NHS: In-house Software Capabilities

Question

Asked by

To ask His Majesty’s Government what plans they have for sustaining and enhancing the in-house software capabilities of the NHS.

My Lords, NHS Digital services are built and run to rigorous Government Digital Service standards. They are secure, user-centred, interoperable and continually improving. National Health Service England has significantly expanded its in-house engineering and data capability, and it is reducing its reliance on outsourced systems and strengthening operational resilience. These measures ensure that health and care data is available in all clinical settings to improve outcomes for patients, while delivering value for money to the taxpayer.

I thank the Minister for that reassuring Answer. The NHS has had a disastrous history of outsourcing its IT technology, which has wasted millions of pounds. A requirement of outsourcing is that there must be sufficient in-house expertise to properly assess the need for outside assistance and the quality of whatever assistance is on offer. In the absence of such expertise, outsourcing can be perilous. Moreover, given the requisite in-house expertise, outsourcing may become unnecessary. At a time when a host of novel IT solutions are becoming available, the IT staff of NHS England are seeing their numbers radically reduced. At the same time, the NHS is becoming increasingly dependent on the services of large American IT corporations. Can we be assured—genuinely assured—that history will not be repeating itself?

My noble friend is right to point out the history. The NHS previously relied very heavily on large, outsourced IT systems that, in some cases, led to inflexibility, high long-term costs and limited NHS control over core platforms and data. I was glad to arrange for my noble friend to meet the chief data and analytics officer at NHS England last Wednesday. I hope that, like me, he was reassured that NHS England has very much shifted its model towards building and operating critical digital services in-house, in line with the standards that I referred to in my initial Answer.

My Lords, cyber security is an essential element in any system, but nowhere more so than when people’s health records are being maintained. Many security breaches are attributed, at least in part, to human error. What investment are His Majesty’s Government making to train front-line staff in the new systems and provide continuous professional development to achieve the 10-year digital healthcare plan?

The straightforward answer is that we are doing exactly that. It is important to say that our front-line digitisation—our move from analogue to digital—is not something for the sake of it; we are doing it because it is improving efficiency and outcomes. For example, a 94% coverage of electronic patient records is expected by the end of this month, and the digitally mature trusts show a 13% lower cost per admission. That is a prize worth having, but we can do it only through the systems and training that the noble Baroness seeks.

My Lords, I support what the noble Viscount said. The history of software in the National Health Service is nothing less than a disaster. Coupled with that is a very unfortunate situation where some of the companies that have been responsible for these messes in the NHS are still on the Government’s procurement lists and are still getting contracts from the Government. Surely more attention should be paid to that, and we should curb that as soon as possible.

If the noble Lord has particular companies in mind, he is most welcome to raise them with me. It is important that we look at what NHS teams have done: they have designed, built and maintained national platforms. The NHS app is an example; I am sure that many noble Lords will be familiar with it. That is going to be our digital front door to the NHS. In addition, there is the NHS login and core national infrastructure. All these mean full NHS ownership, governance and control. Supported by £2.5 billion of investment in 2025-26, we are, as the noble Lord seeks, expanding NHS in-house digital capability to reduce the reliance on large suppliers.

My Lords, last week’s catastrophic attack on Stryker by Iranian-linked actors paralysed supply of some critical surgical equipment across the NHS. Does the Minister agree that our total reliance on vulnerable third-party global medtech platforms is a serious security risk? How will the Government ensure in-house expertise and procurement software so that the NHS can bypass compromised commercial networks during such crises?

Cyber attacks across our whole government are extremely concerning, and that is why we have built resilience. On health and social care specifically, I can assure the noble Lord that, in 2025-26, we invested £75 million across health and social care; that built on the £375 million invested since 2017. When I had responsibility for the blood transfusion service, my own experience was that, where there was a cyber attack, we had the systems in place.

My Lords, there is always a very difficult balance between keeping something in-house or outsourcing it, and we should not forget the national programme for IT in the NHS in the early 2000s, which ended up costing between £10 billion and £20 billion. My question is on the company Palantir. The Minister will be aware that there are a range of views on Palantir. Some say that it is the best software available and that no one can match it; others say that they are worried that it will lock the NHS in long-term and scrape data for other uses. What specific measures have NHS England and the department put in place so that, in the event that the Palantir contract is not renewed, the healthcare system will be able to move seamlessly to another supplier?

That seamless movement is an important point generally, but the federated data platform does not centralise or sell patient data. Data remains firmly under NHS control, and access is strictly governed. It is fully auditable and used only for approved patient benefit and NHS benefit. Palantir operates strictly under the instruction of NHS England and it does not, as I said, own or control NHS data. That access is tightly governed. In response to the earlier question, I note that the federated data platform to which the noble Lord refers is cyber resilient and subject to rigorous contractual, legal and information governance controls.

My Lords, my question also relates to the federated data platform. I am sure the noble Baroness is aware that more than 50,000 patients have written to their local trust boards asking not to have their data placed on it. The Greater Manchester ICB, serving 2.8 million patients, has said that this does not present value for money and is a big public trust issue. Palantir is of course owned by Peter Thiel and Alex Karp, who are closely associated with the Trump regime and have very right-wing and anti-democratic views. Does the Minister acknowledge that this association with Palantir is damaging our NHS?

I would first look at delivery: the federated data platform has enabled nearly 100,000 extra operations, removed over 600,000 patients from waiting lists and reduced unnecessary bed days by 15%, as well as driving a 10% improvement in cancer diagnosis—so people are being diagnosed sooner because the system is working more efficiently, and that is important. This is a three-year contract given in 2023. I refer the noble Baroness to the comments I made to the noble Lord, Lord Kamall, about the rigorous contract due diligence for all commercial agreements, including with Palantir.

My Lords, it is historically true that the NHS wasted a lot of money, but this was partly because the development of digital services was in-house. Currently, things are looking much better, and the classic example is the development of the NHS app. However, I will ask the Minister about the health research data service that will be established. Patients should have confidence in data that is used and collected for research, partly because of the recent report on UK Biobank, where the researchers published the codes they were using to access data for research. It has to be made absolutely certain that the public have the confidence in the data that is used.

Absolutely—public confidence is really important, and the debate around this today perhaps emphasises the need to communicate the realities of what is going on. But giving the NHS greater control and long-term value for money, as well as protecting privacy and improving public trust while improving outcomes, is the way forward. But the noble Lord is quite right, and we will ensure that we seek to build that confidence still further.