Part 4 of The State of DHCW. DHCW's financial control is not in question — unqualified accounts, savings targets overachieved. The criticism is the relationship between spend and outcome: vacancy savings balancing the books of an organisation criticised for insufficient capacity, £30m sunk into WCCIS without an updated business case, and the Welsh Government's 2026 finding of 'sunk-cost lock-in.' The resilience record shows a June 2024 data-centre cooling failure repeating in June 2025, and eleven change-caused major incidents in twelve months with the root cause still unexamined.
Part 4 of The State of DHCW. Numbered citations resolve at the sources page.
Money: sustained investment, unproven benefit
DHCW’s financial control is not in question. It broke even on revenue and capital in 2024–25, its accounts received an unqualified opinion on 27 June 2025, and it overachieved its savings target, delivering £2.7m against a £1.5m goal.[12] The criticism is about the relationship between spend and outcome.
- Savings quality. Of the £2.7m saved in 2024–25, £2.2m came from staff vacancy savings.[12] Audit Wales has flagged “over-reliance on non-recurrent savings” in every structured assessment since 2022, warning that vacancy savings convert into a future shortfall when posts are filled.[15][13][12] An organisation criticised for insufficient delivery capacity is balancing its books partly by not filling posts.
- Short-term funding. The Digital Priorities Investment Fund, replaced in 2025–26 by the Annual National Priorities Fund, “is not long-term,” which Audit Wales says “makes it harder for DHCW to plan over the medium term and hire staff on long term contracts.”[12] The 2025–26 plan assumes £174m total funding.[12]
- Sunk cost without benefit. WCCIS central support costs reached about £30.16m to March 2022, with at least £8.31m more committed (up to £12m if required) — while “the overall business case for WCCIS has not yet been updated, something that I recommended should happen in advance of committing more funding.”[16] Benefits reporting arrangements “have still not been resolved.”[16]
- The Welsh Government’s 2026 finding. “Significant investment has continued in major national digital programmes without commensurate progress toward delivery, increasing the risk of poor value for money and sunk-cost lock-in,” with “insufficient use of pause, reset or stop mechanisms” and “investment … often continued during periods of enhanced monitoring or recovery, rather than being actively constrained or reset.”[1]
- Unquantified requirement. The 2023 joint committee report found “It is concerning that DHCW has not been able to quantify either the capital or revenue funding requirements for digital transformation.”[22]
- 2026: the funding tap tightens mid-intervention. By May 2026 — a month after the Level 4 escalation — DHCW was operating under a recruitment pause and a “DPIF pause and review.” The Audit and Assurance Committee was alerted to consequent risks across the portfolio: the National Target Architecture 2026–27 plan paused; NDR “funding uncertainty and recruitment pause”; the App programme’s “limited ability to expand the in-house app development team and continue external support”; a Connecting Care funding risk; and, for the Cloud Transition Programme, exposure to “increased long-term costs, including rising data centre expenses, hardware replacements for ageing infrastructure, and upcoming software renewals such as Citrix.”[72] An organisation escalated for failing to deliver was simultaneously constrained from hiring the people to deliver.
- An unprovided-for tax liability. Board papers disclose an HMRC VAT assessment of £4.023m plus £0.852m default interest covering the July–December 2021 period, with enforcement paused. DHCW holds a provision for the VAT but “does not hold a provision for the interest liability given that the cash was transferred to WG in line with requirements.”[63]
Resilience: outages, incidents and technical debt
The operational record is more mixed than the programme record, and improved materially after 2018 — the 2023 joint committee report specifically credited “a reduction in ICT outages.”[22] Headline availability is genuinely high: 99.974% across 2024–25.[67] But headline availability conceals both volume and repetition. In 2024–25 DHCW logged 61 major incidents, of which 98% were resolved within target fix-times — meaning roughly one in fifty was not.[67] Two patterns in the record are more troubling than any single outage: the June 2024 data-centre cooling failure recurred in June 2025, and change management keeps causing major incidents despite repeated reviews.
