Whistleblowing for Health

The following paper records my experiences as one member of a group of British computing professors who played a role in an extraordinary episode (well, I hope it was extraordinary) in the history of information technology. When I sometimes feel gloomy about what I have achieved in life, I comfort myself with the thought that my small share in the NHS 23 saga must correspond to a quantity of public money saved rather than squandered that would cover my education plus forty years’ salary many times over.

Geoffrey Sampson

The University of South Africa

1 An ambitious project

This paper is a frankly anecdotal account of one of the largest-scale failures (perhaps the largest ever) in the history of software engineering. When something is the largest of its kind, describing it has to be somewhat anecdotal for lack of comparative data over which to generalize. Nevertheless, the following story is worth publishing, since it has important lessons for anyone hoping to harness the immense potential power of information technology for public benefit.

“Connecting for Health” (CfH) was the brand name for a project under the aegis of the British government which was intended to equip the National Health Service in England with a common computing infrastructure. (The project was formally known as the NHS National Programme for Information Technology (NPfIT); the name “Connecting for Health” was coined to designate a specific organization created after the beginning of the project and charged with delivering the programme, but in practice “Connecting for Health” became a snappy, media-friendly way of referring to the programme in general. Either name is used in material quoted below.)

The British National Health Service is by some reckonings the world’s fourth-largest employer (after the Chinese People’s Liberation Army, Walmart, and Indian Railways), so CfH inevitably had to be a project on a very large scale.[1] In fact, over the years from 2002 to 2011 that it was running, it was believed to be the world’s largest-ever non-military IT project. Quoting a total budget for a programme which evolved during its lifetime and ended without delivering its intended outcomes obviously involves considerable uncertainty, but published forecasts of total eventual cost tended to run to about £12 billion; in 2007 some publications gave a figure of £20 billion.[2] Even by the standards of public spending, these are huge sums, far too large to represent a reasonable gamble on something that might work out or might not. (For comparison, total UK tax revenue in the financial year 2007–08 was about £600 billion.)

CfH was intended to automate a large range of Health Service functions, ranging from the mundane, such as enabling members of the public to use an online system to book appointments with their GP (general practitioner, i.e. family doctor), to clinically-sensitive functions such as managing scans and other patient records. Hospitals and GP practices already had plenty of software systems achieving some of those functions, of course, but those systems had been developed piecemeal. Hospitals, or local hospital groups, are complex organizations with their own ways of working evolved over long periods (Barts, a leading London teaching hospital, was founded in AD 1123). Before the inauguration of the National Health Service in 1948 they were completely independent of one another, and the advent of the NHS amounted mainly to a new system for paying their bills rather than to any harmonization of working practices. Their IT systems had been bought in from various suppliers or developed in-house and tailored to the particular working methods of individual organizations. CfH was intended to enable medical systems throughout the country to intercommunicate electronically without hindrance. An often-cited advantage was that, in future, if someone happened to fall ill while far from home, the medics treating him would be able to summon up his records in seconds from the distant practice where he was registered.

2 Academic unease

I first became interested in CfH in 2005 as a professor of informatics in a British university (now emeritus), when one of my students, a GP in off-campus life, wrote an MSc dissertation about it. At that time the system was still some years off its planned implementation date, and it had received less media attention than it might, partly because NHS management had imposed strong secrecy requirements on the contractors who were developing various pieces of the overall system. But the intended functionality of the system had already been described to the medical profession in some detail. My student’s dissertation involved surveying opinions within his profession about what was promised. It emerged that there was widespread unease about the prospect. For instance, British GPs, and their patients, value confidentiality as an important feature of their relationship, and many survey respondents suspected that a system which enabled patient data to flow instantaneously throughout the Health Service as a whole could not fail to threaten confidentiality in practice.

Confidentiality is a medical issue, outside my own professional expertise. But it became clear that there was also considerable room for doubt whether the system produced would ever succeed in executing its intended functions: this was an informatics rather than medical issue. And it emerged that my doubts on that score were shared by many other computing academics.

Government has a bad record of bringing software projects to a successful conclusion. In the health field we remembered the London Ambulance Service disaster of October 1992: a new computer-assisted dispatching system had failed shortly after it was introduced, leading to severe delays in responding to emergencies and, according to media reports, up to thirty unnecessary deaths. That system was on a far smaller scale than CfH (its main software contract had cost £1.1 million, rather than billions). Big software systems are much harder to get right than small systems, and we saw CfH as potentially a London Ambulance Service disaster writ large. A culture of secrecy, such as already described, rings alarm bells to a computer scientist. Companies which studiously maintain commercial confidentiality about other aspects of their operations tend nowadays to realize that the best hope of getting value out of their investments in software is to be as open about their systems as possible. And there were already straws in the wind suggesting that all was not well with the execution of the CfH project.

