Culture Reform

In 2018, the Welsh Public Accounts Committee found that DHCW's predecessor had a culture that was "the antithesis of open." Staff were afraid to speak. Testimony was choreographed. The committee warned that this culture "may be masking wider and deeper problems."

Eight years later, under CEO Helen Thomas, every problem they feared has materialised. At least two senior technologists have allegedly been dismissed after raising concerns about programme failures that the Welsh Government would later confirm. DHCW publishes zero data on whistleblowing disclosures, zero data on disciplinary actions, and zero data on why people leave. The organisation has not just failed to fix the culture the PAC identified — it has perfected the mechanisms of silence.

Reform must address whistleblowing protection, psychological safety measurement, learning from failure, authentic staff engagement, and the institutional structures that enable a culture of silence to persist.

1. Independent Freedom to Speak Up Guardian

The problem: DHCW adopted the Welsh Government's "Speaking Up Safely" framework, which on paper guarantees protection for staff who raise concerns. In practice, those who speak up are removed. The framework relies on internal investigation of retaliation claims — but when the retaliation is authorised by the same leadership that the whistleblower is reporting, internal investigation is structurally incapable of delivering justice.

The proposal: Appoint an Independent Freedom to Speak Up Guardian (FTSUG) for DHCW — external, statutory, and reporting directly to the Welsh Government, not to DHCW's board or executive team.

How it would work:

• Independence: The FTSUG is not a DHCW employee. They are appointed by the Welsh Government, funded by the Welsh Government, and accountable to the Welsh Government. DHCW has no influence over their appointment, remuneration, or removal.
• Access: The FTSUG has statutory right of access to all DHCW premises, staff, records, and communications relevant to any disclosure under investigation. Obstruction is a disciplinary offence for any DHCW employee, including the CEO and directors.
• Reporting: The FTSUG publishes an annual report covering: number of disclosures received, categories, investigation outcomes, whether any discloser experienced adverse consequences, and recommendations. The report is presented to the Senedd Health and Social Care Committee.
• Protection powers: Where the FTSUG finds evidence that a discloser has experienced detriment (dismissal, demotion, exclusion from projects, hostile performance management), they have the power to recommend remedial action — including reinstatement — and to refer the case to an Employment Tribunal with supporting evidence.
• Proactive engagement: The FTSUG conducts annual "speaking up" surveys across all DHCW staff (including contractors and off-payroll workers) to identify whether the culture supports disclosure. Survey results are published.

Comparator: NHS England operates a national Freedom to Speak Up Guardian network, with guardians in every NHS trust and a National Guardian's Office that publishes data, sets standards, and investigates patterns across the system. The model is well-established and effective. DHCW has no equivalent — and given its track record of retaliating against whistleblowers, it cannot be trusted to operate one internally.

2. Mandatory Whistleblowing Data Publication

The problem: DHCW publishes zero data on whistleblowing. Zero. Not the number of disclosures received. Not their categories. Not their outcomes. Not whether disclosers faced adverse consequences. This is not because no disclosures have been made — we know of at least two cases where senior staff raised concerns and were allegedly dismissed. It is because the absence of published data makes it impossible for external bodies to identify patterns, assess the culture, or hold leadership accountable.

The proposal: Mandate quarterly publication of whistleblowing data, using the National Guardian's Office standard dataset:

• Number of disclosures received (and whether anonymous or attributed)
• Category of each disclosure (patient safety, financial waste, bullying/harassment, other)
• Whether each disclosure was upheld, partially upheld, or not upheld
• Time from disclosure to resolution
• Whether any discloser experienced adverse consequences within 12 months of disclosure (and if so, what consequences)
• Actions taken in response to upheld disclosures

Publication: On DHCW's website, in a dedicated "Speaking Up" section, alongside the Independent FTSUG's annual report.

Why this matters: Data publication alone doesn't fix a toxic culture. But the absence of data guarantees that a toxic culture cannot be detected, measured, or challenged by external bodies. Publishing data creates accountability. When a future DHCW CEO claims the culture has improved, the data will either confirm or contradict the claim.

Comparator: NHS England publishes national whistleblowing data through the National Guardian's Office. Individual trusts publish their own data annually. The data has identified patterns of poor practice and driven targeted interventions. Wales has no equivalent dataset.

3. Psychological Safety Baseline and Measurement

The problem: Harvard's Amy Edmondson has demonstrated conclusively that psychological safety — the belief that you can speak up without being punished — is the single most important factor in team and organisational performance. Google's Project Aristotle confirmed this finding at scale. Organisations where psychological safety is low have higher error rates, lower innovation, worse outcomes, and higher staff turnover.

DHCW's culture, as described by the PAC in 2018 and evidenced by subsequent whistleblower retaliation, is the textbook definition of low psychological safety. But DHCW has never measured it. You cannot improve what you do not measure.

The proposal: Conduct a formal Psychological Safety Assessment across DHCW using Edmondson's validated 7-item instrument, administered by an independent third party.

Implementation:

• Baseline assessment (Year 1): Independent administration of Edmondson's psychological safety survey to all DHCW staff, including contractors and off-payroll workers. Results reported by team, directorate, and organisational level — disaggregated enough to identify problem areas but anonymised enough to protect individual respondents.
• Results published: In full, on DHCW's website. Not summarised, not curated, not filtered through leadership. Published.
• Annual repeat: The assessment is repeated annually using the same instrument, administered by the same independent party, allowing year-on-year comparison.
• Action plans: Where any team or directorate scores below the Edmondson threshold for adequate psychological safety, a mandatory remediation plan is developed with the Independent FTSUG and monitored quarterly.
• Leadership accountability: Psychological safety scores are included in the Personal Accountability Statement metrics for every executive director.

