Concerns that £360m data platform for NHS England is being set up to fail

The top-down approach to the procurement of a £360 million data platform for NHS England is said to favor incumbent supplier Palantir as fears grow the project could be making the same mistakes that led to the failure of the country's infamous £10 billion National Programme for IT. Reports emerged recently showing that the …

[alain williams]

Data grab

This worries me about working with Plantir, how can we be sure that they, or the other bidders, will not quietly add what they learn to the profiles being built about us. Especially so for USA based companies that are subject to the Patriot Act.

Why is it that I always misread Peter Thiel as Peter Thief ?

[VoiceOfTruth]

Re: Data grab

Our data is now being read by Uncle Sam, thanks to the bought and paid for politicians in Whitehall.

[Fruit and Nutcase]

Re: Data grab

What could go wrong...

https://www.bbc.co.uk/news/health-61759643

[hoola]

Re: Data grab

I read this earlier this morning, it is unbelievable.

GPs should never have been allowed to become privatised in this way (and most are now). THe only reason US companies are involved is because of money, data and future contracts. Health provisions is a monumental cash cow in the US and over the last 20 years the UK is seen as a nice fat target ripe for picking.

It is exactly the same as all the schools "Academy Trusts" that are just a way for pen-pushers to make money at the tax payer's expense.

I am not sure US companies have moved into this area yet but give them time.

[Anonymous Coward]

Re: Data grab

>GPs should never have been allowed to become privatised in this way

GPs have always been independent of the NHS. As have dentists.

[Prst. V.Jeltz]

Re: Data grab

semantics!

They have some freedom to manage themselves but Doctors are free at point of service because the govt pays their salaries, Hence they are part of the NHS.

Dentists however , different story i wouldn't mind getting to the bottom of .

Most seem to be able to decline so called "NHS Patients" that dont make them as much money and be fully private.

[Anonymous Coward]

Re: Data grab

"GPs should never have been allowed to become privatised in this way (and most are now)."

In the NHS GP Practices have *always* been private organisations run "for profit" (typically a Partnership rather than a Limited Company). In a typical GP Practice partnership not all the GPs are partners, some of them are employees of the partnership.

Background info: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/770916/gp-partnership-review-final-report.pdf

[I am the liquor]

Re: Data grab

I think hoola has a point though. GPs were always "privatised," but they were not always "privatised in this way." There's a world of difference between an LLP owned by the GPs (or dentists) themselves, and a large corporation serving hundreds of thousands of patients with the cheapest service they can get away with.

[Anonymous Coward]

Re: Data grab

"I am not sure US companies have moved into this area yet but give them time."

Did you actually read the BBC article (or other media article)? To quote from the 3rd paragraph of that article:

"The company, with almost 600,000 NHS patients, is owned by US healthcare giant Centene Corporation."

So it has already happened. Indeed there is an ongoing court case relating to this: https://www.theguardian.com/business/2022/feb/01/us-healthcare-giants-takeover-of-uk-gp-practices-lands-in-high-court

[Gerry Hatrick]

Re: Data grab

Wow, a whole 0.86% of the population. Really making strides there. Or in reality, insignificant.

[Jimmy2Cows]

Re: Data grab

Wooooooooooooooooooossssssssshhhhhhhhhhh...

[Anonymous Coward]

Re: Data grab

"Wow, a whole 0.86% of the population. Really making strides there. Or in reality, insignificant."

if your happy about that your welcome to fuck off to USA and try how failling ill with a long term issue over there works out.

[Anonymous Coward]

Re: Data grab

> Why is it that I always misread Peter Thiel as Peter Thief ?

Thievel Kin'evil

[MikeLivingstone]

A scandal in the making!!!

This approach is just repeating the NHS' bad old mistakes and seems to support the ongoing lobbyists revolving door, whilst locking in NHS structural inefficiency.

It is also worth noting that Palantir's Technology is out of date, and really they should be excluded from the process for trying to circumvent it by hiring.

Patients will die if the NHS doesn't reform its data handling and analysis processes. Today too much narrow focus is placed on the specialisms rather than a holistic approach with patient centric medicine. Modern analytics and AI can reveal new insights, but again the adoption of this is slow.

[Jedit]

"This approach is just repeating the NHS' bad old mistakes"

Actions are only mistakes if they don't lead to the desired outcome. Since the desired outcomes here are 1) lining the pockets of business donors and 2) laying the groundwork for the privatisation of the NHS, it's hard to call this deliberate mismanagement a mistake.

[James Anderson]

Purpose = profit

I have a 40 year IT career and this is the first time I have come across "Purpose Based Access Control".

I quick google come up with some results but nearly all relate to palitar's sales bumf/propaganda and a couple of obscure research papers.

I would guess that "purpose" is a synonym for "paid".

You could have a situation where your doctor whose "purpose" is healing would have trouble accessing data that a big pharma company whose "purpose" is profit can easily mine.

[Fruit and Nutcase]

Re: Purpose = profit

Yep - give the data to the companies and when the medics need to access it, charge for it. And they'll possibly add some variable pricing to it - A citizen has been involved in a RTA - the medics in casualty want to access the subject's medical info - computer asks for reason: life-threatening emergency - that will then be charged at the higher rate/possibly even by sub-second billing for the amount of time the information was viewed.

[elsergiovolador]

Re: Purpose = profit

Or simply a hostile state like Russia could buy the database / access and mine to find a weak spot in the population, then create a chemical compound that could exacerbate it and add it to food products or deliver in other ways to create a full blown health crisis.

[Prst. V.Jeltz]

Re: Purpose = profit

wow! why dont we do that in reverse and create a full blown health boom!

[Anonymous Coward]

Re: Purpose = profit

> Or simply a hostile state like Russia could buy the database / access and mine to find a weak spot in the population, then create a chemical compound that could exacerbate it and add it to food products or deliver in other ways to create a full blown health crisis.

McDonalds are way ahead of you.

[Anonymous Coward]

Re: Purpose = profit

>I have a 40 year IT career and this is the first time I have come across "Purpose Based Access Control".

Quite. It had a brief moment in the sun in academia cira 2005 but ultimately as used today it exclusively refers to implementations of Palantir's attribute-based access control system with some scoring and logic gubbins stuck on the side.

Of course if you said "we'd like some ABAC coupled a business rules engine for attributes" then everyone and their mum could bid, and Palantir wouldn't win because they're 50x the cost.

[Anonymous Coward]

Re: Purpose = profit

> I have a 40 year IT career and this is the first time I have come across "Purpose Based Access Control".

I've also never heard of it before. Whilst searching for it I did discover another alphabet-soup version, RCPBAC, "Role-Involved Conditional Purpose-Based Access Control": https://link.springer.com/content/pdf/10.1007%2F978-3-642-15346-4_13.pdf

[elsergiovolador]

Smorgasboard

Since there is no accountability, the worst that can happen will be the famous four words:

Lessons have been learned

As long as people responsible don't go to prison and start losing their assets, there is not going to be any change, because why?

It's essentially free money.

[Dr Who]

Misunderstanding the NHS

The NHS is an umbrella for a myriad different organisations and a million odd staff. Some of these are private (think GP practices, dentists and pharmacists for example) and some public (largely emergency, acute care and chronic care). If the NHS stands for one thing it's that for its users healthcare is free at the point of delivery. In this context, delivering a monolithic national software stack is a complete nonsense.

Each organisation in the NHS should be free to choose from best of breed solutions for their particular area of operation. The national framework should aim instead to set standards for data interchange such as xml schemas for patient records plus possibly some kind of middleware service to ease the integration of systems via their APIs. A central data repository for healthcare analytics requires only anonymised data, the aggregation of which can be automated using the aforementioned schema definitions and APIs.

In this way a competitive software ecosystem is established ensuring best value for money for the tax payer, avoiding a supplier monopoly, denying the government another unjustified opportunity of harvesting personally identifiable data and finally denying politicians and civil servants the opportunity of a lucrative non-exec role in the private sector. These are also the reasons why the NHS always fails to get sensible technology solutions.

[David M]

Re: Misunderstanding the NHS

Sadly I can only give one upvote. This is exactly what I've been saying for years, not because I have any special insight but because it's the obvious thing to do, supporting genuine competition, and not allowing any one company to monopolise things. But when did common sense ever play a part in major government procurements?