Accordingly, a group comprising 23 British professors of computing, of whom I was one (we became known as the “NHS 23”) wrote an open letter to the Health Select Committee of the House of Commons (the lower house of the British Parliament), calling for a technical review of CfH before it proceeded further. (For readers wishing to study in detail our reasons for concern and the subsequent fate of CfH, the best place to start is the 489-page dossier compiled by Brian Randell, another NHS 23 member.)

I added my signature to the open letter believing that it was probably a futile gesture, but the right gesture. The response, when our letter was published on 12 April 2006, was astonishing. It received coverage on television and in newspapers ranging from the most serious to the most popular, and sparked lively discussion in numerous medical and computing magazines. And the tone of the comments, by people knowledgeable about the project but not themselves responsible for its success, was overwhelmingly supportive. Nobody seemed to be saying “Your worries are unnecessary, in reality it’s going fine”.

3 Some causes for concern

One problem was that the leader of the CfH programme and director general for NHS IT, Richard Granger, seemed unduly focused on sticks and carrots as a means of getting good work out of his suppliers. He boasted that, unlike earlier government IT contracts, those he had concluded for the CfH programme were designed to hold underperforming suppliers’ feet to the fire: in March 2006 he said that “any supplier struggling to deliver and who wanted to walk away would have to pay dearly for the ‘disruption’ caused. ‘If they would like to walk away, it’s starting at 50 per cent of the total contract value’ ”. But sticks and carrots, particularly sticks, are not effective as a means of achieving successful software. A few months later, in August 2006, Accenture (one of the main suppliers, with CfH contracts worth £2bn) did walk away: it announced that it was withdrawing from the programme, and Granger backed down. Rather than a billion, Accenture paid only relatively trivial compensation of £63 million. Presumably it was able to argue that its difficulties stemmed largely from unsatisfactory specifications, or interactions with other contractors, or the like; it is in the nature of software development that such excuses usually are available.

Over the sixty-plus-year history of computing, the profession has learned quite a lot about how to reduce the chances of failure in software development (though even for those who heed the lessons the risk remains high). For instance, one must never knowingly let minor flaws pass with the intention of sorting them out later, because the cost of curing defects rises by orders of magnitude, the later in the development process they are addressed.[3] The manager of a software project must take care to foster a culture in which people take the time to get things right first time. But the culture of CfH seemed to lay little emphasis on the lessons of software engineering. In 2007, when one leading member of a supplier company broke ranks to admit that the programme was in serious trouble (an episode to be discussed in section 4), the online medical-informatics newsletter E-Health Insider commented that his “public warning echoes concerns that key suppliers have repeatedly acknowledged … in private, about how intense pressure to deliver [is leading to] known problems being let through, a focus on targets and payments rather than quality”.

One issue where the profession has arguably not been as explicit as it should concerns the importance of involving users closely in the software development process. Every computer scientist is aware of horror stories about projects which failed because the software engineers’ understanding of the details of the work to be automated proved not to match the realities. As Al-Rawas and Easterbrook put it, “communication problems are a major factor in the delay and failure of software projects … This is especially true of ‘socio-technical’ software systems, which must exist in a complex organisational setting” – such as the British healthcare system. Surprisingly to my mind, standard software engineering textbooks lay little emphasis on the need for system developers to interact intensively with representative users (there have even been some who question the need, though see Hwang and Thorn, “The effect of user engagement …”[4]), but most professionals individually are well aware of the point. In the case of CfH, story after story coming in from the medics who were beginning to be told to use pieces of the new system implied that this kind of consultation was never adequately done. In some cases suppliers seemed to expect software that had already been implemented successfully in American hospitals to be usable with minimal adaptation in the institutionally very different British healthcare environment. One consultant physician responsible for IT within his hospital group reported on a CfH clinical-records system in an October 2006 e-mail:

As soon as the contract for NPfIT was awarded in our cluster, I was immediately in contact with the supplier, asking for systems analysts to come and spend weeks and months with me in the workplace, so that they could learn how clinicians work. … in the 18 months of the project only one supplier employee came on one ward round for one morning … A few months ago I had my first glimpse of the system and asked how it would work in outpatients? The supplier’s consultant asked in an American accent “What is outpatients?”[5]

The content of this story was worrying enough; what shocked me even more was that my correspondent, quite a senior medical professional, was anxious to make sure that his anonymity was preserved, apparently fearing damage to his career if his identity became known to his employers.

