You can't have a solution when you don't know what the question is
The trouble is that the people involved with "Digital" within the NHS - and further up the chain - have little clue as to what they're asking for. It's often a case that there are simple solutions but they aren't educated enough to understand what they're asking for, or know the risks if they're given something which doesn't meet the criteria.
As a case in point I've witnessed a web application - made for the NHS - which was supposed to store data privately. The requirement being that nobody outside the NHS was allowed to access it. What they overlooked was the fact that both the hosting company and developers had full access to said database. This is probably something they didn't even consider because they didn't know how the underlying technology works. Where do they think the data is being stored? Where do they think it's being backed up to? Oh yes, they don't think, because in their minds that's the remit of Jonny Developer and totally not their concern. Even though it's their sodding data.
The NHS, and indeed the government, should start with being educated on the basics of how software/applications/the web actually works, and then take things from there. It's a very sad (unless you're a developer and want to "cash in"!) state of affairs when £9 million of tax payers money is being pissed away because the people that are in positions of power are so bloody thick.