastructure around the software. The software implementation itself is covered in our guide to where to start with care home management software.
- Confirm your organisation's DSPT status and set the renewal date in the governance calendar.
- Write or update the records policy, privacy notice and easy-read version, and complete a DPIA for the new system.
- Shortlist suppliers, using the assured supplier list as a filter, and obtain their data processing agreement, hosting details and a sample export.
- Survey the building for wifi and specify devices, cases, charging and mobile device management.
- Create individual accounts for every member of staff with role-based permissions, and agree the process for agency access and leavers.
- Write and print the business continuity plan and the paper fallback templates.
- Pilot one module on one unit, test offline working and export, and record staff feedback.
- Go live module by module, refresh training at two weeks and two months, and run the first records audit at three months.
A readiness checklist
- DSPT at Standards Met, with the renewal date diarised.
- Records policy, privacy notice and DPIA current and covering the DSCR.
- Data processing agreement signed, sub-processors listed, UK hosting confirmed.
- Backup and restore tested, recovery time known, supplier failure plan understood.
- Every user has their own account; leavers removed same day; agency access limited to the shift.
- Devices sufficient, managed and wipeable; wifi covers the building; offline working tested.
- Business continuity plan written, paper fallback printed, tested in the last year.
- Export obtained and opened without the supplier's software.
- Staff trained in data security annually and in the system on shift.
- Resident and family information about the record available in accessible formats.
What commissioners and inspectors ask about your DSCR
Quality monitoring officers and inspectors ask a fairly consistent set of questions. Which system do you use and is it on the assured list? What is your DSPT status? Can I have read-only access today? How do agency staff record? What happens when the system goes down? How do you audit the records? Show me a resident's record from admission to today. How do you share information with the GP and the hospital?
The strongest answer to all of them is to demonstrate rather than describe. Set up the read-only access in two minutes, open a resident, show the audit trail, show the agency log-in, show the continuity folder, show the last records audit with its findings, and show the compliance dashboard the manager uses each morning. Three-tap daily logs with photographs and body maps, and an eMAR with a complete audit trail, are the parts of the record inspectors spend longest in.
Learning disability and mental health homes: accessible records
In services for people with a learning disability or autistic people, and in many mental health homes, the record has a second audience: the person themselves. A DSCR that can produce an easy-read version of the care plan, a one-page profile, a health action plan and a hospital passport in a format the person can use is meeting the accessible information standard as well as the regulations. Ask suppliers to show these, and ask how the person's own contributions, such as photographs and their own words, are captured.
The record also needs to handle restrictive practice, positive behaviour support and capacity decisions with the care that Right support, right care, right culture expects. A system built for elderly residential care and adapted will often lack these, and the gap shows on inspection.
Common mistakes
- Buying software and assuming the DSCR is done, with no DSPT, DPIA, contract review or continuity plan.
- Shared log-ins on the unit tablet, making every entry unattributable.
- Letting the DSPT lapse and losing NHSmail and GP Connect access.
- Never testing the export until the day you decide to leave.
- Wifi that does not reach the far bedrooms, discovered after go-live.
- A business continuity plan that exists on paper but has never been run.
- Treating the assured supplier list as a guarantee that the product suits your service.
- Forgetting the resident and family privacy notice, especially in accessible formats.
What good looks like on inspection day
The inspector asks which system the home uses and whether it is on the assured list, and the manager answers and adds that the DSPT is at Standards Met with the renewal date next April. Read-only access is set up in two minutes on a spare tablet. The inspector opens a resident and sees the assessment, a care plan with review history, versioned risk assessments and a PEEP, the last month of daily notes with body maps, the MAR with every dose accounted for, and an incident with its review, all attributed to named staff with timestamps. They ask an agency carer on shift how they record and the carer shows a log-in created that morning. They ask what happens if the system fails and the senior brings the continuity folder with printed MAR summaries dated last week and the record of the paper drill in March. They ask how records are audited and the manager shows the quarterly records audit with its findings and actions. They ask about sharing with the GP and the senior shows GP Connect open on the medicines screen. Nothing needs to be fetched, and the record tells its own story.
Final conclusion
A digital social care record is now the expected way for a care home in England to hold its records, and the expectation extends well beyond the software: a recognised standard, an annual DSPT, clear data protection arrangements, individual access for every person who records, devices and connectivity that work, a rehearsed plan for when the system is down, and the ability to take your data with you. Put those in place around a system your staff will actually use, and the record becomes both the tool you run the home with and the evidence that you run it well.
Frequently asked
Is a digital social care record compulsory for care homes?
There is no law that bans paper, but NHS England set adoption expectations and CQC and commissioners now treat a digital record as part of good governance. A home still on paper should expect to be asked why and to have a plan and timescale ready. Most care homes in England now use one.
What is the DSCR assured supplier list?
It is the NHS England list of digital social care record suppliers that have shown they meet standards on functionality, information governance, security and a roadmap towards sharing with NHS systems. Programme funding was tied to choosing from it. It is a useful filter but does not guarantee a product suits your home.
What is the Data Security and Protection Toolkit and do care homes need it?
The DSPT is an annual self-assessment of how an organisation handles personal data. Care homes are expected to complete it, and access to NHSmail, GP Connect and shared care records depends on reaching Standards Met. Commissioners and inspectors ask about it.
Do care homes need a DPIA for a digital care record?
Moving special category data to a new system is a change in processing that is likely to require a data protection impact assessment. It records what you are doing, the risks and the measures you take. Your supplier should provide the technical information, and the DPIA should be reviewed when modules or suppliers change.
What should happen when the care record system goes down?
Every home needs a written business continuity plan: paper templates ready, a printed summary of each resident's essential information refreshed regularly, a printed MAR fallback, a named person who invokes the plan, and a process for entering paper records afterwards. Test it once a year with a real shift on paper.
Can agency staff use a care home's digital record?
Yes, and they should, but never through a shared log-in. The right approach is an individual account created for the shift, limited to the residents the worker is supporting and expiring automatically. That keeps entries attributable and protects residents' data.
How long must care home records be kept after someone leaves?
For the retention period set in your records policy, with the NHS Records Management Code of Practice as the usual reference for adult social care. The records must stay readable for the whole period, so your system needs a full export you can open without the supplier's software.
What is GP Connect for care homes?
GP Connect lets authorised care home staff view parts of a resident's GP record, such as medicines and allergies, directly. It improves admissions and medicines reconciliation. Access depends on the DSPT being at Standards Met and on local arrangements with the integrated care board.
Sources
- NHS England: Digital Social Care Records programme guidance
- NHS England: assured solutions list for digital social care records
- Digital Care Hub: Data Security and Protection Toolkit guidance for adult social care
- Information Commissioner's Office: UK GDPR guidance for organisations
- Professional Record Standards Body: digital social care record standards
- NHS England: Records Management Code of Practice
- CQC: guidance on Regulation 17 Good governance
- Skills for Care: digital skills framework for adult social care