It is important to appreciate that the waste of huge quantities of public funds, while important, was not the most serious danger our group foresaw. Much more important is that we believed the introduction of CfH, which meant requiring hospitals and GP practices to abandon tried-and-true local software systems in favour of uniform new systems not of their choosing, would degrade aspects of health care. Even though only small components of CfH had gone live, this was already beginning to happen. We heard, for instance, about medical professionals finding CfH logging-on procedures so cumbersome that systems were left up and running in a workplace for colleagues to access, rather than each user having to log on with his individual password. This of course was strictly against the rules and destroyed confidentiality safeguards, but the alternative was for people to waste so much time wrestling with the computer that they had insufficient time for their clinical responsibilities.

Meanwhile, doctors were commenting that the ability to access medical records for someone taken ill when far from home, while an attractive public-relations point, was not really a very significant gain, especially if balanced against all the disruption CfH was causing. Apparently cases where this kind of communication is crucial are rarer than one might imagine, and when they do arise they can usually be sorted out by telephone.

4 An insider blows the gaff

We open-letter signatories expected CfH to fail on the basis of the information about it which was available to us as outsiders. But by 2007 it became clear that insiders constructing the system were themselves losing faith. In February of that year, Andrew Rollerson, a responsible representative of one of the main IT suppliers (Fujitsu, which had an £896m contract to deliver CfH systems for the Southern region) publicly acknowledged that the project was heading for collapse. At a conference on implementing CfH, Rollerson, who was Fujitsu’s “healthcare consultancy practice lead”, said among other things: “What we are trying to do is run an enormous programme with the techniques that we are absolutely familiar with for running small projects. And it isn’t working. And it isn’t going to work.”

I read about this in a front-page story in the Daily Telegraph newspaper. When the Telegraph checked its information with Fujitsu, Fujitsu had replied that Rollerson “was not directly involved in the NHS contract and was not a senior executive … the contents of his [presentation] slides ‘may have been ill-considered’ but [Fujitsu] insisted that his quotes had been taken out of context and that he supported the programme”.[6] The Telegraph believed Rollerson was a “top executive” (their phrase), and so did I: already in 2005 Fujitsu quoted his job title as “Head of Change Management”, which sounded like a senior executive to me. The Telegraph had got their story from a fuller write-up in the trade paper Computer Weekly, who had spoken to Fujitsu’s NHS account director, Ian Lamb. Lamb’s comment on Rollerson was “This is a significant misrepresentation of a presentation made in support of the National Programme. We refute any inference that has been drawn to the effect that Fujitsu in any way questions the success of the National Programme.” In other words, a man responsible for technology was saying “this isn’t going to work”, and a man responsible for company profitability was saying “he doesn’t mean that, of course it will work”. In a case like that, probably most third parties know who to believe.

It was in response to Rollerson’s remarks that E-Health Insider discussed the CfH culture of ignoring known problems, as quoted in section 3. According to the newsletter, some in the industry saw Rollerson’s comments as a “welcome breath of fresh air, providing a necessary and honest account of the state of the NPfIT programme.” It must have been brave of Rollerson to speak out as he did. In March 2007 it was reported that Fujitsu had suspended him in advance of possible disciplinary action.

5 Credibility crumbles

The NHS, and the government, continued to insist publicly that all was well. But the embattled attitudes of the supporters of CfH were reflected in an extraordinary way during a House of Commons debate about it in June 2007, when Andrew Miller MP referred to a Letter to the Editor I had written to the Daily Telegraph, printed on 24 April that year. I began working with computers in the mid-1960s, and for most of the time since then the educated public in general seemed to see these machines as totally mysterious black boxes. But about the turn of the century there was a sudden turn-around: most people now owned a computer (though they often used it for nothing more than e-mail, web browsing, and perhaps games), and they believed this made them experts on the machines’ potential – rather as if someone who took to eating out saw himself as thereby qualified to pronounce on running the kitchen of a large restaurant. In practice, laymen had taken to grossly overestimating what computers can be made to do. My letter noted that a computing professor’s job used to be to develop the potential of the technology, but nowadays to a significant extent it consisted of cooling laymen’s over-optimism about that technology. I cited CfH as an example.

