The verdict in three sentences
A healthcare app that stores patient data for NHS organisations has to clear the Data Security and Protection Toolkit (DSPT) and the Digital Technology Assessment Criteria (DTAC), on hosting that meets NHS data security expectations, or procurement simply stops. As a 2026 order of magnitude, compliant hosting costs £250 to £2,000 a month depending on volume, plus a DPIA at £1,500 to £4,000, clinical safety work, encryption and audit logging, for 4 to 8 weeks of compliance effort. The 20 to 40% premium over basic hosting is real, but it is small next to a single trust contract.
What the UK framework actually requires
The UK has no direct equivalent of France's HDS certification for hosting providers. The obligation sits with you, the supplier: completing the DSPT annually, meeting DTAC across clinical safety, data protection, technical security, interoperability and usability, and complying with UK GDPR, where health data is special category data. Clinical safety standard DCB0129 requires a named Clinical Safety Officer, a hazard log and a safety case for any software used in patient care.
NHS guidance allows health data to be hosted in the UK, the EEA or countries with an adequacy decision, provided controls are in place. In practice, most trusts expect UK regions, such as AWS London, Azure UK South or Google Cloud London, and many procurement questionnaires ask explicitly. The split of responsibilities between you and the cloud provider must be documented, including who patches, who monitors and who can access production data.
Hosting options and monthly costs
The premium comes mainly from what becomes mandatory in practice: encrypted and replicated backups, retained audit logs, private networking, stronger support tiers and multi-zone availability.
| App profile | Basic hosting (per month) | Compliant hosting (per month) | Premium |
|---|---|---|---|
| Pilot, 1 to 2 trusts, under 5,000 patients | £190 to £380 | £250 to £500 | 25 to 30% |
| Growth, 10 organisations, 50,000 patients | £500 to £950 | £650 to £1,250 | about 30% |
| Scale, several trusts, high availability | £950 to £1,500 | £1,250 to £2,000 and above | 30 to 40% |
| Provider | Strength | Typical setup for a supplier | |
| AWS, London region | Broad managed services, NHS familiarity | Managed databases, encrypted storage, CloudTrail logging | |
| Microsoft Azure, UK South | Close to NHS Microsoft estates | App Service, managed SQL, Defender for Cloud | |
| Google Cloud, London | Strong data tooling | Cloud Run or GKE, Cloud SQL, audit logs | |
| UK sovereign or specialist hosts | UK-only operations, personal support | Private cloud with managed backup and monitoring |
The compliance budget beyond hosting
Moving to a UK region is not enough. Trusts ask for a security pack, and their Information Governance team will read your DPIA line by line.
| Item | Scope | Cost (2026 order of magnitude) |
|---|---|---|
| Data Protection Impact Assessment | Data flows, risks, mitigations | £1,500 to £4,000 |
| Encryption at rest and in transit | Databases, files, backups, key management | £2,500 to £5,000 |
| Access audit logging | Who viewed which patient record, retention | £1,500 to £3,500 |
| Cyber Essentials Plus | Certification required by DTAC | £1,500 to £3,000 |
| CREST penetration test | External test before go-live | £4,000 to £10,000 |
| Clinical safety (DCB0129) | Clinical Safety Officer, hazard log, safety case | £3,000 to £8,000 |
The 4 to 8 weeks cover migration, security development and documentation. Suppliers whose app was built cleanly from day one land at the low end.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Daniel, founder of a post-operative monitoring app in London, is negotiating with an NHS trust that follows 8,000 surgical patients a year. Basic hosting costs him £400 a month; a compliant setup in a UK region costs £520, a 30% premium or £1,440 more a year. In year one he adds a DPIA at £3,000, £5,000 of encryption and logging, Cyber Essentials Plus at £2,000, a penetration test at £6,000 and clinical safety work at £5,000: with £6,240 of hosting, the total reaches £27,240. The contract is worth £3,500 a month across three surgical units, or £42,000 a year, so compliance pays back in about 8 months, and without it there is no contract at all.
FAQ
Does a wellness app need all this?
Not necessarily: DTAC and DCB0129 target technologies used in health and care settings or making clinical claims. A fitness app with no NHS deployment and no clinical claims usually falls outside, but special category data under UK GDPR still applies if health data is collected.
How long does migration to compliant hosting take?
Allow 4 to 8 weeks, of which 1 to 2 weeks is the technical migration itself. The rest goes into security development, testing and the DTAC evidence pack.
Is the DSPT a one-off?
No, it is an annual self-assessment, typically 3 to 10 days of internal effort once the first submission is done. Missing the deadline can block access to NHS data and contracts.
Can the 20 to 40% premium be reduced?
Partly: 1-year or 3-year reserved capacity often cuts compute by 20 to 40%. Dropping replicated backups or logging to save money would fail trust security reviews.
What do trusts ask for before signing?
Usually a completed DTAC, DSPT status of Standards Met, the DPIA, the clinical safety case and the latest penetration test report. Larger trusts add a security questionnaire of 100 to 200 questions.
Let's scope your project. Tell us about your app, its data and your target NHS customers, and we will scope the hosting migration and compliance work step by step. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