[MisterHappy]

Re: Misunderstanding the NHS

This is what I have tried to get across on here before there is no "The NHS" when it comes down to Hospitals, Trusts, GP's & Dentists, it's more like a franchise.

There are standards in place for data formatting, most systems use a variant of HL7 for messaging between clinical applications to allow interoperability, with some translations needed because HL7 is not a strict standard.

At the moment Trusts/Hospitals are free to choose their preferred software for EPR/Imaging etc & this is usually driven by the clinicians, which can lead to some interesting conversations around what IT think should be implemented vs what the clinicians desire. (The clinicians always win btw).

[James Anderson]

Re: Misunderstanding the NHS

Absolutly. What is required is a well defined set of message formats and protocols for exchanging medical data.

The financial world has had these for years SWIFT, FIX, etc. These are standards based message formats which the various institutions are free to implement however they like as long as they follow they structure the messages correctly and follow the communications protocols.

[XZ]

Re: Misunderstanding the NHS

This style of integration described by 'Dr Who' is being worked on independently by local groups of healthcare organisations - such as the Yorkshire and Humber Care Record (YHCR). This specifies messaging protocols and provides the exchange for healthcare providers to query/send data relevant to current patient care while caching no data itself, or dictating the local systems in use.

It works and pays early dividends in healthcare terms.

[tip pc]

DIY

The NHS should just roll their own, setup their own thing or empower a leading uni to setup a business to provide privacy focussed home grown solutions for their IT needs.

It’s how everyone used to do it, see Lyon’s TEA for an example of how amazing diy systems can be.

[Anonymous Coward]

Re: DIY

I'm sorry. I have to disagree.

Whilst it would make every sense to get an internal body to the NHS do this, 40 years of the NHS being run by civil servants who couldn't organize their way out of a paper bag begs to disagree with the common sense.

Getting commercial pressures into play was essential to prevent the huge inefficiencies that the systems were (and in some ways still are) built in to the system.

But there needs to be control. What we actually need is a regulated market, with hard rules to ensure that the NHS is being run mainly for the benefit of the people, not the companies running it.

There are some organizations that absolutist need to be run on a non-profit basis, like education, the health service and some utilities. Unfortunately, politicians make the rules. We're going down the route of the people in control influencing the rules so that they personally benefit. This is just so wrong, but the rules to set the rules are created by the same people!

I'm a conservative at heart, but I can't wait to see the back of the incumbent madmen (or is it just one madman) currently ruling the asylum. The only problem with that is that this issue is endemic in all of the political parties with any potential to get into power.

[tip pc]

Re: DIY

Whilst it would make every sense to get an internal body to the NHS do this, 40 years of the NHS being run by civil servants who couldn't organize their way out of a paper bag begs to disagree with the common sense.

https://en.wikipedia.org/wiki/Central_Computer_and_Telecommunications_Agency

https://en.wikipedia.org/wiki/Structured_systems_analysis_and_design_method

https://en.wikipedia.org/wiki/ITIL

https://en.wikipedia.org/wiki/PRINCE2

UK government where a pioneer in many initiatives for computing a few of which i have linked to above.

its likely fairer to say that since government computing agenda was decentralised since the mid 90's and more autonomy given to individual departments to negotiate with industry the outcomes have got steadily worse.

look at the number of systems that are still on operation for more than 25 years and contrast with all the IT disasters where new systems have failed to be successfully implemented in the last 25 years. Air traffic control NATS is a good example of a modern replacement system that had a hard time replacing its predecessor that was built to differing standards.

[Peter Gathercole]

Re: DIY

Love your references to ITIL and PRINCE2.

Very good set of practices, very often paid lip service to, even though they were 'required' for government projects.

And I believe that both were defined since 'the mid '90s' that you use as a break point between good and not-so-good.

NATS is an interesting example. It's not fair to say that the system in use at that time could not be replaced. A like-for-like replacement could have been done quite easily. But the scope of the new system was so much greater than the original, and this is often the case with replacement projects. This, and the fact that the integration problems of the US based software with the different areas of ATC in the UK were more extensive than originally expected, plus the issue of the contract being moved from one contractor to another twice during the implementation all contributed to the late delivery.