For Miller, speaking in Parliament,[7] it seemed that the fact that I had written to the Daily Telegraph, which is a right-leaning newspaper (it is also by far the most widely-read serious British daily), somehow demonstrated that the scepticism of our 23-man group was a Conservative party-political conspiracy against an initiative of the Labour government. Furthermore, Miller knew that I happen to hold unfashionable views (I make no secret of them) about racial differences and race relations; he tried to use this as a way of blackening our NHS 23 group as a bunch of ill-intentioned troublemakers. One might wonder how my racial politics could possibly be relevant to an action I took in my role as a professor of computing – or could undercut the force of a position being advocated by 22 other senior academics whose politics are, I imagine, highly diverse. (I have never discussed politics with them.) However, around this period it seemed to become routine for the British government to deal with all sorts of academic findings that it found awkward by the crude technique of vilifying the researchers responsible for the findings.

Ironically in view of the Rollerson episode, in May 2008 Fujitsu, at that point one of three remaining main CfH suppliers, itself withdrew unilaterally from the programme (at considerable cost in penalties, I believe), as Accenture had done earlier. Fujitsu was quoted as abandoning negotiations with the NHS “as it did not feel there was any prospect of an acceptable conclusion”. (I do not know what became of Andrew Rollerson.)

One can easily understand Fujitsu’s earlier wish to insist that the programme was proceeding satisfactorily. Harder to explain, perhaps, was what felt like naive optimism on the part of the CfH chief executive Richard Granger (reputedly Britain’s highest-paid civil servant at the time), who had continued to assure sceptics that all was well right up until he announced his resignation from the NHS in order to return to the private sector, which became effective in February 2008. But a fascinating sidelight on this had emerged in November 2006. Granger’s mother, with whom he was reportedly on bad terms, announced that she “can’t believe that my son is running the IT modernization programme for the whole of the NHS”, pointing out that he had failed his computer studies degree as an undergraduate at Bristol University. (After his mother appealed to the University Visitor on his behalf for him to be allowed to re-sit, he managed to gain a mediocre degree in geology.) While amusing, this was also quite depressing. Computing teachers endeavour to instil in their students lessons which the profession has learned the hard way over the years about what works, in software development, and what does not. I would not wish to suggest that anyone allowed to manage a software project must be a computing graduate, but one might feel that trying to gain such a degree and failing ought to ring alarm bells. Perhaps, if Granger had been a more successful student at Bristol, fewer billions would have been squandered on a project which any competent computing teacher should have been able to predict as a failure.

6 The project abandoned

By 2008 or 2009 it seemed that everyone in public life other than the government and the Health Service leadership was coming to realize that CfH had no prospect of success. The opposition Conservative Party commissioned an independent review of the project by a group led by Glyn Hayes, previously chairman of the British Computer Society’s Health Informatics Forum and president of the UK Council for Health Informatics Professionals (and a GP for 25 years of his earlier career). Their 186-page report, published in August 2009, in summary confirmed what we were saying in 2006: a top-down, centralized system could not hope to achieve the aims set for NHS IT. Interviewed by the BBC, Hayes said “The review makes clear that NHS IT will only succeed in improving patient care if information is held locally and centred on the patient”.

A spokesman for the health ministry dismissed the Hayes Review – in advance, before it was published. As late as early 2010, the Labour government was still preserving the fiction that CfH remained a live enterprise, trying to keep the remaining software suppliers on board by tactics such as eliminating demanding points from the specifications they were contractually committed to meet. At that point the government was facing an election, and knew that public admission that the project had been a colossal mistake would be a vote-loser. But intelligent observers were no longer taken in. On 21 March 2010 the left-leaning (therefore Labour-friendly) Guardian newspaper wrote:

The government’s ailing £12.7bn IT programme to overhaul paper-based NHS patient records in England is close to imploding, potentially triggering a deluge of legal claims against the taxpayer running into billions of pounds … the Department of Health … is locked in frantic contract renegotiations with contractors to keep the project alive … As the National Programme moves into its seventh year, the Department of Health and regional contractors are trying to thrash out a back-room compromise over how to apportion the bill for an army of IT workers who have failed to deliver … The government has offered to slash the functionality requirements …

The election in May 2010 led to a change of governing party, and in September the new Conservative/Liberal-Democrat coalition announced the end of NPfIT: “a centralised, national approach is no longer required”. In future, hospitals would be free to develop the IT they already have, and to source new systems from wherever they think best (as we were urging five years earlier). The new government convened a meeting of leading IT suppliers to tell them that “The days of the mega IT contracts are over, we will need you to rethink the way you approach projects, making them smaller, off the shelf and open source where possible”; and it put in place a mechanism designed to ensure that large-scale government projects in future should not be able to run out of control in the same way. (How well that will work remains to be seen, of course.)

