Report

by the Comptroller
and Auditor General

Department of Health & Social Care, NHS England &
NHS Improvement, NHS Digital

Digital transformation in the NHS

HC 317 Session 2019–2021 15 May 2020

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office (NAO) helps Parliament hold government to account for the way it spends public money. It is independent of government and the civil service. The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether government is delivering value for money on behalf of the public, concluding on whether resources have been used efficiently, effectively and with economy. The NAO identifies ways that government can make better use of public money to improve people’s lives. It measures this impact annually. In 2018 the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £539 million.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 13 May 2020

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

12 May 2020

This report considers the readiness of the government to deliver its ambitions for digital transformation in the NHS in England.

© National Audit Office 2020

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

006583 05/20 NAO

The National Audit Office study team consisted of:
Javed Ahmed, Yvonne Gallagher, Ernest Obumselu, Jonathan Pownall, Tunmise Usikalu, David Williams and Paul Wright-Anderson, under the direction of Robert White.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

Preface

These are unprecedented times for the United Kingdom. The coronavirus pandemic is having an extraordinary impact on the National Health Service and its staff as well as on all parts of government, society and the economy. The effects will last long after the pandemic has subsided.

This report describes the state of digital services in the English NHS and examines its readiness to deliver digital transformation. It focuses on the plans, governance arrangements, resources and technical challenges. We carried out the fieldwork and prepared the report before the pandemic hit the UK.

I have decided to publish the report at this time because digital transformation in the NHS will increase in importance as a result of the crisis. Digital services can enable health and care services to be delivered flexibly and remotely where necessary and provide better information. Over time, more patients should be able to access medical information and advice without face-to-face contact with clinicians, and risks to everyone can be managed more effectively. Better data will underpin clinical decision making, vital research and government planning to help the NHS manage anticipated demand as well as threats like those we are experiencing now.

I am grateful to the Department of Health & Social Care and the NHS for their help in confirming the factual accuracy of the report and hope that its findings are of assistance as they take forward the digital transformation of the NHS when the current emergency allows.

Gareth Davies

Comptroller and Auditor General

Key facts

Summary

1 The NHS’s health and care services are dependent on people, processes and information technology (IT) systems, and some of these IT systems are outdated and inefficient. The Department of Health & Social Care (the Department) and NHS England & NHS Improvement (NHSE&I) believe that it is essential to implement new ways of working and that improved digital services are central to this. In other words, the NHS will need to undergo a digital transformation. However, the previous attempt to achieve this, between 2002 and 2011, was both expensive and largely unsuccessful. Since then the Department, NHSE&I and NHS Digital (the arm’s-length body that seeks to use information and technology to improve health and care) initiated the Digital Transformation Portfolio (the Portfolio) to deliver their 2014 digital strategy. The Department and NHSE&I are now updating their strategy and the Portfolio, and in July 2019, they set up a new unit, NHSX, to lead digital transformation in the NHS. NHSX intends to use a different approach to digital transformation to that attempted in 2002, though the objectives are similar. In particular it will allow over 220 NHS trusts and foundation trusts (trusts) more autonomy to develop their overall approach to digital transformation and the IT systems they implement so long as they comply with national standards which are currently being specified.

2 This report describes the current state of digital services in the NHS and examines the readiness of the NHS to deliver digital transformation, focusing on:

strategy and implementation plans, including lessons from past strategies and progress made to date (Part One);

the governance of digital transformation (Part Two);

financial and human resources (Part Three); and

technical challenges (Part Four).

Key findings

Digital services in the NHS

3 Digital transformation of the NHS is a huge challenge. The need for large-scale process and behavioural change and for substantial financial investment in IT systems mean that digital transformation is inherently difficult. In the NHS, transformation is further complicated by major challenges including aged (‘legacy’) IT systems, the nature of healthcare information, the large number of organisations and stakeholders, complex governance arrangements, and existing commercial arrangements with technology suppliers (paragraphs 1.2 to 1.4, 1.23, 2.2 to 2.5, 2.16, 4.2 and 4.3, and Figure 2).

4 The NHS has not made the expected progress since 2014, including against a headline target to achieve a ‘paperless’ NHS. The Department’s arm’s-length bodies have attempted to implement practical solutions. However, the Portfolio (to deliver the 2014 strategy) has been restructured and some objectives were unclear, making it difficult to assess progress against the original aims. A significant target – a paperless NHS by 2018 – was missed and redefined in a new target to reach a “core level of digitisation” by 2024. Internal reporting shows that progress is being made for many programmes (paragraphs 1.13 to 1.16).

5 Recent investment in digital transformation has not been sufficient to deliver the national ambitions. The government committed £4.7 billion to deliver the Portfolio between 2016-17 and 2020-21. This was an increase on expenditure in prior years, but an independent review considered it to be insufficient to fully deliver the ambitions. NHSE&I acknowledged the funding was not enough to deliver everything, but felt it was enough to make a good start and thereby make the case for additional funding. At a local level, trusts’ expenditure on IT varies widely and collectively they spend less than the recommended level: NHSE&I estimates that less than 2% of trusts’ expenditure is on technology, compared with a recommended 5% (paragraphs 3.2, 3.3, 3.9 and 3.12, and Figure 5 and Figure 7).

6 Current plans are based on very limited cost data and it is uncertain that planned funding will be sufficient. NHSE&I expects the NHS will need around £8.1 billion to deliver its digital transformation ambitions. The proposed funding comprises:

£5.1 billion from national bodies, between 2019-20 and 2023-24 (£2.2 billion of revenue funding, which is already committed, and £2.9 billion of capital funding which is dependent on spending reviews); and

£3 billion to be funded by trusts between 2019-20 and 2028-29. NHSE&I has not set out how much of this it expects to be funded in the first five years, but national ambitions suggest the majority will be spent in this period.

A further £1.6 billion is allocated to live services between 2019-20 and 2023-24 (for the maintenance of core IT systems and services which support day-to-day running of the NHS – this is mostly committed revenue funding). NHSE&I has sought to improve its cost model over time, in particular by adding data from more trusts (it originally estimated costs based on one trust but now uses data from 14 trusts). This has had the effect of roughly halving its planning estimate to £8.1 billion, with the most significant adjustments being substantial reductions in estimated infrastructure costs. However, we consider the current estimate to be based on very limited data, and there is a significant risk that trusts will be unwilling or unable to fund the £3 billion expected of them (paragraphs 3.4 to 3.6 and 3.10).

7 The Global Digital Exemplar (GDE) programme is helping a small number of trusts. The GDE programme, run by NHSX, aims to create a cadre of high-performing trusts which other trusts can follow (in particular partner trusts, known as “fast followers”). The programme provides £385 million of funding between 26 relatively digitally mature trusts to enable them to become world leaders (with smaller shares going to the fast followers). These trusts report they are improving in digital maturity (the use of digital technology to run a health and care system that is paper-free at the point of care), but it is less clear whether good practices will spread to other trusts. The Department and its arm’s-length bodies have previously been unsuccessful in other (non-digital) programmes that sought to spread good practice through exemplars (paragraphs 1.18 and 3.11).

8 Trusts’ digital maturity has improved, although significant challenges remain. According to self-assessments by trusts, their digital maturity improved between early-2016 and late-2017. For example, 83% of trusts assessed their digital readiness (their ability to plan and deploy digital services) as high in 2017, compared with 65% in 2016. There are examples of trusts which are digitally mature and scored highly against an international assessment. But digital capability (the use of technology to deliver care) remains a significant challenge, with 16% of trusts assessing their capability as ‘low’. For example, only 54% of trusts reported that staff can rely on digital records for information they need when they need it (paragraphs 1.19, 1.20, and Figure 4 and Figure 10).

Strategic challenges

9 Changing national strategies have contributed to a fragmented environment, which makes achieving current ambitions more challenging. Digital services in the NHS rely on a vast array of IT systems critical for delivering services. Many systems are aged, ‘legacy’ IT (operationally embedded, but superseded by more effective technologies or changed business needs). National strategies have moved between centrally managed and ‘hands-off’ approaches to digital transformation, and this has contributed to the proliferation of legacy systems. NHSE&I is now seeking to plan and coordinate care through local health and care organisations. This makes it essential that those organisations can share data effectively. NHSE&I expects that working in partnerships will improve organisations’ data sharing, but many of the existing IT systems within these organisations predate this approach (paragraphs 1.2, 1.3, 1.7, 1.9 and 4.10, and Figure 3).

10 Digital transformation is essential to the NHS’s Long-Term Plan to improve services and will need a high-quality implementation plan. The NHS Long-Term Plan (2019) states that digitally enabled care will be rolled out across the NHS to help transform the provision of services and it sets some ambitious targets. However, there is no digital implementation plan setting out how this will be done in clear detail, including the role of national bodies, and to a realistic schedule. NHSX intends to publish a comprehensive technology plan for health and care in the autumn of 2020 (paragraphs 1.5 and 1.15).

