Digital care records are now at the heart of how care homes and domiciliary providers deliver safe, consistent care. MAR charts, risk assessments, daily logs, care plans, incident reports – it’s all moving online.

That shift brings huge benefits: better accuracy, more accountability, quicker handovers and easier sharing with GPs and community health teams.

But it also brings something else:
a growing expectation that you can keep those digital records safe, available and recoverable – even when something goes wrong.

CQC, DSPT and UK GDPR all point in the same direction:
care providers must be able to restore critical information quickly and securely.

And here’s where many services get caught out…

Microsoft 365 isn’t natively backed up – and CQC/DSPT assume you know that

Most care providers use Microsoft 365 for day-to-day work. It’s brilliant for collaboration and the built-in tools are helpful:

• Version history

• Recycle bins

• Retention policies (if configured correctly)

• Multi-factor authentication

But none of these are backups.

And none of them guarantee that you can recover your digital care records after:

• a ransomware incident

• accidental deletion

• data corruption

• a misconfigured retention policy

• a staff change that alters permissions

• a system-wide failure

• a sync issue

• a compromised account

This matters because every major regulator expects you to have something stronger in place.

What the CQC expects

CQC’s digital records guidance is clear:
digital care records must be reliable, secure and available when staff need them.

If your system fails, even temporarily, CQC will ask:

• Can you still deliver safe care?

• Can you still access essential information?

• How quickly can you recover?

• Do staff know what to do if systems go down?

If the answer is “we rely on OneDrive and SharePoint,” you won’t meet that expectation.

What DSPT requires

Care homes, nursing homes and domiciliary providers are Category 3 in the DSPT.

That means you must meet the required evidence items in DSPT Version 8, including:

B5.c — “You hold accessible and secured current backups.”

This means:

• backups must be separate from day-to-day systems

• backups must be protected from deletion or tampering

• you must know where backups are stored

• you should test a restore to prove it works

DSPT assumes you understand the difference between synchronisation and backup.
OneDrive is synchronisation – not a backup.

What UK GDPR requires (Article 32)

UK GDPR adds a legal requirement:

Organisations must have the ability to
“restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.”

This applies to resident records, staff rota information, medication data, incident logs – everything.

So GDPR, DSPT and CQC all say the same thing:
you need a proper backup you can restore quickly. 

To make this easier, we created a simple checklist

As a care managers you don’t need technical jargon – you need clarity.
So we built a plain-English checklist you can use for:

• internal audits

• pre-inspection preparation

• DSPT submissions

• discussions with your digital care records supplier

• business continuity planning

Here it is (to follow)

If you’re unsure where to start, we can help

Black Swan supports care homes and home care providers with:

• secure, managed backups for Microsoft 365

• continuity planning that matches DSPT expectations

• simple cyber security controls

• staff awareness training

• DSPT support and annual reviews

If you want practical, jargon-free help that fits the size and pressures of your service, get in touch below: