Digital systems are clinical instruments. The record — a patient index that mixed up records, a cancer system tolerated for thirty years, a decade-old safety fix never delivered — is what happens when the people accountable for the instrument are not the people who use it on patients. The fix is structural: clinical leadership with authority, safety engineering with published evidence, and co-design as a condition of funding.
Clinical leadership with authority
- Every health board: a Chief Clinical Informatics Officer (CCIO) and a Chief Nursing Informatics Officer with protected time, sitting in the board’s digital governance — part of the minimum capability standard.
- The standards body: a Chief Clinical Informatics Officer on the executive, owning the clinical safety function and the AI register.
- Nationally: a Welsh clinical informatics council — the CCIOs, the Royal Colleges, primary care — that ratifies clinical standards before adoption. The Royal Colleges wrote in December 2025 that clinicians “regularly see examples of patients experiencing delays… when they move between systems.” The council makes that constituency a standing authority instead of an occasional briefing.
Safety engineering, published
Clinical risk management to DCB0129 (manufacturers) and DCB0160 (deploying organisations) — not as compliance paperwork but as engineering practice:
- A named, trained Clinical Safety Officer for every system in clinical use — supplier side and deploying side.
- Safety cases published. Hazard logs and safety cases for national systems are public documents, redacted only where the law requires. A safety case that cannot survive publication is not a safety case.
- Incidents reported like aviation. Digital-clinical incidents flow to a national reporting stream with feedback loops to every board; the monitoring framework tracks them as a headline quadrant.
- The triage precedent. Intervention 1’s patient-safety triage of live systems is the transitional form of this discipline. This chapter makes it permanent.
Co-design as a funding condition
The delivery standard requires named clinicians in discovery; this chapter requires them with authority throughout: a clinical lead with sign-off on every clinical workflow, paid sessional time (not goodwill), and adoption forecasts made by named clinicians at named boards — the mechanism Portfolio Ruthlessness uses to select programmes, applied to everything that ships. Denmark’s Sundhedsplatformen go-live taught the comparator lesson: procurement without deep clinical implementation involvement produces clinician revolt. Wales gets to skip that lesson by learning it from someone else’s rollout.