Uncertainty over accountability and local costs

11 National governance arrangements for digital transformation remain confused, despite attempts to clarify them. Since 2016 management of the Portfolio of national programmes has been overseen by the Department, NHSE&I and NHS Digital in a complex governance arrangement. Attempts to improve governance of the Portfolio were unsuccessful, for example because accountability for managing development costs and for achieving programme benefits were shared across different organisations. The Department then set up NHSX in July 2019 to lead digital transformation across the NHS, although the new arrangements have still not been finalised and NHSX does not have a statutory basis. NHSX’s chief executive reports to both the Department and NHSE&I (paragraphs 2.2 and 2.3, and Figure 2).

12 Arrangements for national oversight of digital transformation at a local level are not in place. Outside the Portfolio, mechanisms for ensuring trusts’ investment in technology is consistent with the national strategy are still being developed. This work includes the implementation of spending controls on trusts’ digital and IT expenditure, in which NHSX is being assisted by the Government Digital Service. There is currently no governance mechanism to make existing data and technology compatible with national plans (paragraphs 2.4 and 2.5).

13 NHSX is unclear about the whole-life costs and benefits of the different approaches to digital transformation at a local level. NHS organisations use electronic patient record systems to store and share information and these systems are essential to digital transformation. NHSX expects trusts to take one of three approaches to developing a system consistent with national ambitions: to buy an enterprise-wide system; to integrate multiple record systems; or to build their own system. NHSX noted the trusts with an enterprise-wide system tended to be more digitally mature. However, they also tend to have the highest upfront costs and this approach is not affordable in every trust. But NHSX does not have comparable whole-life-cost information for the three approaches, nor does it know the hidden costs which trusts incur as a result of the inefficiencies of legacy IT systems (paragraph 1.3, 1.7, 4.11 and 4.12).

Interoperability of IT systems and data

14 Achieving interoperability of data and IT systems is a longstanding aim and essential to current plans for digital transformation, but it will be very challenging to fully achieve. Interoperability means seamless sharing of data so that all parties understand it in the same way. The Department has recognised the importance of this since 1998, and interoperability is fundamental to the aims of its current strategy. But achieving interoperability will be very challenging. For example, only three of the 10 sets of standards so far identified by NHS Digital are ready. And in 2017 only 15% of trusts reported being mostly compliant with the standard for clinical terminology (SNOMED CT) (paragraphs 1.5, 4.4 to 4.6, and Figure 8 and Figure 9).

15 NHSX does not have a timeframe for achieving interoperability and its plans are under-developed, which risks making interoperability harder to achieve in the future. There has been some progress towards achieving interoperability but much uncertainty remains. NHSX does not have a clear schedule for completing this work. Stakeholders felt that achieving interoperability had been made more difficult by the previous attempt to implement standards, since this resulted in the use of multiple standards or different versions of the same standard. It is our view that if NHSX does not develop and implement a carefully considered plan with a realistic schedule then it not only risks failing to take the right steps towards interoperability in the short-to-medium term, but risks making it harder to achieve in the longer term (paragraphs 4.7 and 4.8, and Figure 8).

16 There could be a tension between the ambitions to achieve interoperability and the aim to increase the number of technology suppliers to the NHS. The Department’s Vision for digital, data and technology (2018) sets out plans to expand the supplier market, and NHSX and NHS Digital intend to use contractual frameworks to ensure all technology suppliers meet standards that will allow interoperability between IT systems. Nonetheless, increasing the number of suppliers could make interoperability more difficult to achieve because there will be more system-to-system integrations required. NHSX intends to address this problem by asking local organisations to build a ‘data layer’ to support data access and exchange across different systems (with the intention that these layers will eventually be linked). However, NHSX has not yet defined what work is needed to achieve this; our previous work shows that other parts of government found similar approaches to be expensive and problematic (paragraphs 2.4, 2.8, 2.16, 4.16 and 4.17, and Figure 8).

Developing workforce skills and public trust

17 Specialist skills are in short supply and national bodies have not finalised plans to improve the workforce’s digital skills. Health Education England estimates between 40,600 and 53,900 full-time-equivalent NHS staff hold roles in informatics (4% to 5% of the NHS workforce). Most trusts now report having board-level representation for their digital transformation agenda, although stakeholders feel there is a shortage of digital and data skills. There is an existing programme of work in the Portfolio to support the improvement of digital skills across the workforce and at board level in trusts, although its budget is less than 1% of the Portfolio budget to 2020-21. This programme is being consolidated with other initiatives into a workforce implementation plan. It is still in the planning stage, but NHSX intends that this new workforce programme will significantly increase support for improving digital skills (paragraphs 2.6 and 3.13 to 3.16).

18 Maintaining public trust about the use of data is essential to achieving national ambitions. Patient information is used both to inform the direct care the patient receives and for secondary purposes such as planning services and undertaking medical research. The public can opt out of having their information used for secondary purposes if it can be used to identify them. Currently, the opt-out rate is low (below 3%). However, if large numbers of people have concerns and choose to opt out, then planning and research will be less effective. The failure of NHSE&I and NHS Digital to maintain public trust previously resulted in the closure of the care.data programme in 2016. A related risk arises from cyber security. The NHS’s legacy IT systems are especially vulnerable to cyber-attack and loss of data. Although work has been undertaken to improve cyber security since the 2017 WannaCry attack, it remains a concern (paragraphs 1.5, 1.7, 2.13 to 2.15 and 4.3).

Applying the lessons from the previous national programme

19 The previous attempt at digital transformation in health was expensive and largely unsuccessful, but we are not convinced that all the lessons are being applied now. In 2011 the National Programme for IT (the Programme) was stopped early and did not deliver key benefits, despite the Department spending an estimated £9.8 billion on the Programme, although some national digital services were delivered successfully and are still in use (for example, the NHS Spine to enable sharing electronic information between organisations). Many factors contributed to the failure, including the insufficient understanding of, and support from, key stakeholders such as clinicians and the need for adaptive change (changes in the way people work) alongside technological change. For current efforts to be successful, it will be essential to avoid previous mistakes. While some high-level lessons were identified in the Wachter Review (2016), we have not seen evidence that the lessons of this and other programmes have been captured systematically. In our view, significant risks to successful implementation remain in all areas (Figure 1) (paragraphs 1.9 to 1.12).

Conclusion on value for money

20 The Department and its arm’s-length bodies have ambitious plans for digital transformation, intended to enable many of the wider service changes set out in the NHS Long-Term Plan. However, the track record for digital transformation in the NHS has been poor, with the previous major national programme being closed early without achieving its objectives. Currently, £4.7 billion of national funding is delivering some national digital services and improving the digital maturity of some NHS trusts. However, the target of a ‘paperless’ NHS by 2018 has not been achieved. NHSE&I now expects the NHS to reach a core level of digitisation by 2024, with important information routinely available to clinicians when and where they need it.

21 Local NHS organisations face significant challenges in working towards digital transformation. This includes outdated IT systems that do not connect to other systems and competing demands on their resources. The Department and its arm’s-length bodies need to set a clear direction for local organisations and to ensure resources are directed to the right priorities nationally. Doing so will require financial investment, but the government does not have a reliable understanding of how much funding is required. It will also require strong governance and accountability for delivery, which are not yet in place and which are to be led by a new unit, NHSX, which has no statutory footing. National bodies must manage other significant risks including insufficient skills and capability and major technical challenges such as how to embed interoperability between systems in such a complex environment. Unless the Department and its arm’s-length bodies address these issues far more effectively than they have managed previously, then they are unlikely to achieve value for money for the up to £8.1 billion they estimate will be spent on digital transformation between 2019-20 and 2023-24.

Recommendations

The Department and its arm’s-length bodies should:

a Maintain a comprehensive set of lessons for digital transformation from NHS and wider government experience. This should include lessons about digital transformation where organisations vary in their digital maturity and reliance on legacy IT and data. Future plans should be tested against these lessons.

b Ensure that the expected technology plan for health and care includes an implementation plan with specific objectives and measurable actions that are required. The plan should include milestones for the implementation of all standards required for interoperability and must take account of the varied readiness of NHS organisations. The plan should be realistic about the time and investment required. It should also be clear about the responsibilities of local organisations, and the support available to them.

c Collect more data to enable a better understanding of the full cost of delivering digital transformation and prioritise the work programme. Essential work to lay the foundations of digitisation and interoperability (including data standardisation) should be done before investment in newer technologies. There should be robust assessment of the whole-life costs and benefits of different approaches to implementing electronic patient record systems.

d Alongside the implementation plan, develop specific resources and plans for high-risk issues:

Establish a resource to provide bespoke support to trusts in managing the adaptive change required for digital transformation.

