All Posts

Staff arriving at supermarkets across France on Monday morning faced a problem few would have anticipated. Refrigerators and freezers had been remotely manipulated overnight, with some reportedly reaching temperatures of 50°C. Fresh and frozen food had to be discarded, stores faced disruption, and reports emerged of fires and damaged equipment. The cause was a cyberattack targeting the digital systems used to control commercial refrigeration. By 15 October, French officials w

If you're approaching your first ISO 27001 certification audit, there's a good chance you're wondering how the day will unfold. Who will the auditor speak to? What evidence will they ask for? Will they want to inspect your systems? And what happens if they discover something you've overlooked? These are reasonable questions, particularly if you've spent months developing your Information Security Management System (ISMS) and are now preparing to have it independently assessed

Some of the controls that make a system safe are not built into the technology at all. They are things the practice is expected to do. Our general practices are becoming increasingly digital and they are now using AI scribes and online consultation tools to automated document processing, clinical decision support and prescribing systems. Many of these developments offer opportunities to reduce administrative burdens, improve access and support clinicians to spend more time wi

employer may be liable where a worker is harassed by a third party in the course of their employment and the employer has failed to take all reasonable steps to prevent it. From 30 October 2026, employers will face a new liability for harassment of their workers by third parties. The Employment Rights Act 2025 changes the Equality Act 2010 so that an employer may be liable where a worker is harassed by a third party in the course of their employment and the employer has faile

An individual's right of access applies to the personal information that the organisation is processing. The fact that some of that information originated somewhere else does not, by itself, take it outside the scope of the request. We find that there is a surprisingly persistent misunderstanding when our customers respond to subject access requests: “We didn't create that document, so we don't need to disclose it.” But that isn't how subject access works because a patient's

It is important to remember that obtaining an ID document is not the objective here, it is to be reasonably satisfied that the person requesting information is who they claim to be. Protecting patient information is fundamental to healthcare, and so before confidential information is disclosed, a provider needs to be satisfied that it is giving that information to the right person. But that does not mean every patient requesting information must automatically produce a passpo

The NHS's procurement and deployment of Microsoft 365 Copilot provides significant central assurance about the product. It does not necessarily tell a provider whether its particular way of using Copilot is appropriate. Microsoft 365 Copilot is beginning to become a much more familiar part of NHS working life. In June 2026, NHS England announced that more than 500,000 NHS staff would be given access to Microsoft 365 Copilot, following a trial involving more than 30,000 staff

The aim is not simply to publish a large amount of legal information. It is to help people understand, in a meaningful way, what is happening with their information. A transparency notice, often called a privacy notice, is there to explain, in clear and accessible terms, what an organisation does with personal information. For our customers, this is an important part of UK GDPR compliance. Service users, staff and applicants should be able to understand what information is co

If the parent is not providing care, is not involved in treatment decisions and has no current healthcare role, the benefit to the child may be limited. Parents often assume that if they have parental responsibility, they have a right to see their child’s medical record, which is understandable. . Parental responsibility gives a parent important legal rights and duties in relation to their child. But it does not create an automatic entitlement to information held about that c

A parent who has managed every aspect of their child’s healthcare for years does not necessarily become an inappropriate person to deal with simply because the child has reached a particular age. Parents are usually closely involved in their children’s healthcare. They book appointments, request prescriptions, speak to clinicians, manage referrals and, quite often, submit requests for copies of medical records. For younger children, this will rarely cause problems but as chil

A transcription error can become a clinical hazard AI-powered speech recognition is increasingly being used across healthcare in the form ambient voice technology, clinical documentation to triage, call handling and patient-facing tools. Our customers are learning that converting spoken language into structured or written information can save considerable time and reduce administrative burden. But from a clinical safety perspective, we support our customers to ask Who does it

One of the most important safeguards within the legislation is that information should not be shared if the person making the decision reasonably believes that doing so would be more detrimental to the child than not sharing it. If you've spoken to us recently, you'll know this new legislation has been a regular topic of conversation. We've had some fantastic discussions with GP practices, safeguarding teams, DPOs and healthcare professionals, all asking very similar question

The strongest protections are controls that prevent a single convincing communication from causing harm. We have written on this topic before but it warrants revisitng. I think deepfakes should now be treated as a medium and increasing risk for sectors like healthcare, finance or IT. The technology is becoming more accessible, convincing and much easier to use. These are not always sophisticated fake videos. In many cases, a cloned voice, manipulated image or impersonation ca

While the webinar is designed with Clinical Safety Officers in mind, it is also valuable for CCIOs, CNIOs, Digital Leads, Information Governance professionals, AI Leads and anyone responsible for assuring AI technologies within healthcare. A practical session exploring the governance, legal and information risks associated with AI in healthcare, designed for CSOs 18th August 2026, 12pm to 2pm Online via Teams For Clinical Safety Officers, AI presents new challenges. Traditi

Applying the 'serious harm - health' exemption It is important to remember that the harm exemption is time limited. This article relates only to subject access requests (SARs) made under UK GDPR and the Data Protection Act 2018. It does not cover disclosures made under court orders, police investigations, safeguarding processes, litigation, insurance requests, statutory powers, or any other legal basis for sharing information. A SAR is a request by an individual, or someone

Applying the 'third party confidential ' exemption The ICO makes clear that you should not automatically redact information simply because it mentions another person. This article relates only to subject access requests (SARs) made under UK GDPR and the Data Protection Act 2018. It does not cover disclosures made under court orders, police investigations, safeguarding processes, litigation, insurance requests, statutory powers, or any other legal basis for sharing information

This is the paradox. The more carefully every AI output is reviewed, the less productivity the AI may deliver. The more productivity the AI delivers, the less likely it is that every output is being carefully reviewed. From AI scribes and service user triage to decision support and administrative automation, AI has the potential to reduce workload and improve efficiency for all our customers. However, a very common phrase in supplier materials is: “A human reviews every AI ou

One consequence of widespread AI use is that many tender responses are beginning to sound very similar. Many suppliers assume that if they have a strong product, competitive pricing and relevant experience, they should perform well in public sector procurement exercises. In practice, good suppliers score poorly for reasons that have little to do with the quality of their service. At Kafico, we regularly support organisations assessing suppliers, reviewing governance arrangeme

NHS procurement and healthcare procurement processes place significant emphasis on assurance and governance. For a decade now we have supported our NHS and charity customers to assess HealthTech products before adoption, reviewing supplier assurances, data protection arrangements, AI governance, DPIAs, risk assessments, clinical safety considerations and wider compliance evidence. For many HealthTech and AI suppliers, the UK healthcare market can appear highly attractive. The

Many suppliers spend effort trying to prove their AI is accurate, powerful or innovative but in our experience, customers understand that no system is perfect. We support around 150 healthcare, charity and tech customers as their DPO or AI Compliance Lead and perform AI governance assessments routinely. Over the last few years we've worked on both sides of the procurement journey; with organisations developing AI products and trying to bring them to market and with organisati