Some of our new leaders denounced the failed project in strong language. Simon Burns, Conservative Health Minister in the incoming government, called it an “expensive farce”. That was easy for a Conservative to say, of course: governments are expected to rubbish the work of their political opponents. But even Margaret Hodge, who had been a member of Tony Blair’s Labour government which inaugurated CfH (and was now chairwoman of the Parliamentary Accounts Committee) publicly acknowledged in August 2011 that:

The Department of Health is not going to achieve … a fully integrated care records system across the NHS. Trying to create a one-size-fits-all system in the NHS was a massive risk and has proven to be unworkable. The Department has been unable to demonstrate what benefits have been delivered from the £2.7 billion spent on the project so far …

Contractual commitments meant that quite a lot more than £2.7bn would have to continue to be spent. (One argument that had been used against giving up on CfH was that this would fail to save money in view of contracts already entered into – though a careful analysis refuted this.) In effect, though, Connecting for Health had been laid to rest.

7 Lessons to be learned

This episode, as I see it, has at least two lessons to teach. One concerns the role of the academic profession. Our profession has severely diminished in status in recent decades. During my career I have seen a change from a situation in which universities were “owned” by their academic staff to one where, now, effective ownership lies in the hands of managers who often have very little understanding of or interest in academic values. (The change has taken place everywhere – it is well documented for the USA by Benjamin Ginsberg.[8] I believe that similar changes have been happening to the medical profession – see e.g. a column by Theodore Dalrymple – though there I cannot comment from personal knowledge.) It would be easy to believe that society no longer sets any value on the special expertise of academics, and in this case it seemed that the British government did not. But the same was not true for society in general. Although our open letter included few points that had not already been raised by other individuals and organizations over many previous months, suddenly when these things were said by 23 “academic heavyweights” (as one newspaper called us), the country sat up and listened. Our open letter seemed to be needed in order to crystallize a widespread sense of unease, and others who criticized the programme in following years frequently referred back to our letter as a precedent for their criticism. It appeared that the public continues to recognize that professional expertise has a value, even if politicians nowadays seem to see the traditional professions as little more than conspiracies in restraint of trade.

But above all, the Connecting for Health débâcle teaches us about limits to what can be achieved by political authority. Every English schoolchild learns about the 11th-century king Canute, who gave his courtiers a lesson about this by having his throne installed on the beach at low tide and solemnly commanding the sea not to rise; of course they then watched him get his feet wet. A millennium later, our politicians still seem to need that lesson.

Perhaps the problem is specially acute with information technology. If a group of civil-engineering professors had warned that some projected bridge was likely to fail, I am not sure it would have taken so long for the warning to be heeded. With an IT project, unlike with an ill-designed bridge, no physical limitations rule out success. Conceivably, there might be some possible suite of program code which would achieve everything that CfH was supposed to do and nothing it was not supposed to do, if it could be identified (one cannot know, because it is only by implementing a successful large-scale software system that one fully discovers what all the requirements are and whether they are entirely compatible with one another). But, change one letter or dot anywhere within those millions of code lines, and the result would probably be software that was useless or worse than useless. The solution-space of distinct suites of code within which programmers have to search for a satisfactory solution, not knowing for sure that it exists, is so more-than-astronomical in size that the prospect of finding that solution, starting from scratch, is a statistical rather than physical impossibility.

In practice, when large-scale software systems succeed, they are commonly developed on the back of earlier, smaller systems which have already proved their worth, so that at any stage only a limited amount of new or revised code has to be written to integrate the older systems into a larger whole. Software development proceeds by evolution, not revolution. If the revolutionaries of 1789 wanted to sweep away the Ancien Régime system of French regional government and establish an entirely novel structure based on 90 newly-invented départements, nothing stopped them doing this. But you just cannot do that sort of thing with information technology.

Government and computing are bound to mix badly, because the two domains are founded on contrary assumptions. In the government world, it is a given that sufficient authority will elicit any desired action. In the world of informatics, authority is impotent. Bring as much pressure as you like to bear on a flawed software system, and what you will get is a worse-flawed system. We have known not just that that is so, but why it is so, ever since Fred Brooks’s Mythical Man-Month[9] of 1975. (It is, among other things, one of the reasons why academic computer scientists insist that students must learn to program. Many of them will go into jobs where they never write a line of code; but anyone working in the IT industry needs a feeling for the intractable nature of the industry’s basic resource, and only personal experience can create that awareness.)

If governments hope to make IT serve their purposes, as since the turn of the century they have increasingly been aiming to do, then they have got to learn to defer to information-technology realities. Human beings bend to government will. Software development cannot be given orders.