Prepare a communication plan to ensure trusts, clinical staff, suppliers and the public are kept informed about what is happening and what is expected of them.

Strengthen the incentives and levers to encourage local organisations to invest sufficient resources in digital transformation.

Prepare a strategic workforce plan to support digital transformation.

Prepare plans for determining specific national requirements for clinical records, data quality, and privacy and how they will be met.

e Simplify and strengthen national governance arrangements. This should include further work to provide national bodies with the levers and monitoring capability to ensure local NHS organisations and suppliers comply with national standards for existing and new technology, and for data.

f Use digital maturity assessments of local organisations to gather additional information. NHSX should continue these assessments, which provide the only comparable information about trusts’ progress and identify common areas of strength and weakness. The assessments could also collect information on the costs and benefits of electronic patient record systems.

Part One

Digital transformation in the NHS

1.1 Digital transformation is the step-change improvement of operations and services, through the use of digital technology. This report focuses on the digital services that government has identified as being important to delivering its ambitions to transform the NHS in England. This part of the report covers the current state of digital services, key stakeholders, the importance of digital transformation, and the progress made in recent years including lessons learned.

Legacy information technology (IT) in the NHS

1.2 The NHS relies on a vast array of IT systems for delivering health and care services. Many of these are years-old ‘legacy’ IT (that is, they are operationally embedded in the organisation but have been superseded by more efficient or effective technologies or changed business needs). All organisations have some legacy IT since it would not be value for money to replace systems whenever a new need or a more effective technology is identified. However, our 2013 cross-government report found legacy IT posed a growing risk to the availability of public services and the ability of government to implement its planned reforms.1 Government organisations with a significant amount of legacy IT found it challenging to reduce costs and improve services through better use and sharing of information. We also noted that adding interfaces to legacy systems was likely to be insufficient to achieve full digital transformation.

1.3 Our 2013 report also found that running services based on legacy systems results in hidden costs, because of the need for additional business processes to adapt and support legacy systems. However, the NHS lacks cost and performance information on the true cost of legacy services. Such information is vital for deciding whether to invest in replacement IT systems and for producing a robust business case for such a change.

Key stakeholders for the government’s ambitions for services

1.4 The NHS’s health and care services are dependent on people, processes and IT systems, and many organisations in the NHS and social care sector use digital services. Figure 2 sets out their roles and responsibilities. NHS Digital has been central as it is the primary delivery organisation for national programmes. NHSX is a new unit which now leads digital transformation, and national roles are being redefined. Patient records are fragmented across thousands of local organisations, including NHS trusts and NHS foundation trusts (trusts), general practitioners (GPs) and social care providers.

Digital technology is essential to the government’s ambitions

1.5 In the NHS Long-Term Plan, digital services are regarded as essential to ambitions for the next 10 years.2 The Long-Term Plan states that digitally enabled care will be rolled out across the NHS to help transform services. This includes:

the use of interoperable data and systems between NHS organisations to help patients and staff;

online services such as advice about medical conditions, appointment booking and prescriptions being sent to pharmacists electronically;

virtual consultations using telephone or online video with GPs and hospital doctors, to result in 30 million fewer outpatient visits per year;

new technologies such as smart inhalers and artificial intelligence; and

using patient data for planning services and medical research.

1.6 These ambitions are already starting to be delivered. The Long-Term Plan builds on the NHS’s Five Year Forward View (2014), by aiming to make digitally-enabled care mainstream across the NHS. Prior to the Long-Term Plan, the Department of Health & Social Care (the Department) published its Vision for digital, data and technology in 2018.3 This sets out the principles and priorities for improving the use of data, digital services and technology. The Department sees achieving interoperability between data and systems as one of the first steps in allowing the sector to benefit from cutting-edge technologies.

1.7 NHS England & NHS Improvement (NHSE&I) increasingly seeks to plan and coordinate care through partnerships of local health and care organisations known as sustainability and transformation partnerships (STPs) and integrated care systems (ICSs). This makes sharing data between organisations essential and NHSE&I expects that by working in partnership, organisations’ data-sharing will improve, although many of the existing IT systems within these organisations predate this approach to working. Seamless sharing of data (or interoperability) will allow electronic patient records to be seen and updated by clinicians in different organisations such as GP practices and hospitals. This should release staff time by:

allowing clinicians to record information into the electronic patient record at the point they provide care (rather than writing up notes afterwards); and

reducing duplication of care, since clinicians will see information (such as test results) recorded by others.

The NHS expects this will benefit patients by allowing ‘richer’ consultations with clinicians and by not having to repeat their medical history each time they see a new clinician. These records can also enable the NHS to plan services more effectively and support medical research (the NHS specifies that, where possible, it removes data that could identify the patient before using records for these purposes).

1.8 Seamless sharing of data will also allow new technologies to be used to their full extent. For example, data from wearable devices to monitor blood pressure could be added to the patient’s record to inform clinicians of changes in symptoms.

Previous attempts at digital transformation have not been successful

1.9 The Department and its arm’s-length bodies have longstanding aims to transform the way the NHS works using digital technology but have not successfully delivered their previous strategies (Figure 3). The previous centrally-led strategy was the National Programme for IT (the Programme). This was launched in 2002 as a 10-year programme of reform. Central to the Programme was the aim of making a patient’s care record available to whoever needed it to care for the patient. Expenditure on the Programme was estimated to be £9.8 billion.

1.10 Some parts of the Programme were delivered successfully and are still in use: for example, the ‘NHS Spine’ to enable sharing electronic information between organisations, the Electronic Referral Service to help patients choose their place of care and book appointments, and the Electronic Prescription Service to send electronic prescriptions from GP surgeries to pharmacies. However, other parts of the Programme encountered significant difficulties; in particular, the detailed care record systems. In 2011, the government decided to dismantle the Programme. The Wachter Review found that there had been no definitive analysis of the failings of the Programme, but identified six main lessons:4

The Programme lacked engagement with clinical staff and focused on technology not service change and adaptive change (changes in the way people work).

The Programme used a controlled, top-down approach to implement standardised IT systems with insufficient support of local organisations and professionals.

The Programme was felt to be politically driven and staff felt deployment was rushed. There were unrealistic expectations and too much additional work was added to the original scope.

Despite a substantial funding allocation, trusts felt they lacked central support to implement the systems.

Procurement and contracting arrangements were problematic, with nearly impossible delivery timeframes and contracts in which the scope was unclear.

There were continuous leadership changes and a shortage of individuals with relevant skills.

1.11 The need to engage with the workforce and ensure adaptive change alongside technological change was a main point identified in the Wachter Review. Therefore, the Programme differed from current plans in that it sought to implement nationally procured, enterprise-wide electronic patient record systems across all trusts and GPs. The current arrangements are for trusts to choose their own electronic patient record system. Although individual trusts may do this in conjunction with their local partners, a common national approach to implementation and adaptive change is not expected. Nonetheless, the adaptive change required when implementing a new electronic patient record system can be hugely challenging. NHSX will need to ensure that trusts and other organisations understand the scale of the challenge and commit sufficient time and resource to achieve the adaptive change required.

1.12 NHSX told us it has drawn on lessons learned from the Programme and other programmes. However, the national bodies have not systematically recorded all the main lessons from digital implementation, for example in a central database that could be updated as new lessons are learned.

Progress against ambitions for digital technology

1.13 Existing work is being delivered through the Digital Transformation Portfolio (the Portfolio). The Portfolio currently consists of 27 programmes which are intended to both deliver the National Information Board’s 2014 strategy for the NHS, Personalised Health and Care 2020, and to maintain live services. Personalised Health and Care 2020 made 63 proposals under seven themes (including the proposal that clinicians in key parts of the NHS would be working without paper records by 2018).

1.14 The delivery of Personalised Health and Care 2020 has undergone various iterations since it was published:

The National Information Board published nine workstream roadmaps under six domains in 2015, setting out delivery plans. These did not map directly to the proposals in Personalised Health and Care 2020. The objectives were not routinely monitored by any NHS body, and only one annual review was published.

In 2016 the Portfolio was launched as a five-year transformation plan with 10 domains. The Portfolio funding was £4.7 billion.

In September 2017 NHSE&I announced a restructure of the Portfolio, into ‘placemats’ in which programmes were grouped into ‘pillars’.