| Date | Incident | Effect and attribution |
|---|---|---|
| Jan–Jun 2018 | 21 major outages | Public Accounts Committee: "one outage every 9 days," prompting its recommendation for a review of senior leadership capacity.[21] NWIS era. |
| 24 Jan 2018 | National data-centre outage | 26 nationally hosted systems affected "including systems which manage appointments and which share patient referrals, tests results, laboratory results and GP test requests." Cause: "a problem with the firewall equipment which occurred when a routine firewall change was applied." Not a cyber attack; record integrity not compromised.[5] The Auditor General recorded radiotherapy delays and inability to access blood results, and concluded: "We are not aware of patients coming to harm … although it can reasonably be expected that the issues will have contributed to negative patient experiences and significant frustration on the part of NHS staff."[19] NWIS era. |
| May–Jul 2021 | Welsh Clinical Portal degradation; Fiorano outages | Cwm Taf Morgannwg UHB: WCP "loading times increasing to 3-5 minutes," and "3 outages in the past 14 days associated with the DHCW Fiorano integration engine which have taken down numerous clinical applications." Electronic radiology requesting in emergency departments fell 50% in April–May.[53] |
| Oct–Nov 2021 | WCCIS unavailability | "Significant performance issues during a planned upgrade to the underlying platform for the system resulted in the system being unavailable altogether for certain periods," continuing into early 2022.[16] |
| May–Jun 2023 | WelshPAS / WNCR / WCP; GP Test Requesting | A WelshPAS failure left the Welsh Nursing Care Record "rendered ostensibly offline (beyond login)" and removed WCP clinic and ward lists, pathology requesting and pharmacy ordering, though a read-only record view remained. A separate GP Test Requesting outage lasted 68 minutes, linked to "high CPU (100%) exacerbated by an application memory leak." Eleven major IT incidents were logged that month.[43] |
| 2023–24 | Change-management controls | A risk-based audit of change management was commissioned by DHCW's Incident Review and Learning Group "following a number of incidents occurring as a result of inconsistencies in Change Management practice, resulting in unplanned downtime." Its tally of non-compliances / non-conformities was "Major = 6 … Minor = 1 … OFI = 0." The findings included "No verification or risk acceptance criteria required on implementation of emergency changes" — the observation being that "potentially a change with any risk rating can be approved by a Change Manager" — and "Security controls are not defined," with "Security Assessments on change requests … not defined or benchmarked."[42] Given that the 2018 national outage was caused by a routine change, this is a pointed finding. |
| Jun 2024 | Data-centre cooling failure — 1st | "A cooling failure at one of our data centres resulted in the shutdown of some underlying infrastructure which caused an outage of multiple services" — 29 services, all restored within six hours.[44][67] Laboratory (WLIMS), demographics (WDS), GP test requesting, WCP and WNCR all fell below target. June logged 10 major incidents totalling 5,503 disruption minutes, with availability of 99.866% against the 99.900% target — the lowest month of the year. DHCW said the supplier had "identified preventive measures."[44] |
| 2024–25 full year | Aggregate incident load | 61 major incidents; average availability 99.974%; 98% resolved within target fix-times. DHCW notes "some of these incidents were due to issues with third party suppliers or infrastructure problems at health board premises."[67] Separately, DHCW "logged 9 clinical incidents. Four of these incidents were escalated to Welsh Government as Early Warning Notifications due to the assessment of the potential for patient harm during the initial incident review."[68] |
| Mar 2025 | Five major incidents | Reported to the SHA Board: "Five Major Incidents (MIs) for DHCW-provided services occurred with change control process reiterated to avoid future incidents."[69] |
| 11 Jun 2025 | Data-centre cooling failure — repeat | Presented to the Board as a "Data Centre Learning Incident" by the Executive Medical Director and Executive Director of Operations: "The incident on 11th June involved a major failure in the Data Centre 1 … Both cooling systems failed, causing a spike in temperature and subsequent service interruptions." Response involved "powering off services and failing over to the secondary facility." Critical services were recovered by 10pm, "with some non-critical services still impacted"; full resilience was not restored until 13 June — three days. June availability fell to 99.8% against the 99.9% target. Actions included establishing "a standing Major incident management team," playbooks, faster failover automation, and to "continue to work with DCP to improve the resilience of cooling systems at DCI."[70] |
