The National Data Resource (NDR) Programme is a collaborative national programme to develop a new data architecture and enhances data analytics skills across Wales. Using Google Cloud technology, this data platform allows for better access to data for clinical, operational and research purposes.

The programme supports the creation of a single digital health and social care record, providing information to the right person at the right time. The NDR platform will ensure that health and social care data is stored safely and securely, reducing data management costs and improving collaboration. National and local teams will have access to reliable patient information and trends when needed, including at the point of care.

The NDR is our future data platform and part of our shift to cloud and open architecture. It will enable us to do more with data in a safe and secure way and deploy new technologies including artificial intelligence and advanced analytics.

Core elements of the platform include the Care Data Repository (CDR) and the National Data and Analytics Platform (NDAP). Enterprise API management is crucial for securely delivering an open architecture and interoperability, while a terminology service ensures consistent use of code systems and terminologies and distributes all-Wales administrative reference resources.

We are supporting health boards and trusts to use the NDR platform and services to integrate new functionality into their plans and align national and local roadmaps.

The completion of the Google Cloud platform's build was a significant step, laying the groundwork for the NDAP and CDR. The review of the terminology server infrastructure was completed, with ongoing alignment underway.

All milestones in this area were achieved, including:

Towards the end of the year, challenges emerged regarding programme funding for 2024-25, prompting a review of plans across all delivery partners (DHCW, health boards, trusts, Health Education and Improvement Wales, and Social Care Wales). Despite funding uncertainties, progress continues towards enhancing data sharing capabilities, laying a strong foundation for future advancements in healthcare delivery and data-driven decision-making in Wales.

We are creating an open digital architecture across Wales, using a data platform that shares information safely & securely. We work with NHS Wales colleagues and private sector partners to follow rules that protect patient data while supporting the aims of A Healthier Wales, through an API Management system.

We are building key parts of our architecture roadmap, such as the Care Data Repository, National Data & Analytics Platform and API Management.

This year we have expanded our architectural building blocks and Application Programming Interfaces (APIs) and developed our open architecture onboarding process. The National Data Resource (NDR) Programme has advanced its API management and open architecture capabilities, focusing on better patient care and access to information. We successfully implemented the Google Apigee API management product, enabling the hosting and management of API endpoints with enhanced logging and security features.

Creating a developer community within DHCW has encouraged API-first development, increasing the number of APIs available for modernisation and publication through Google Apigee. We delivered initial sets of APIs and engagement products, which improved access and contribution to the single patient record, benefitting patients and citizens across Wales. Collaboration with health boards and suppliers has shown the practical use of APIs, particularly in areas such as electronic Prescribing and Medicines Administration (ePMA).

Most of our product roadmaps remained on track for delivery, though we made adjustments due to changes in priorities and funding. In the fourth quarter, we made significant progress with the API roadmap, despite some delays due to limited resources. We enhanced engagement and ensured the smooth integration of diagnostic and document APIs for enhanced data sharing across health boards.

Looking ahead, the NDR Programme plans to continue growing and developing, with further improvements to API capabilities, more engagement initiatives, and better resource allocation to achieve strategic objectives. A Data and Integration Hub will be established in 2024-25.

We have developed a new Information Governance (IG) Framework to monitor and improve information governance understanding and responsibility in Wales. Without a framework, it becomes more difficult to make information available to services providing health and care.

The IG Framework includes the Wales Accord for Sharing Personal Information (WASPI), the National Intelligent Integrated Audit Solution (NIIAS), data protection advice to GPs, the Welsh Information Governance (IG) Toolkit and advising on data publication to ensure compliance with information governance standards. We develop and promote a National IG framework for Wales to enable safe and secure sharing of patient information.

The NIIAS project has achieved significant milestones, strengthening information governance and audit capabilities across the organisation, including improved auditing processes in relation to procurement approval. The launch of the third version of the IG Toolkit further solidified our information governance practices. The publication of the NIIAS Single Tender Agreement streamlined procurement procedures and drafting the Information Governance Strategy prioritised key initiatives for the planning cycle.

As the year progressed, we awarded contracts for critical tools and solutions, signalling continued progress in audit capabilities. Updates to the Service Level Agreement for the GP Data Protection Officer Service enhanced data protection measures. Key accomplishments included the publication of the WASPI Code of Conduct consultation report, the latest version of the IG Toolkit, and planned developments for standards adoption. We managed corporate risks associated with long-term funding effectively. Looking ahead, we will explore an API management layer for audit data extraction, which will further enhance procurement processes and affirm our commitment to information governance and audit capabilities.

The DHCW Information Governance team manages application of British Standard 10008 (BS10008): Evidential Weight and Legal Admissibility of Electronic Information. The standard currently covers our national data repositories, namely the Welsh Care Records Service (WCRS) and Welsh Results Reporting Service (WRRS). We initially achieved the standard in November 2019, with annual external surveillance audits in 2020, 2021. We were reaccredited in 2022 following a three-year cycle.

The most recent report concluded that the audit objectives have been achieved. The standard has recently been updated, so we reviewed DHCW’s accreditation against the updated standard. A standard surveillance audit was held in January 2024, with DHCW’s accreditation passing with no nonconformities or opportunities for improvement.

Cyber threats against the health sector are increasing rapidly, especially targeted ransomware attacks, which are highly damaging and disruptive. To protect the confidentiality, availability and integrity of critical health services, we continue to invest in preventing, detecting and responding to cyber incidents across NHS Wales. This year we invested £0.834m in cyber security.

Throughout the year, DHCW has modernised infrastructure and enhanced cyber security measures, including deploying a DNS-based security solution for outbound internet traffic. We made significant progress on our 3-year Cyber Security plan, including procuring Security Information and Event Management (SIEM) systems. The National SIEM has been acquired by DHCW for NHS Wales. We have onboarded all domain controllers and training is underway with all organisations.

The Data Centre Two Transition Project aims to move our infrastructure from the current data centre before the contract ends in 2024. The new data centre will support DHCW’s Decarbonisation Strategic Plan and enable us to adopt a cloud-first approach. We advanced cloud migration planning and business cases, successfully implementing a Cloud PC solution and starting cloud migration assessment scans.

At the start of the year, the new data centre hall was made available to us and we began installation work. Although we faced challenges with networking, we successfully migrated all services to the new data centre by the end of the year, with networking due to be completed early in the new financial year.