1.15 These changes, and the fact that national bodies were focused more on managing a delivery Portfolio rather than a strategy, make it difficult to evaluate progress against the original proposals made in Personalised Health and Care 2020 (although the NHS did not achieve the paperless by 2018 target). The current Portfolio is still monitored against the revised 2017 structure, although NHSX has recently conducted a prioritisation exercise which further changed the Portfolio with the intention of making it affordable and focused on delivery of the Long-Term Plan and the Vision for digital, data and technology. NHSX plans to publish a comprehensive technology plan for health and care in the autumn of 2020, after it completes an engagement exercise. It is therefore not possible to comment on progress against these ambitions yet. However, the Long-Term Plan includes some challenging aims, such as the target that all providers reach a “core level of digitisation” by 2024. Clearer objectives, set at the beginning of the Portfolio, and consistent monitoring throughout its life would allow better oversight and earlier identification of problems, and reduce the risk of adding to the scope of the strategy without due consideration.

Current performance of the Portfolio

1.16 The Digital Delivery Board, the cross-organisational board that oversees the Portfolio, considers a monthly report on the progress and performance of each programme. Most programmes report making satisfactory progress. Of the 27 programmes reporting in November 2019, 13 were ‘green’ or ‘amber-green’, 12 were ‘amber’, and two were ‘amber-red’. NHSX told us the planned benefits in some individual programmes might not be realised on schedule.

1.17 The Infrastructure and Projects Authority assesses major projects across government, considering their likelihood to deliver objectives on time and on budget. At November 2019 it had reviewed seven programmes in the Portfolio: three were rated ‘amber-green’; three were ‘amber’; and one was ‘amber-red’.

1.18 There is uncertainty over whether one of the main programmes in the Portfolio will deliver all of the intended benefits: the Global Digital Exemplar (GDE) programme, which aims to create a cadre of high-performing trusts which other trusts can follow. Trusts within the GDE programme report that they are improving in digital maturity (the use of digital technology to run a health and care system that is paper-free at the point of care), and they have developed 121 ‘blueprints’ to help other trusts replicate their improvements, with more in development. However, our view is that this might not be enough to spread good practice, including on how to manage adaptive change, to other trusts as intended. National bodies have previously been unsuccessful in other (non-digital) programmes that sought to spread good practice across the NHS in this way. An independent review of the GDE programme found that significant benefits are being delivered, with an increased focus on digital transformation and activity to improve digital healthcare. It also reported more sharing of learning and highlighted the need to build on lessons from the GDE programme so that shorter-term programmes integrate sufficiently with long-term national aims for digital transformation.5

The digital maturity of local providers

1.19 NHSE&I has developed a digital maturity assessment for trusts to self-assess their maturity. It comprises 175 questions, aggregated to give a score against three ‘themes’:

Readiness: ability to plan and deploy digital services, such as the engagement of a trust’s board in its digital strategy.

Capability: use of digital technology to support the delivery of care, such as access for clinicians to electronic patient records.

Infrastructure: presence of infrastructure to support these capabilities, such as a service desk to assist users.

NHSE&I categorises the scores for each of these themes as ‘low’, ‘medium’ or ‘high’. NHSE&I ran assessments in late 2015/early 2016 and in late 2017, and NHSX plans to run them again in 2020, but is considering whether it will use a different approach. Trusts’ responses are not routinely validated by NHSE&I, although it did check a small sample of the trusts which had assessed themselves as ‘high’.

1.20 The national results of the assessment indicate that digital maturity improved between 2016 and 2017. Most trusts scored ‘high’ for readiness and infrastructure, although capability was less mature, with few scoring ‘high’ and nearly one fifth scoring ‘low’ (Figure 4). NHSE&I considers improvement against the capability theme important because it affects services. Thirty trusts rated themselves as ‘high’ against the capability theme and NHSX told us two hospitals had scored highly (but not in the highest category) on an international benchmarking assessment.

1.21 NHSE&I also developed a digital maturity self-assessment for GPs’ practices. The data for 2019-20 show a mixed picture, with most practices reporting that they did not have some key elements of digital working in place, although a significant proportion did have some important components in place. For example, 44% of practices reported being able to access their clinical systems from patients’ homes using mobile technology but only 13% had completely digitised their legacy paper records. And practices were far more likely to offer telephone consultations than video consultations for patients (90% versus 5%) and for nursing homes (70% versus 2%). The survey also showed that practices had more mature arrangements in place for sharing electronic patient records with other healthcare providers in their area than they had with social care providers. Fifty-seven per cent of practices reported that other healthcare providers could access their systems and 42% reported they could access the systems of other healthcare providers, compared with 23% of practices which could share their systems with social care providers and 17% who could access the systems of social care providers.

1.22 The Local Government Association developed a similar assessment to assess the digital maturity of local authorities carrying out social care responsibilities (typically commissioning adult social care from private providers, although a small number provide care themselves). The results of the social care survey were broadly similar to those of NHS trusts, but since the assessment was voluntary and did not include providers of social care the results might not be representative of the sector overall. The aggregated results also include children’s services so it is not a direct comparison between NHS services and adult social care services. Other stakeholders told us that adult social care providers were much less digitally mature than NHS providers; and the Care Quality Commission has reported the particular challenges faced by adult social care providers in adopting digital technology.6

There are significant challenges in delivering digital transformation in the NHS

1.23 Digital transformation is inherently challenging, requiring significant financial investment and process and people change, not just technological change. This ‘adaptive change’ requires significant effort from front-line staff to engage directly with digital transformation. The challenges may be exacerbated in the NHS, where the behaviours and attitudes reflect the importance of patient safety. The Academy of Medical Royal Colleges noted the potential tension between the technology mantra, “move fast and break things” and the ethical principle of “do no harm” in medical care.7 Furthermore, previous failure illustrates the particular challenges of achieving digital transformation. These include:

the complex organisational and reporting structures create challenges in ensuring the delivery and oversight of transformation (covered in Part Two);

the NHS has many demands on its limited financial resources, and the financial benefits of digital transformation take many years to realise (Part Three); and

technical challenges resulting from the data and systems used in the NHS (Part Four).

1 Comptroller and Auditor General, Managing the risks of legacy ICT to public service delivery, Session 2013-14, HC 539, National Audit Office, September 2013.

2 NHS England, The NHS Long-Term Plan, January 2019.

3 Department of Health & Social Care, The future of healthcare: our vision for digital, data and technology in health and care, October 2018.

4 National Advisory Group on Health Information Technology in England, Making IT Work: Harnessing the Power of Health Information Technology to Improve Care in England, 2016.

5 R. Williams, K. Cresswell, et al. (2020) Independent Evaluation of the Global Digital Exemplar Programme, second year report, The University of Edinburgh, February 2020.

6 Care Quality Commission, The state of health care and adult social care in England 2018/19, October 2019.

7 Academy of Medical Royal Colleges, Artificial Intelligence in Healthcare, January 2019.

Part Two

The governance of digital transformation in the NHS

2.1 This part considers how spending on digital technology and digital transformation is governed at the national level (the Digital Transformation Portfolio, or Portfolio) and the local level. It also considers information governance, cyber security and the management of relationships with technology suppliers.

Governance of the Digital Transformation Portfolio

2.2 The governance arrangements for the Portfolio at its launch in 2016 were complex. They brought together stakeholders from the Department of Health & Social Care (the Department), NHS England & NHS Improvement (NHSE&I), and NHS Digital. A chief clinical information officer, assisted by a chief information officer, was responsible for commissioning the services required to deliver the Portfolio, and both represented, and had authority to act across, the whole health and care system. Problems included confusion caused by there being multiple stakeholders, funding held in multiple budgets across organisations, and unclear lines of commissioning, funding, delivery and accountability. These issues contributed to slow delivery and transformation.

2.3 After years of minor adjustments to these arrangements, the Department formed a new unit (NHSX) to resolve conflicting priorities and confusions and take overall responsibility for digital transformation. Launched in July 2019, NHSX brought together staff from the Department and NHSE&I. The new governance arrangements have still not been finalised; these were expected to commence from April 2020, but NHSX told us the coronavirus pandemic meant this work has been delayed. It has been confirmed that NHSX’s chief executive will report to both the Department and NHSE&I. Part of NHSX’s role is overseeing NHS Digital. Around the time of the launch of NHSX several senior staff left the Department and NHS, representing a significant loss of corporate knowledge and experience.

Governance of local organisations’ digital technology investment

Trusts

2.4 Under the national strategy, local NHS organisations, including NHS trusts and NHS foundation trusts (trusts), are expected to obtain the technology necessary to deliver the strategy, in particular electronic patient record systems which can share information with other organisations. National governance arrangements are therefore necessary to ensure trusts develop such systems and NHSX expects to set out its approach for mandating that organisations meet technology and data standards in early 2020-21. However, current arrangements are limited. NHSX is developing three mechanisms to strengthen governance, which are to be fully implemented during 2020.

