Patient Safety

Digital Health and Care Wales controls every critical digital system that NHS Wales depends on: patient administration, GP referrals, prescriptions, patient identity matching, laboratory systems, radiology, and the national patient app. When these systems fail, patients are harmed. This page documents the evidence — from health boards, Royal Colleges, government officials, and DHCW's own admissions — that the organisation's failures are not merely administrative inconveniences but active risks to patient safety.

1. WPAS and Patient Death

The Welsh Patient Administration System (WPAS) is used in every hospital in Wales. It processes 4.5 billion transactions and serves 52,653 users. It is the foundational system through which patient admissions, appointments, referrals, and clinical workflows are managed.

According to information from Employment Tribunal proceedings, a senior technical leader at a Health Board confirmed that WPAS was identified as a factor in the death of at least one patient. The same Health Board considered WPAS their single biggest risk to patient safety.

This allegation has not been independently verified through public records. However, it is consistent with the known condition of the system. The Senedd's Public Accounts Committee found in 2018 that NWIS (DHCW's predecessor) was operating "archaic and fragile IT systems." DHCW itself has acknowledged that the quality of its systems "directly affects administrative and clinical decision-making." The system that processes the largest volume of patient data in Wales has been identified by those who use it most as a threat to the patients it was designed to serve.

2. WCCG — The Ticking Time Bomb

The Welsh Clinical Communications Gateway (WCCG) is the system that connects GP practices to hospitals. Every time a GP refers a patient to secondary care — for a specialist appointment, for diagnostic testing, for urgent assessment — that referral passes through WCCG.

According to Employment Tribunal proceedings, this system runs on technology that has been unsupported for eight years. It allegedly meets no criteria for resilience or cybersecurity. The technical team responsible for maintaining it had been raising the alarm for years, warning leadership that the system was deteriorating. Those warnings were allegedly ignored.

The consequences of failure are not hypothetical. If WCCG goes down, every referral to secondary care in Wales stops. GPs cannot send patients to hospital. Hospitals cannot receive referrals. The entire pathway from primary to secondary care — the route through which cancer diagnoses, cardiac assessments, surgical referrals, and urgent care transfers flow — ceases to function.

This is not a system that might fail at some point in the distant future. It is a system running on technology that has passed every reasonable end-of-life threshold, held together by a small number of specialists who, according to Sam Hall, Director for Primary Community Mental Health Digital Services, present a critical knowledge risk. As Hall acknowledged at the January 2026 accountability meeting: "The issue we have with our legacy technology is that... there are just a few people that know how that thing is put together."

3. eMPI Outage — Patient Records Mixed Up Across Wales

The enterprise Master Patient Index (eMPI) is the system that matches patients to their records. It is the identity layer beneath every other system in NHS Wales. When a clinician looks up a patient, when a prescription is issued, when test results are returned — the eMPI ensures the right information reaches the right patient.

According to Employment Tribunal proceedings, the eMPI suffered a catastrophic outage that mixed up patient records across Wales. The consequences were immediate and dangerous: patients received health communications intended for other people, while others missed invitations to life-saving treatments. Screening invitations — for conditions including cancer — went to the wrong addresses or did not arrive at all. A year of remedial work followed at significant cost.

The eMPI had been procured at considerable expense for a system designed for entirely different purposes, of which only a tiny fraction of its capability was used. The outage demonstrated what happens when critical patient safety infrastructure is treated as a procurement exercise rather than an engineering challenge.

4. Royal Colleges Joint Briefing — July 2025

In July 2025, the Royal College of Physicians Cymru Wales and the Royal College of General Practitioners Cymru Wales issued a joint briefing demanding urgent action on digital fragmentation across NHS Wales. These are the professional bodies representing the doctors who use DHCW's systems every day to treat patients.

Their warning was unequivocal. Patients "regularly experience delays that lead to worsening health" when moving between digital systems. Digital fragmentation leaves patients facing "confusion and avoidable risk."

The Royal Colleges' intervention is significant because it represents the clinical profession's formal judgement — not a political criticism, not a media report, but the considered assessment of the doctors who see the impact of system failures on their patients. When physicians state that patients "regularly experience delays that lead to worsening health," they are describing harm that is occurring now, repeatedly, as a direct consequence of the digital infrastructure DHCW is responsible for delivering.

5. DHCW's Own Admission

The most damning evidence on patient safety comes not from external critics but from DHCW itself.

In its own documentation, DHCW has acknowledged:

"The environment of differing configurations, logins and user interfaces is complex to manage, and ultimately increases the risk of harm to patients."