Comparator: Google uses psychological safety measurement as a core team health metric. NHS England trusts increasingly use Edmondson's instrument or equivalent tools. High-performing technology organisations worldwide treat psychological safety as a leading indicator of delivery capability. DHCW does not measure it at all.

4. Blameless Post-Mortems

The problem: When things go wrong at DHCW — and they go wrong frequently — the institutional response is to assign blame, manage the narrative, and protect leadership from scrutiny. The eMPI outage that mixed up patient records across Wales did not result in a published post-mortem. Programme failures that triggered government intervention did not result in published lessons-learned documents. The organisation does not learn from failure because it does not study failure — it hides it.

The proposal: Adopt the practice of Blameless Post-Mortems for all significant incidents and programme failures, following the model established by Google, Etsy, and now widely adopted across the technology industry and increasingly in healthcare.

How blameless post-mortems work:

• Trigger: Any significant incident (system outage affecting clinical users, data breach, security event) or programme milestone failure (missed deadline, budget overrun above 20%, failed service assessment) triggers a mandatory post-mortem.
• Process: Within 5 working days, the team involved writes a structured post-mortem covering: what happened (timeline), why it happened (root causes, not just proximate causes), what went well (what prevented it from being worse), and what actions will prevent recurrence.
• Blameless principle: The post-mortem focuses on systems, processes, and circumstances — not on blaming individuals. "Person X made an error" is never an acceptable root cause; "The system allowed an error to propagate because of [design flaw]" is. This is not about avoiding accountability — it is about creating an environment where people tell the truth about what happened, because only the truth enables improvement.
• Publication: All post-mortems for incidents affecting clinical users or patients are published on DHCW's website within 30 days. Internal incidents are shared across DHCW and available to the Independent Technical Advisory Panel.
• Action tracking: Every action item from every post-mortem is tracked in a published register. Overdue actions are escalated to the board.

Comparator: Google publishes its Site Reliability Engineering (SRE) handbook, which codifies blameless post-mortem practice. NHS England's Clinical Safety team requires incident investigation for clinical digital systems. The practice is standard in every high-performing technology organisation. DHCW appears to conduct no systematic post-incident learning.

5. NHS Staff Survey (Not Self-Designed)

The problem: DHCW conducts internal staff satisfaction surveys and reports the results to its board. The results are consistently positive — high satisfaction, high engagement, strong culture. These results are contradicted by Glassdoor reviews describing a culture of fear, by the PAC's finding of a culture "the antithesis of open," by the alleged dismissal of whistleblowers, and by the Welsh Government's own intervention.

The reason for the discrepancy is simple: when an organisation designs its own survey, administers its own survey, and reports its own results, it gets the answers it wants. This is not measurement — it is theatre.

The proposal: Replace DHCW's self-designed staff survey with the NHS Staff Survey — the standardised instrument used across NHS England, administered independently, and benchmarked against all other NHS organisations.

Benefits:

• Independence: Administered by an approved external contractor, not by DHCW's own HR or communications function.
• Standardisation: Uses the same questions across all NHS organisations, enabling like-for-like comparison.
• Benchmarking: DHCW's results can be compared directly against NHS England digital organisations, other Special Health Authorities, and NHS Wales bodies.
• Credibility: Results published nationally cannot be curated or suppressed by DHCW leadership.
• Trend tracking: Year-on-year comparison using a stable instrument reveals whether culture is genuinely improving or whether positive headlines mask deteriorating reality.

Comparator: Every NHS England organisation participates in the NHS Staff Survey. Results are published, benchmarked, and used as a basis for CQC inspection and NHS oversight. DHCW uses its own instrument that produces consistently positive results that no one outside the organisation believes.

6. Staff Digital Council

The problem: DHCW staff — the engineers, developers, clinical informaticists, and technical specialists who do the actual work — have no formal mechanism for influencing technical decisions, raising concerns about programme direction, or providing input to strategy. Technical decisions are made by leadership and imposed on delivery teams. When those decisions are wrong (as they frequently are), the teams who predicted the failure have no channel through which their expertise is heard.

The proposal: Establish a Staff Digital Council — a representative body of DHCW's technical and clinical informatics staff that has formal input into technical strategy, programme prioritisation, and standards decisions.

How it would work:

• Composition: 8-12 members elected by DHCW staff in technical and clinical informatics roles. Representation across directorates. Contractor and off-payroll workers eligible to participate and vote.
• Remit: The Council has formal rights to:
  • Review and comment on all technical architecture decisions before they are approved by the board
  • Provide written evidence to the Independent Technical Advisory Panel during programme assessments
  • Submit an annual "State of Technology" report directly to the Senedd Health Committee, independent of DHCW leadership
  • Raise concerns about programme direction, technical debt, or workforce issues directly with the FTSUG
• Protection: Council members are protected from adverse consequences for their Council activities under the same framework as the FTSUG arrangements.
• Transparency: Council meeting minutes, submissions, and the annual report are published.

Comparator: Many technology organisations operate Staff Advisory Councils, Engineering Advisory Boards, or equivalent bodies. In the public sector, NHS England's clinical advisory structures provide clinician input to digital decisions. The principle is simple: the people who build and maintain the systems know more about their state than the people who manage the budgets. Their expertise should be formally captured, not informally suppressed.

These six reforms — independent whistleblowing protection, mandatory data publication, psychological safety measurement, blameless post-mortems, independent staff survey, and staff voice — would transform DHCW from an organisation where speaking up costs you your career into one where speaking up is expected, measured, and rewarded. Culture change is the hardest reform of all. But without it, no other reform will survive contact with the people who currently run the organisation.