The business case approval process. NHS trusts are currently required to obtain business case approval from NHSE&I when they plan any investment in technology of more than £15 million. However, smaller investments are exempt and foundation trusts are fully exempt (at 31 March 2019, 150 of the 227 trusts were foundation trusts). NHSX and NHSE&I intend to refine this process to make it better suited to digital technology expenditure. However, NHSX told us there are several significant challenges with the approvals process, including: the length of time required to go through the process; the requirement to adhere to rigid approval amounts and return any in-year underspend; and the need to secure revenue funding alongside capital funding for most technology projects.

Spending controls for technology are being designed with the assistance of the Government Digital Service. Where investment is below the threshold to require business case approval from NHSE&I, these controls will be intended to ensure spending on new technology is permitted only where it meets standards set by NHSX.

The Health Systems Support Framework. This procurement framework provides NHS organisations with a list of suppliers that NHSE&I considers to be financially-stable providers of suitable products and services. The framework went live in August 2018 and, by January 2020, 24 contracts worth £96 million had been awarded through it (one of which was for an electronic patient record system). The framework is more flexible than were the procurement arrangements of the National Programme for IT, and its use is not mandatory. Some large suppliers of electronic patient record systems have not joined the framework.

It is not yet clear how NHSX will assess new technology where it needs to integrate with legacy information technology (IT) systems as this requires deep understanding of existing systems and data.

2.5 These mechanisms will mostly influence expenditure on new technology, and therefore apply to trusts when they come to implement new systems. However, an electronic patient record system might last for 10 to 15 years, meaning it will take many years before fully interoperable systems are in place across the NHS. The wider NHS strategy presents an additional challenge, as trusts are increasingly working in local partnerships with other NHS and social care organisations (that is, sustainability and transformation partnerships (STPs) and integrated care systems (ICSs)). With the mechanisms previously mentioned largely applying to individual trusts it is not clear how they will be applied to STPs/ICSs. NHSX is considering how it can manage this challenge.

2.6 Trusts’ self-assessments of their digital maturity indicate that they are improving their own governance of digital transformation. In 2017, 98% of trusts reported that they had a board-level sponsor for digital transformation (up from 91% in 2016), while 89% reported having strong clinical leadership for their digital agenda (up from 74% in 2016).

General Practice and social care

2.7 General practitioners’ (GPs’) core IT systems (including electronic patient records) are funded centrally under the General Medical Services contract. This arrangement gives national bodies and clinical commissioning groups far greater control over GP systems than they have over hospital systems. Until December 2019, GPs’ clinical IT systems were supplied through the GP Systems of Choice framework; this allowed GPs to choose one of four IT systems that would then be funded by clinical commissioning groups. In practice, two IT suppliers (EMIS and TPP) supplied around 95% of the GP market.

2.8 NHSX considered that these arrangements presented disadvantages, including insufficient competition and a lack of innovation. NHS Digital has now launched a new framework, GP IT Futures. This framework is intended to increase competition and innovation through a larger pool of suppliers and to enforce standards that allow interoperability with other GP and hospital systems. It includes 69 suppliers, including seven suppliers of core GP IT systems. A greater number of suppliers and systems will add to the complexity of achieving interoperability as it requires additional integration between new and old systems in GP practices (and with trusts’ systems). We discuss interoperability in Part Four.

2.9 NHS organisations need to share data with social care providers to ensure patient care is coordinated. However, social care is commissioned and provided by local authorities, which are outside the NHS accountability structure. We have previously reported that this separation has contributed to problems with data-sharing and coordinating care.8 STPs and ICSs (which include local authorities) are expected to prepare digital plans as part of their wider planning. However, there is currently no assessment of whether these plans exist or how well they are working. Previously NHSE&I required local NHS providers and commissioners to work in partnership with social care providers to deliver plans called local digital roadmaps. However, NHSE&I no longer monitors the progress of these partnerships as they have been superseded by STPs and ICSs.

Information governance and cyber security

2.10 NHS organisations are responsible for information governance and holding data securely including protecting against a cyber-attack. Information governance covers all processing of data including the collection, retention, use, access to and decommissioning of information and data.

Information governance

2.11 All organisations that have access to NHS patient data and systems must complete NHS Digital’s Data Security and Protection Toolkit (which enables organisations to measure their performance against the National Data Guardian’s data security standards).9 Almost all trusts and GPs have done so: 6,648 GP practices had completed the assessment by April 2020 and all reported at least meeting the standards. Also, 223 trusts have returned an assessment, with 62 (28%) reporting passing the full assessment against the 2019-20 standard and around two-thirds of trusts reporting that they had completed an interim assessment but not yet the full assessment. In the previous year, 100 trusts did not meet the Toolkit standard by April 2019 and 57 of these were still not compliant by September 2019. NHSX and NHS Digital have developed a new process to help make non-compliant trusts compliant, but it will not be implemented until after September 2020. The delays in both implementing this new process and completing full assessments are a result of resources being refocused during the coronavirus pandemic.

2.12 Until the formation of NHSX, a number of organisations provided advice on information governance, including the Department, NHSE&I, NHS Digital, Public Health England, the Information Commissioner’s Office and the National Data Guardian. These bodies coordinated their efforts through an Information Governance Alliance, yet it remained a complicated area. Stakeholders (including trusts) told us they remained uncertain about what information could be shared and whether they could share information with non-NHS organisations. Our report Challenges in using data across government found that multiple government policies and principles about data-handling are by necessity at a generic level and organisations are not turning these guidelines into working practices for staff.10 This can create uncertainty and place burdens on front-line staff. NHSX is now the lead organisation responsible for ensuring relevant, timely, clear and consistent guidance and advice is provided to health and care organisations. It intends to prioritise plans and develop guidance through collaboration with key stakeholders and regulators.

Cyber security

2.13 Our work across government has led us to conclude that legacy systems present risks to cyber security for a number of reasons. These include organisations not acting to ensure IT systems are protected once the manufacturer support ends and legacy systems being incompatible with more secure new technology. Legacy systems increase vulnerability to cyber-attacks because re-engineering infrastructure (the physical buildings, cabling and other structures which support, house and enable the transfer of information) and software is often not possible.

2.14 In 2017 the NHS experienced widespread disruption from the WannaCry cyber-attack, including the cancellation of around 19,000 appointments at an estimated cost to the NHS of £92 million.11 The Department and its arm’s-length bodies have since taken steps to improve cyber security, including agreeing a Windows 10 licensing agreement (which includes the ‘advanced threat protection’ functionality, intended to reduce vulnerabilities and increase resilience) and setting up a Data Security Centre to help prevent, detect and respond to cyber-attacks.

2.15 NHS Digital collects information on trusts’ cyber security through on-site assessments using the Cyber Essentials Plus standard and other relevant information. At the time of the WannaCry cyber-attack on-site assessments were voluntary and 88 of 236 trusts had been assessed (none had passed). Since the WannaCry attack the Department and NHSE&I expect all trusts to have an on-site assessment and, as at February 2020, 204 had had one. The average score across the trusts was 63% (compared with NHS Digital’s estimate of around 50% in late-2017). Cyber Essentials Plus requires a score of 100% for an organisation to pass the assessment, and just one trust achieved this. However, NHSX and NHS Digital consider some trusts have reached an acceptable standard, even though they did not score 100% in the assessment, and note there has been a general improvement in cyber security across the NHS. However, while some attempts have been made to address underlying cyber security issues, and progress has been made, it remains an area of concern. A 2019 survey of 186 IT leaders across the sector showed that 61% considered cyber security one of their top priorities (sixth highest priority overall).12

Overseeing local organisations’ relationship with technology suppliers

2.16 The Department’s strategy sets out intentions to work differently with technology suppliers to achieve benefits from increased competition and innovation. In fact, the Vision for digital, data and technology (the Vision) states that one of the main challenges in digitising the NHS are the existing commercial arrangements between NHS organisations and IT suppliers. It notes that contracts are often not specific enough to ensure interoperability, ease of use and ongoing improvement, and that they are too long and effectively leave the NHS organisation locked into the contract and unable to move to a better IT system. Changing how the NHS works with suppliers will also create challenges that need to be managed, including:

Commercial capability within the NHS. The Vision calls for shorter contracts, broken down into constituent parts, so that organisations are not tied into a long contract with one supplier. Creating and negotiating contracts is already a protracted process, and doing it more frequently adds to the burden on local organisations. There is also a risk of over-estimating ability and willingness among suppliers to adapt to the new approach.

Ensuring interoperability of data and systems. More suppliers might make this more difficult. We discuss this in Part Four.

Introducing new technologies. New technology can have unintended consequences, including benefits. For example, the ‘Babylon GP at hand’ practice uses an app to deliver a digital-first model of primary care. An evaluation for NHS England found that these arrangements had some benefits and noted there was an impact on the wider health system. The host clinical commissioning group reported that it had experienced exceptional, but unfunded, growth in its patient list in 2018-19 as a result.13

8 Comptroller and Auditor General, The health and social care interface, Session 2017–2019, HC 950, National Audit Office, July 2018.