This is not alleged. This is not contested. This is DHCW's own written assessment of its own systems. The organisation responsible for Wales's digital health infrastructure has stated, in its own words, that the current state of that infrastructure increases the risk of harm to patients.

When the delivery body and the clinical professions agree that the status quo risks patient harm, the finding requires no further interpretation. DHCW has diagnosed the disease. It has failed to deliver the cure.

6. NHS Wales App Delay

The NHS Wales App was conceived in 2021-2022 as the national patient-facing digital platform — Wales's equivalent of the NHS App in England. It was intended to give patients access to their records, appointments, prescriptions, and communications with their health providers.

As of early 2025, the app was still in beta with approximately 1,000 users at ten GP practices — a negligible footprint. By late 2025, DHCW claimed 345,000 registered users, though the gap between 1,000 and 345,000 within a single year, if accurate, represents belated acceleration under the pressure of Level 3 escalation rather than planned delivery.

At the January 2026 accountability meeting, Nick Wood, Deputy Chief Executive of NHS Wales, stated: the app has "been mired in delay, non-delivery." He added: "People are clearly not adopting it, because it's not there for what they want it to be there for" and "There's hardly anybody in the population who are registered and are using the app regularly."

When asked to provide a timeline for when the app would reach critical mass, Sam Hall, Director for Primary Community Mental Health Digital Services, replied: "I think it's really hard to put a time point on when we'll hit that critical mass."

Cabinet Secretary Jeremy Miles responded: "I'm not getting a great deal of confidence that we know what the critical path is for the app."

His follow-up letter of 12 February 2026 stated: "The public need a more integrated, seamless, and universally reliable product before this can be described as the primary digital front door for Wales."

Meanwhile, over 653,000 people sit on NHS Wales waiting lists. These are patients who could benefit from digital access to their referral status, appointment management, and clinical communications. Every month the app remains non-functional is another month these patients are excluded from the digital services that patients in England have had for years.

7. Pandemic Preparedness

In January 2025, CEO Helen Thomas gave an interview to Digital Health in which she was asked whether NHS Wales's digital systems were ready for another pandemic.

Her answer: "Are we ready for the next one? No."

She disclosed that data-sharing freedoms temporarily enabled during COVID-19 had "almost snapped back to pre-Covid levels." Wales had accumulated "non-standard standards" and "compromises to make things work in an integrated way over the last two decades." The Electronic Prescription Service — a critical capability for remote healthcare delivery during a pandemic — had been activated by only 7% of GP practices and 19% of community pharmacies.

She also revealed that In Practice Systems, one of Wales's two GP system suppliers, had entered administration — creating a single-supplier dependency risk not previously disclosed in public governance documents.

The pandemic response of 2020-2021 was frequently cited by DHCW as evidence of its capability. Thomas's own 2025 admission that the systems are not ready for a repeat means the pandemic response was a temporary workaround, not a durable legacy. If another pandemic struck tomorrow, Wales's digital health infrastructure — under DHCW's stewardship for nearly five years — would be no better prepared than it was in 2020.

The Human Cost

These are not abstract system failures. Behind every statistic is a patient:

• The patient whose death was linked to WPAS — a system DHCW knew was failing.
• The patients who received someone else's health communications after the eMPI outage — and the patients who missed screening invitations for life-threatening conditions.
• The patients who, according to the Royal Colleges, "regularly experience delays that lead to worsening health" — delays caused by the digital fragmentation DHCW was created to fix.
• The 653,000 patients on waiting lists who cannot access their own health information digitally because the national app remains, in the Deputy Chief Executive's words, "mired in delay."

DHCW was established in April 2021 with a specific mandate: to transform NHS Wales's digital infrastructure. Five years later, CEO Helen Thomas admits the organisation cannot demonstrate a return on investment, the Welsh Government has imposed its highest level of intervention, and the clinical profession has formally warned that patients are being harmed.

Source Note

Patient safety evidence on this page is drawn from the following verified public sources: the Senedd Public Accounts Committee report on NWIS (November 2018); the joint briefing by the Royal College of Physicians Cymru Wales and RCGP Cymru Wales (July 2025); DHCW's own published documentation acknowledging patient harm risk; the DHCW public accountability meeting of 29 January 2026 (live-streamed, transcript generated via OpenAI Whisper); the Cabinet Secretary's follow-up letter of 12 February 2026; and Helen Thomas's interview with Digital Health (January 2025). Where claims derive from Employment Tribunal proceedings — specifically regarding WPAS and patient death, the WCCG system condition, and the eMPI outage — this is explicitly stated. These allegations have not been independently verified from public records.