NHS DSPT controls for a healthcare agent
Map NHS Data Security & Protection Toolkit standards to runtime controls for an AI agent handling health data.
For: Teams building health-data agents for the UK / NHS
The regulated problem
An AI agent touching NHS or health data must satisfy the NHS Data Security & Protection Toolkit's standards and UK GDPR — with data kept in-region and every access evidenced, not just asserted in an annual self-assessment.
How Regulus handles it
DSPT standards as runtime controls
The NHS DSPT profile composes with UK GDPR into the resolved policy, so the toolkit's data-security expectations are enforced on every tool call rather than described in a spreadsheet.
PII redaction and in-region state
The privacy plugin redacts health-data PII on write, and the residency plugin plus service extensions pin session, memory, and artifact state in-region — failing closed if it can't.
Evidence for the annual submission
Hash-chained audit envelopes and signed GRC evidence give an auditable, framework-mapped record to attach to the DSPT submission, produced by the runtime instead of assembled by hand.
Regulus is the open-source EU + UK compliance plane for Google ADK, a project by Neul Labs.