9 NHS Digital publishes the results of assessments at: www.dsptoolkit.nhs.uk/organisationsearch.

10 Comptroller and Auditor General, Challenges in using data across government, Session 2017–2019, HC 2220, National Audit Office, June 2019.

11 Comptroller and Auditor General, Investigation: WannaCry cyber attack and the NHS, Session 2017–2019, HC 414, National Audit Office, April 2018.

12 Digital Health Intelligence, NHS IT Leadership Survey 2019, July 2019. The Digital Health Intelligence website is available at: www.digitalhealth.net.

13 ‘Babylon GP at hand’ is a GP practice that provides services primarily through the use of a mobile app and video consultations provided by its partner, Babylon.

Part Three

Financial and human resources

3.1 This part examines how much the NHS spends on digital technology, both nationally through the Digital Transformation Portfolio (the Portfolio) and locally by NHS trusts and NHS foundation trusts (trusts), whether this funding is likely to be enough to meet its ambitions, and whether the NHS workforce has the skills to deliver the ambitions.

Financial investment

Expenditure on the Digital Transformation Portfolio

3.2 Government committed £4.7 billion to deliver the Portfolio between 2016-17 and 2020-21 (comprising £2.9 billion of revenue and £1.8 billion of capital funding, covering both transformation and live services). This was an increase compared with 2014-15 and 2015-16, and NHS England & NHS Improvement (NHSE&I) plans to maintain a higher-level of expenditure on the Portfolio to deliver the new strategy (Figure 5).

3.3 There were concerns that the allocated funding would not be sufficient to deliver the ambitions. In 2016, the Wachter Review estimated it would cost almost double the £1.8 billion allocated to achieve a paperless joined-up NHS (from the £4.7 billion Portfolio funding).14 NHSE&I acknowledged that while the funding was not enough to deliver the ambition it could be used to make a significant start and demonstrate the value of more funding in future.

3.4 Costing estimates prepared by NHSE&I for the NHS Long-Term Plan are based on limited data from trusts’ business cases. They indicate that the future shortfall could be more substantial and that the work it funds might fall short of the policy ambition. NHSE&I expects the NHS will need around £8.1 billion to deliver digital transformation ambitions, the proposed funding for this comprises:

£5.1 billion from national bodies, between 2019-20 and 2023-24 (£2.2 billion revenue funding, which is already committed, and £2.9 billion of capital funding which is dependent on spending reviews); and

£3 billion to be funded by trusts between 2019-20 and 2028-29. NHSE&I has not set out how much of this it expects to be funded between 2019-20 and 2023-24 (to align with national funding), but national ambitions suggest the majority will be spent in this period.

A further £1.6 billion is allocated to live services between 2019-20 and 2023-24 (for the maintenance of core information technology (IT) systems and services which support day-to-day running of the NHS; this is mostly committed revenue funding).

3.5 NHSE&I has sought to improve its cost model over time, in particular by adding data from more trusts to the model (it originally estimated costs based on one trust but now uses data from 14 trusts). It now expects trusts to achieve a slightly lower level of digital maturity than it did previously, and has not set an independently verified level of digital maturity that trusts should achieve. This has had the effect of roughly halving its planning estimate to £8.1 billion. The most significant adjustments within this were substantial reductions in estimated infrastructure costs. However, we still consider the estimate to be based on very limited data.15

3.6 There is also a significant risk that trusts will not be able to fund £3 billion. NHSE&I told us that based on experience it is increasingly confident that trusts will invest in technology where national bodies provide an incentive through match-funding arrangements. However, some trusts cite infrastructure upgrades costing £100 million or more as being part of the challenge and note that potentially hundreds of millions of pounds of additional infrastructure investment could be required, including across the hospital estate, to enable full transformation.

3.7 Despite the shortfall in funding, the Portfolio underspent by almost £530 million from 2016-17 to 2018-19. NHS Digital told us this was largely due to delays in implementing work, and NHSX told us that behaviour is influenced by the financial rule that annual spending on digital transformation does not exceed the budget.

3.8 The Department of Health & Social Care (the Department) and its arm’s-length bodies fund general practitioners’ (GPs’) IT systems as part of the Portfolio. Between 2014-15 and 2017-18 the Department spent around £1,260 million on these systems, and between 2018-19 and 2023-24 it expects to spend around £700 million under its new arrangement, GP IT Futures.

Expenditure by trusts

3.9 Trusts’ capital expenditure on IT has increased over the past six years (Figure 6). However, NHSE&I estimated that trusts spend less than 2% of their total expenditure on IT, compared with a recommendation by Lord Darzi that they aim to spend 5% of their turnover on IT by 2022.16 NHSX plans to work with NHSE&I and local organisations in 2020-21 to determine whether there are minimum and optimal levels of expenditure on digital technology, and to set out how funding for technology in trusts should work.

3.10 Trusts and their representative organisations told us that funding is one of the biggest barriers to investing in technology since they face many demands for limited resources. Also, a lack of time to focus on digital transformation, caused by managing day-to-day pressures, makes it difficult to invest. The 2019 survey of 186 IT leaders across the sector found that 77% considered that their organisation’s IT budget was insufficient to meet business priorities.17 Around half the respondents reported that this was the biggest barrier to implementing their IT strategy. Furthermore, our 2019 report NHS financial sustainability noted that technology is typically funded through capital funding but that trusts are short of capital and there is a backlog of (capital-funded) maintenance, yet NHSE&I has moved funding from capital to revenue budgets to help fund day-to-day running costs.18 Alongside this short-term financial pressure, the Wachter Review noted that a financial return on investment from technology typically takes a decade or more to realise.19 Trusts also noted that NHS trusts (as opposed to foundation trusts) find it difficult as they are constrained by centrally-imposed limits on how much capital they can invest.

3.11 Some trusts have received additional funding for technology from national bodies as part of the programmes in the Portfolio. In particular, in 2016-17 the Global Digital Exemplars programme, run by NHSX, committed to providing £385 million to 26 trusts which were already relatively digitally mature so that they could become “world leaders” and share their learning with other trusts, starting with 24 partner trusts (“fast followers”), which receive a smaller share of the funding. There was a concern that this would increase the gap between the most and least digitally mature trusts, but a new programme (the Health Systems-Led Investment (HSLI) programme) has, from 2018-19, made £413 million of additional funding available to sustainability and transformation partnerships (STPs) or integrated care systems (ICSs), and one of its aims is to help less digitally mature trusts prepare for digitisation. In both programmes, trusts receiving additional funding are required to match the central funding they receive (although in the case of the HSLI programme this does not have to be financial investment and can, for example, be staff time to support implementation). NHSX also launched a new programme in 2019-20 to support trusts’ digital transformation. The Digital Aspirant programme is expected to be a multi-year programme, providing £28 million of funding to 23 trusts in the first year.

3.12 While these programmes represent a substantial investment in trusts’ IT, trusts must still fund the majority of their own transformation and there is significant variation in the amount trusts invest. It can be difficult to make direct comparisons because trusts differ in size and type, there is a lack of information on revenue expenditure (which might counterbalance lower capital investment) and because mergers between trusts make it difficult to track spending over time. However, Figure 7 gives some indication of the wide variation between trusts.

Workforce

The current workforce

3.13 Health Education England recently undertook some work to better understand the number of NHS staff who work in specialist information or digital roles. It reported that, in 2019, it was possible to identify 34,800 full-time equivalent staff who worked in ‘informatics’. However, it noted that limitations in the data meant that this figure was likely to be an underestimate and it estimated the actual number of staff was between 40,600 and 53,900 (4% to 5% of the NHS workforce). There is no data on the number of informaticians working in social care. Health Education England also told us it is difficult to gain a reliable understanding of digital skills in the NHS as there is no recognised qualification or accreditation. It believes far more digital staff are needed.

3.14 Trusts and other stakeholders told us it was difficult to recruit and retain staff with specialist information/digital skills because there are few people with these skills and a lot of demand for them. It can be difficult for trusts to pay a competitive salary, and some felt the NHS pay bands set under Agenda for Change could be a contributory factor in this. Some trusts told us that they were sharing staff who had specialist digital skills with local partners. However, the 2019 survey of IT leaders found that after a lack of adequate financial resources, they were most concerned about their lack of staffing resources to implement their IT strategy.20

Future plans

3.15 The Portfolio includes the programme Building a Digital-Ready Workforce. This aims to support the professionalisation of health informatics, improve the digital skills of the health and care workforce, and increase understanding of new technologies among leaders. This programme is a collaboration between Health Education England, NHS Digital and NHSE&I and is expected to cost £17 million (less than 1% of the Portfolio budget) by 2020-21. At October 2019 delivery confidence for the programme was rated as ‘amber-green’, following the recruitment of staff to fill key vacancies. A key element of the programme is the NHS Digital Academy, a virtual organisation set up to develop ‘digital leaders’ in the NHS, such as chief clinical information officers and chief information officers, who can lead local transformation. In partnership with universities, the NHS Digital Academy provides a year-long learning programme (Post-Graduate Diploma in Digital Health Leadership). The first cohort of 100 delegates started in April 2018 and all had completed the training by March 2019. Since then two further cohorts have been recruited with more cohorts expected after this.