[Medical Cynic]

Mistakes learned?

The only lesson the NHS has learned from its previous mistakes, is HOW TO REPEAT THEM

[Cereberus]

Am I being stupid?

Whilst I like to keep up with IT issues generally I am only good at dealing with issues at a single local PC level, so bearing that in mind am I just being stupid with the next question?

Why do Palantir (or whoever ends up building the system) need access to the data at all? I can understand them needing dummy data for testing purposes but why can't they build the system and hand it to the NHS groups who then have people trained on the system to provide ongoing support from within the NHS itself. That way the data is kept integral to the doctors, hospitals etc. who need access to undertake their role but it centralised with no access by a 3rd party.

Worst case a major system fault appears and Palantir' specialist engineers' need to be drafter in to provide additional support resolving the problem, but they shouldn't need to take live data off the system, and shouldn't be allowed to.

[Anonymous Coward]

Re: Am I being stupid?

You're not being stupid; there's no reason why not; and many companies keep their private data private from suppliers in similar ways.

Palantir, no doubt, have said something along the lines of: yes we can do that - you can have the basic system and manage the data yourselves. And then add the inevitable "But... if you want us to mine the data to show you how to save £Xm a year on your drugs bill, for example, then you'll need our expert staff and we'll need a copy of all the data.

[Anonymous Coward]

Floods of cash

I spent some time working with the NHS recently and money is flooding in at an unprecedented rate. Your money. My money. It's being pumped in for infrastructure and capital investments rather than improving operational services. It's focussed on removing technical debt and getting the NHS fit and ready for sale. Your money, my money, our money is being used to get our NHS fattened up and ready for sale at market to whichever US healthcare conglomerate offers the minister a consultancy gig after the ministerial gravy train ends. NHS privatisation isn't just a threat anymore it's a thing that is happening before our eyes. This is the theft of our generation, like the railways, energy, water and telecoms we owned that was taken from us the last time this lot were in charge. They know they won't be in power for a long time after this so it's now or never for taking every penny they can from us.

[ThunderchildCharles]

Why are the design specs not open-source?

I'm a software developer, but I have no experience of government IT and the tenders/contract system, but I do want to ask...

Such data platforms are hardly cutting edge technology, why is everything so vague in the government announcements and tech press? It's like they're setting up for novel research in computer science... It's bread & butter stuff on face-value, which is all they disclose...

Why is there not a concrete list of data requirements offered for public scrutiny? This isn't for "gotcha" reasons, it's simply the best known approach to a good engineering solution: peer review. Each proposal from a vendor should come with a design doc, again for public scrutiny. I suspect they are massively over-complicating the project, and I see no counter-balances in this tender system to counteract that. The only one that works is public discussion and bidding, with open-source outputs.

[Variant-separate]

Tin foil hat

It’s sad that after almost 2 years as a public company people still have no idea what Palantir does. Palantir does not collect, buy, sell or share data. It’s merely a tool that lets organizations understand data they already have (think Excel).

Their SEC filings specifically state that data never leaves the customer. They would be delisted and sued for lying. Even if you don’t believe that, why would hundreds of EU companies work with them if they shared or sold data.

Please do your own research, it’s all there. Just read past the scaremongering headlines. Spending 10b tax payer money building something that doesn’t work rather than buying the industry leader for 300m is ridiculous.

[eljay90]

Re: Tin foil hat

Palantir's products are a decade ahead of the nearest competition & offer a unique opportunity for the NHS & the UK government to actually make a smart decision for once.

Palantir does not collect, buy, sell or share data but it does display this data in ways that people can actually understand & make informed decisions.

a) It's better than something the government or the competitors have or could make

b) It's cheaper than building from scratch (ignoring the fact it would take decades to get anything half useful to be released)

c) I would quite like it if billions of the taxpayer's money were not wasted due to inefficiencies (300m seems a fair trade-off to me)

[Strahd Ivarius]

Re: Tin foil hat

Palantir, as an American company, will give access to your data to 3-letters agency as soon as they request it, because they follow the US laws and your data is hosted on an American cloud...