| to Dec 2025 12 months | Change-caused major incidents | An IRLG thematic review, "Incidents caused by Change": "Over the past 12 months, DHCW had encountered several Major Incidents (MIs) associated with unsuccessful changes, leading to operational disruptions and safety concerns. Eleven of these incidents were directly attributable to inadequate impact assessments or an inability to foresee the unintended consequences of system changes." Critically: "Although previous incident reviews have been conducted to address these issues, the fundamental cause relating to the application of the change management process by teams had yet to be thoroughly examined." Lessons included enforcing technical peer review, treating misconfigurations as formal Problems, and to "avoid normal working hours when performing high-risk changes such as failover testing."[71] |
| 2025–26 | Cloud dependency; NIS | An Early Warning Notification was issued to Welsh Government "in relation to Information Services issues surrounding Amazon Web Services (AWS), with a total of 6 notifications issued across the year." Two incidents were referred to the Cyber Resilience Unit under the NIS Directive; neither was assessed as in scope.[71] |
| Feb 2026 | Four major incidents | Reported to the May 2026 Board: "Four major incidents occurred in February but were resolved within the SLA," with availability at 99.95%.[72] |
| May 2026 | National NHS Wales broadband outage | "An update was provided on a major national IT incident which affected the NHS Wales broadband services … detected early evening and resolved overnight. No data loss or patient harm identified. A national lessons learned review will be undertaken in collaboration with Welsh Government."[72] This affected the shared national network rather than DHCW-hosted applications specifically — see PSBA. |
The repetition is the finding. In June 2024 a cooling failure at a DHCW data centre took out 29 services and produced the worst availability month of the year; DHCW reported that the supplier had identified preventive measures.[44] In June 2025 — almost exactly a year later — both cooling systems failed at Data Centre 1, and full resilience took three days to restore.[70] The public minutes do not state that the root cause was identical, and it is fair to note that fail-over to the secondary data centre worked; but a second cooling failure in twelve months, after remediation, is a resilience failure of the same class.
The change-management picture is worse because it is explicitly acknowledged as unresolved. A 2023–24 audit found six major non-conformities in change management.[42] Change control was "reiterated" to the Board in March 2025 after five major incidents.[69] Then in late 2025 a thematic review found eleven major incidents in twelve months caused by inadequate change impact assessment, and recorded that despite "previous incident reviews … conducted to address these issues, the fundamental cause … had yet to be thoroughly examined."[71] That is the identical dynamic the Welsh Government describes in programme delivery — remediation reported, cause untouched — appearing in operations.
On technical debt, DHCW’s own medium-term plan concedes “an increasingly complex technical landscape … against a backdrop of an outdated legacy of technical debt which needs updating.”[49] Its 2026 evidence quantifies the underlying problem: “There are more than 1400 different digital systems in use resulting in fragmentation and duplication.”[4]
On cyber and data protection, the Cabinet Secretary’s February 2026 letter recorded assurance on the Security Operations Centre and Cyber Resilience Unit but said DHCW “also recognised the need for a national governance board setting minimum cyber standards, and the importance of consistent adherence across health boards,” adding that Welsh Government “expects this area to continue receiving urgent attention.”[3] DHCW disclosed five potential personal-data-breach incidents in 2022–23, of which “none met the assessment criteria for reporting to the ICO.”[43a] No ICO enforcement notice, reprimand or penalty against DHCW or NWIS was found.