3.16 Outside of the Portfolio, the Secretary of State for Health & Social Care commissioned a review to explore how the healthcare workforce could be prepared to “deliver the digital future”, through education and training. The Topol Review: Preparing the healthcare workforce to deliver the digital future (published February 2019) focuses on how technological and other developments (including genomics, artificial intelligence, digital medicine and robotics) are likely to change the roles and functions of clinical staff in all professions, the implications of these changes for the skills required by those professionals, and the consequences for the selection and training of current and future NHS staff. Health Education England told us it is consolidating the work to deliver The Topol Review recommendations and other relevant work into the Building a Digital-Ready Workforce programme from 2020-21. NHSX intends that this new workforce programme will significantly increase the work that was under way within the Building a Digital-Ready Workforce programme. It also expects to commission Health Education England to take full responsibility for the delivery of this work.

14 National Advisory Group on Health Information Technology in England, Making IT Work: Harnessing the Power of Health Information Technology to Improve Care in England, 2016.

15 NHSE&I’s original estimate was around £16 billion. However, the National Audit Office has not seen sufficient evidence to be able to verify this figure and precisely how it was reduced to £8.1 billion.

16 Lord Darzi and Institute for Public Policy Research, Better health and care for all, June 2018.

17 Digital Health Intelligence, NHS IT Leadership Survey 2019, July 2019.

18 Comptroller and Auditor General, NHS financial sustainability, Session 2017–2019, HC 1867, National Audit Office, January 2019. This issue is explored further in the Comptroller and Auditor General’s report Review of capital expenditure in the NHS, Session 2019-20, HC 43, National Audit Office, February 2020.

19 National Advisory Group on Health Information Technology in England, Making IT Work: Harnessing the Power of Health Information Technology to Improve Care in England, September 2016.

20 See footnote 17.

Part Four

Technical challenges in realising the NHS’s ambitions

4.1 To achieve successful digital transformation the NHS will need to overcome several technical challenges. This part examines challenges relating to data, interoperability, legacy systems and the use of cloud computing.

Data challenges

4.2 Commentators have cited the benefits of digital technology in other sectors, such as banking and the airline industry, as an example of what the NHS might achieve through digital transformation. Others note that while there are lessons from other sectors, the activities within the health sector mean that data must reflect the complexity of human physiology, disease and related healthcare processes as well as the unusually specialised and separated nature of health and care services. These factors make it more difficult to achieve the benefits.21

4.3 NHS patient data is used to inform clinicians about the care the patient requires and for secondary purposes such as planning local services and undertaking medical research. However, citizens have the right to opt out of having their information used for secondary purposes if it could identify them. If large numbers of citizens choose to opt out, then planning and research will be less effective. The NHS therefore needs to reassure citizens that their information is safe and will not be shared in ways they disapprove of. The current opt-out rate is below 3%.22 However, the consequences of not winning public trust was demonstrated by the failure of the care.data programme in 2016. This programme was meant to take information from general practitioner (GP) records and combine it with information from hospital records to inform the management and planning of services, but it was closed early following concerns over obtaining patient consent and the right of patients to opt out. The current opt-out policy was implemented following a report by the National Data Guardian, which highlighted the need for the NHS to improve data security and its policies and processes relating to patient consent and opt-out.23

Interoperability

4.4 The Department of Health & Social Care (the Department) has recognised the importance of the seamless sharing of information for a long time: its 1998 information strategy stated that systems would be integrated and information shared, with national standards to enable this, by 2005.24 The Department and its arm’s-length bodies refer to this as ‘interoperability’. This term can mean different things, but essentially the data must be structured and coded so that the users of both the sending and receiving information technology (IT) systems will have a common understanding of what the data mean. The main steps to be taken and features of interoperability are set out in Figure 8. This shows that while progress is starting to be made, huge challenges will need to be overcome.

4.5 For interoperability to work there must be national standards in place, setting out an agreed way of recording and sharing data. The Vision for digital, data and technology (the Vision) included a sample of the (international and UK) standards the NHS will need to achieve interoperability, including:

unique patient identifiers to ensure safety and continuity of care, and to allow patients to log in to online NHS services (NHS number);

specifications for staff and the public to securely access multiple applications using a single log-in (FIDO, OpenID Connect and OAuth 2.0);

terminology for clinicians to describe interactions with patients (SNOMED CT);

terminology for clinical interactions with patients, for secondary uses such as planning services and medical research (ICD11);

codes that describe medicines and devices in use across the NHS (Dictionary of Medicines and Devices); and

a standard for exchanging healthcare information electronically (FHIR).

4.6 However, the NHS standards vary in their readiness for use and whether they are already mandatory. NHS Digital has defined three sets of standards that should be fully adhered to now, two sets that are ‘live’ so organisations should be planning to adopt them if they are not already using them, three sets that are a future requirement, two sets that have been identified but not yet defined, and an unspecified number of standards that have not been identified. As noted in paragraph 2.4, NHSX expects to set out its approach for mandating that organisations meet technology and data standards in early 2020-21. Where standards are not adequately defined there is a risk that different stakeholders will implement them differently, meaning that their systems are not interoperable. For example, in our report Rolling out smart meters, we found that using multiple suppliers and manufacturers while standards were still under development increased the complexity of roll-out and caused delay.25

4.7 Technical experts told us that the NHS is making progress but will still need to do a great deal of work after it has defined its standards. For example, the NHS has worked with suppliers and other stakeholders to define the content of transfers of care records (the information that must be provided when a patient moves from one organisation to another, or when they are discharged from care), and the transmission of these records using FHIR standards. However, transfers of care are just one function. The NHS will need a separate set of messages for different clinical specialties and care settings. This is a major undertaking and the NHS has not set a timeframe for completing it.

4.8 Stakeholders told us that achieving interoperability through standards has been made more complex by several previous attempts to achieve standardisation, resulting in the use of multiple standards, including alternative standards for the same function and several generations of the same standard being in use at the same time. For example, the standards that predate FHIR have been around since the 1980s and were implemented as part of the previous National Programme for IT (the Programme) in some national services. In our view, if NHSX does not develop and implement a carefully-considered plan then it risks not only failing to take the right steps towards interoperability in the short-to-medium term, but also making it harder to achieve interoperability in the future by adding to the number of standards in use.

4.9 Stakeholders we spoke with felt that achieving interoperability was a significant challenge. One technology supplier believed, however, that many of the benefits of interoperability could be achieved quickly by sharing the GP record, which it considered to be the most complete account of a patient’s history. The supplier considered that hospitals could be allowed to view and update the GP records, while at the same time interoperability across all care settings was worked on. NHSX considered that simply sharing the GP records would not be sufficient to deliver all of the benefits envisaged in the NHS Long-Term Plan. It noted that GP records hold useful data, but will not hold the detailed history of all the interactions between the patient and the health and care system, or some data that are of interest to clinicians working in hospitals.

Legacy systems and data

IT systems

4.10 Following the closure of the Programme (see paragraphs 1.9 and 1.10) NHS trusts and NHS foundation trusts (trusts) were free to buy their own IT systems (the Five Year Forward View referred to this period as allowing “a thousand flowers to bloom”). This has resulted in a vast array of IT systems being used (potentially hundreds within a single trust), which makes sharing information within and between organisations very complicated. For example, some of the IT systems are not based on existing standards and to become interoperable will need to be replaced or converted. The NHS digital maturity assessment asks trusts about their compliance with six standards. Figure 9 shows compliance with some important standards is not widespread among trusts. It might take trusts a lot of effort over many years to make their systems compliant. Stakeholders said that trusts typically change their electronic patient record systems every 10 to 15 years, and while the cost varied it was tens of millions of pounds and could be far higher if infrastructure upgrades are necessary to support the system (more than £100 million for some trusts, see paragraph 3.6).

4.11 NHSX expects trusts to take one of three approaches to replacing electronic patient record systems:

an enterprise-wide commercial system;

a ‘best of breed’ approach that uses different patient record systems in different hospital departments and seeks to integrate them to achieve interoperability; and

in-house systems built by the NHS.

