Digital NHS faces ‘optimism bias’ risk after past IT failures

The government has acknowledged that its flagship digital reforms face significant delivery risks, citing a history of NHS IT programmes underestimating cost, complexity and timescales.

An impact statement on the NHS 10 year health plan, published by the Department of Health and Social Care (DHSC) on 12 January 2026, says that the project to establish a single patient record (SPR) “is expected to take several years based on evidence from previous major digital programmes in the NHS”.

The government admits “it is possible that the project takes longer than expected and the HM Treasury Green Book notes that there is a systematic tendency for project appraisers to be overly optimistic both in terms of costs and duration”.

It highlights the scale and technical difficulty of the programme, with costs expected to include “product development, technology and data integration including alignment with external vendors, delivery and administration”.

The DHSC stresses there are risks associated with the SPR “due to the magnitude and complexity of the programme and integration with legacy systems”.

It adds that the “broad scope of the SPR means it will require investment to ensure that staff such as paramedics and community pharmacists have the same access to their patients’ data as those working in GP surgeries and hospitals”.

Patient information collected through the NHS App and wearable devices will also create “further revenue and capital costs” alongside ongoing operational burdens.

Concerns are raised about the supplier dependency, warning about “reliance on a single provider and de-facto vendor-lock”, where the cost of switching becomes so high that provision is locked into the original supplier.

The statement also highlights concerns about data security and privacy, stating “while many people would support data sharing for the purposes of improving care, there may be a risk of clinical resistance to changes to data sharing if safeguards are perceived to be insufficient”.

Citing public attitudes research, it notes that while 83% of respondents said that they trust the NHS to keep patient data secure, common concerns were around cyber attacks and that the NHS “might make mistakes with their patient data”.

Although the statement says that the NHS App could become a source of 24/7 access to the NHS, it adds “there are risks were the NHS App not to become a widespread ‘first choice’ option as this could limit the scale of transformation to health service access that the plan aspires to”.

Key barriers to adoption of the app include patients preferring contact by phone or in person, staff lacking the skills or confidence, and app functionality not meeting both the patient’s and GP practice’s needs.

The DHSC says that AI “could be cost saving in the long run due to operational efficiencies” however risks include “slow uptake due to implementation delays caused by upfront cost of new technologies”.

“There are also inherent wider risks of artificial intelligence, which will need to be mitigated – including safeguarding patient data and training models using high quality evidence that is reflective of different population groups and equalities considerations,” the statement adds.