[Variant-separate]

Re: Tin foil hat

Palantir has a product called "Foundry On-Premises" which stores the data at the customer site and not on a cloud.

Even if it was hosted on a cloud like AWS, 3 letter agencies can't just request it. See Lawful Overseas Use of Data Act (“CLOUD Act”).

[Bill19501]

Your commentators seem to have lost the plot. What has the article got to do with GPs being independent contractors? Commentators should be concentrating on the total inability of the civil service to actually provide any sort of management on large programmes.

There's an old project management saying that goes 'Analyse from the top down; Build from the bottom up'. The initial analysis should have been used to generate a plan. Instead, we got the 2018 NHS Long Term Plan, which isn't actually a plan as you need an effective strategy to define what information needs to be collected in order to determine the actions that are necessary to meet objectives. There are no actions, just a wish list. Instead of a sensible IT strategy, we have an Apps based approach that has no chance of maximising the benefits of what should be a massive improvement in the utilisation of date within the NHS via data warehousing the Spine. NHSx actually wanted to simplify the Spine so that ordinary people could use it to make their own medical decisions. How useful would that be!

Phil Booth is quite right in saying that the process will fail for the same reasons that NPfIT and Connecting for Health failed. NHSx and NHS Digital have also disappeared, being absorbed into NHS England. How is that going to improve things? They need to change thinking, not re-organising.

In 2016, The Government generated another quango called the Major Projects Authority which was later integrated into yet another quango to produce the Infrastructure and Major Projects Authority. I spent a miserable 2 hours listening to the new organisations’ presentation to the Public Accounts Committee. It was obvious that nobody involved had the faintest idea of what they were doing and how to manage massive programmes.

Another saying from project and programme management goes ‘Q: How do eat an elephant? A: Cut it into bite size pieces!’ yet I’ve never heard a mention of breakdown structures.

They don’t even seem to understand contracts. After all the money that was spent implementing ISO 9000, performance-based specifications are still rare beasts.

I could go on, but it’s a waste of time. I wrote a comprehensive report on what needed to be done about 3.1/2 years ago after I’d watched the PAC presentation. I got a note from Lord Kamalls’ office earlier this year to say it has now been passed to the civil service to deal with

[Bill19501]

Your commentators seem to have lost the plot. What has the article got to do with GPs being independent contractors? Commentators should be concentrating on the total inability of the civil service to actually provide any sort of management on large programmes.

There's an old saying that goes 'Analyse from the top down; Build from the bottom up'. The analysis should have been used to generate a plan. Instead, we got the 2018 NHS Long Term Plan, which isn't actually a plan as you need an effective strategy to define what information needs to be collected in order to determine the actions that are necessary to meet objectives. There are no actions, just a wish list. Instead of a sensible IT strategy, we have an Apps based approach that has no chance of maximising the benefits of what should be a massive improvement in the utilisation of date within the NHS via data warehousing the Spine. NHSx actually wanted to simplify the Spine so that ordinary people could use it to make their own medical decisions. How useful would that be!

Phil Booth is quite right in saying that the process will fail for the same reasons that NPfIT and Connecting for Health failed. NHSx and NHS Digital have also disappeared, being absorbed into NHS England. How is that going to improve things? They need to change thinking, not re-organising.

In 2016, The Government generated another quango called the Major Projects Authority which was later integrated into yet another quango to produce the Infrastructure and Major Projects Authority. I spent a miserable 2 hours listening to the new organisations’ presentation to the Public Accounts Committee. It was obvious that nobody involved had the faintest idea of what they were doing and how to manage massive programmes.

Another saying from project and programme management goes ‘Q: How do eat an elephant? A: Cut it into bite size pieces!’ yet I’ve never heard a mention of breakdown structures.

They don’t even seem to understand contracts. After all the money that was spent implementing ISO 9000, performance-based specifications are still rare beasts.

I could go on, but it’s a waste of time. I wrote a comprehensive report on what needed to be done about 3.1/2 years ago after I’d watched the PAC presentation. I got a note from Lord Kamalls’ office earlier this year to say it has now been passed to the civil service to deal with