4.12 NHSX considers that the ‘best of breed’ approach is more complex, and trusts using it take longer to improve digital maturity compared with those using the enterprise approach. It has limited information on in-house systems. Trusts that we spoke with that had implemented an enterprise approach told us they had to change workforce processes as part of the system implementation, which is difficult but essential when transforming. NHSX does not have data on the whole-life costs of the different approaches. However, it noted that while the upfront costs of the enterprise approach are higher, the running costs of a best of breed solution are likely to be higher and that the NHS cannot afford to implement an enterprise system in every trust. The 2019 survey of 186 IT leaders across the sector found slightly more trusts were developing an enterprise-wide approach compared with best of breed (at a ratio of 33:26).26

Data

4.13 NHS information is held on a large number of IT systems and is not recorded in a consistent format. Much of the work to make data consistent across organisations will be done through the Local Health and Care Record programme. This programme involves local health and care organisations collaborating to develop a single ‘longitudinal’ record for each patient in their area. The records developed in this programme will include every interaction the patient has with the health and care sector. This record will make key information available to authorised professionals involved in the patient’s care regardless of their location within the area (hospital, GP practice, in the community) and updates to the record will be made in ‘near real-time’, so the professional is able to see all relevant information. The data of these records will be in a standardised format so that they can be accessed by different applications. The data will also be used to create an anonymised longitudinal record that can be used for purposes other than the care of the patient (‘secondary uses’), in a way that means the patient cannot be identified. The work to ‘normalise’ NHS patient data (that is, put it in a standard format, as codes rather than free text) is to be done as part of this programme.

4.14 The programme is being delivered in ‘waves’, with an initial expectation that the final wave will be completed by April 2023. At the current time only the first wave has been launched, covering 42% of the population and based in five localities. At September 2019 the performance of the localities was mixed, and localised work had not yet been brought together to ensure there was sufficient standardisation to allow data-sharing between the five localities. The overall rating of the programme was ‘amber’, which reflected delays in putting in place funding for the second wave of the programme and a shortage of staff. NHSX told us that it was undertaking a review of the programme to learn from the lessons of the first wave in order to inform how the programme would progress in the rest of the country. It said some of the uncertainty is created by the need to make national decisions about the best overarching approach for patient records that can inform local work, but that because NHSX is still a relatively new unit it had not yet recruited sufficient staff to allow it to do the necessary work.

4.15 Trusts’ self-assessment of their digital maturity in 2017 indicated that some trusts were unable to rely on their digital data, did not routinely share digital data in a structured format and most were unable to view or amend an electronic patient record shared with local organisations. In the assessments only 39% of trusts reported that, of the information they shared with other healthcare providers, more than 60% was in a structured or semi-structured digital format. And Figure 10 shows trusts’ responses when asked about how reliable digital records were in their trust, whether data were recorded just once, and whether staff could view and contribute to patient health and care records shared with other local organisations. In the 2019 digital maturity assessment of GPs, 57% of practices reported that other local healthcare providers could electronically access their practice records (although the data-sharing is not necessarily done in a structured format).

4.16 Part Two (paragraphs 2.7, 2.8 and 2.16) notes that the Vision sets out plans to increase the number of technology suppliers providing systems to the NHS. It is our view that the increased number of suppliers could make it harder to achieve interoperability since there will be more systems that need to interoperate, and each system-to-system integration creates additional burden for the NHS. And, in our experience, each time a single system changes in a legacy environment a whole cycle of reintegration with other existing systems is then required. NHSX intends to avoid this problem in the future by asking local organisations (in partnership or individually) to build a ‘data layer’ with communication protocols known as Application Programming Interfaces (APIs). These data layers would mean patients’ data are not held solely in IT systems purchased from vendors, but are available from other data stores including the cloud. NHSX intends that, eventually, these data layers will be linked, enabling organisations to access and exchange data from different systems or layers.

4.17 The data layer aspiration does not have clear scope, delivery milestones, schedule or budget, so we cannot assess progress towards it. NHSX will need to define what work is needed to achieve this at a greater level of detail than principles. For example, it will need to specify a data model, data architecture, and physical solutions with timescales and funding to develop them, so that local organisations can build their data layers. Our previous work has shown that other parts of government found the use of APIs to share data was not always straightforward due to the inconsistency and lack of accuracy of data. In our report Challenges in using data across government, we noted that APIs will not resolve all the data-sharing issues without proper standards and a clear data model being in place. While it may be technically possible to introduce APIs into a legacy environment, some government departments found it to be difficult and expensive.27

Cloud computing

4.18 ‘Cloud computing’ is a term for using the internet to access applications, computing power and data stored outside an organisation’s own premises. The Vision includes the principle that all healthcare services should run in the public cloud. Government digital policy also supports the move to cloud computing (although departments are free to choose an alternative if they can demonstrate that it offers better value for money). Moving to cloud computing may present challenges at both the national and local level. NHS Digital told us that moving the ‘NHS Spine’ (a part of the health and social care IT infrastructure in England) to the cloud in its current form would be unlikely to save money and would involve a significant effort. In the future it plans to re-develop the NHS Spine so it is feasible to make it a cloud-based service. A further challenge of cloud computing for trusts is that, since cloud computing is a service, it is funded through revenue budgets rather than through capital investment (which has traditionally funded IT investments). Trusts’ revenue budgets must cover all day-to-day activity and it can be difficult to fund digital services from the same budget.

4.19 In our guidance for audit committees on cloud services in 2019, we cautioned that the cost and effort of moving to cloud computing solutions and the skills required to manage them effectively should not be underestimated.28

21 INTEROPen, FHIR and openEHR, March 2019.

22 There are two types of opt-out. This opt-out rate refers to the national-data opt out, previously known as the Type 2 opt-out, and relates to patients opting out of having their data shared outside NHS Digital for reasons other than direct care. The Type 1 opt-out refers to patients opting out of having their data shared outside their GP practice for reasons other than direct care. The Department of Health & Social Care expects to remove Type 1 opt-outs in 2020.

23 National Data Guardian for Health and Care, Review of Data Security, Consent and Opt-Outs, June 2016.

24 NHS Executive, Information for Health, 1998.

25 Comptroller and Auditor General, Rolling out smart meters, Session 2017–2019, HC 1680, National Audit Office, November 2018.

26 Digital Health Intelligence, NHS IT Leadership Survey 2019, July 2019.

27 Comptroller and Auditor General, Challenges in using data across government, Session 2017–2019, HC 2220, National Audit Office, June 2019.

28 National Audit Office, Guidance for audit committees on cloud services, April 2019.

Appendix One

Our audit approach

1 See Figure 11.

Appendix Two

Our evidence base

1 We reached our independent conclusion on whether the government was ready to deliver value for money through the digital transformation of the NHS after analysing evidence we collected between March 2019 and April 2020.

2 We analysed operational, financial and performance data, including:

expenditure on digital technology, digital services and information technology, by national and local NHS bodies;

cost estimates for future plans;

digital maturity assessments completed by trusts in 2016 and 2017;

other data published or provided by NHS Digital including workforce data, local organisations’ scores on the Data Security and Protection Toolkit; and

workforce data provided by Health Education England.

3 We conducted case study visits (and/or teleconferences) with five trusts: Bradford Teaching Hospitals NHS Foundation Trust, Cambridge University Hospitals NHS Foundation Trust, North Middlesex University Hospital NHS Trust, West Hertfordshire Hospitals NHS Trust and University Hospital Southampton NHS Foundation Trust. We selected these trusts to provide differing geographical locations, levels of digital maturity, financial position and size (based on number of staff).

4 The main purpose of these case studies was to see how the national strategy is understood and delivered at a local level, and the challenges faced by local organisations. We carried out semi-structured interviews with staff and reviewed digital transformation plans and other documents and data.

5 We conducted semi-structured interviews with individuals from a range of organisations. The interviews were designed to help us understand the perspectives and challenges of government bodies and other stakeholders including the digital technology industry, patients, the NHS workforce, and the leadership of local healthcare organisations (in particular trusts). We spoke with those involved in the strategy, planning, oversight and delivery of digital transformation including the Department of Health & Social Care, NHS England & NHS Improvement, NHSX and NHS Digital. Other stakeholders we met included Health Education England, the Care Quality Commission, the Infrastructure and Projects Authority, the Government Digital Service within Cabinet Office, The National Data Guardian, the Local Government Association, the Professional Record Standards Body, Healthwatch England, NHS Confederation, NHS Providers, the British Medical Association, Academy of Medical Royal Colleges, the Royal College of General Practitioners, the Royal College of Nursing, techUK, INTEROPen, Cerner, TPP, the Nuffield Trust, the Health Foundation and The King’s Fund.

6 We reviewed important documents. These included departmental and NHS strategy and planning documents, governance and oversight documents, guidance to local organisations and technical standards.

Design and Production by NAO External Relations
DP Ref: 006583-001