NHS organisations should treat collaboration as an operating model, not just a procurement choice. Shared planning, joint governance, and common platforms can reduce duplicated effort, lower delivery risk, and make it easier for staff to work across organisational boundaries. The key is to align local priorities with a regional or national delivery roadmap so transformation improves frontline care rather than adding another top-down mandate.
Why NHS digital transformation works better when autonomy is bounded by shared operating rules
Local autonomy is useful when it lets trusts adapt delivery to service pressures, legacy estates, and workforce needs. It becomes harmful when it creates incompatible processes, duplicate platforms, or separate governance paths that slow down interoperability. The balance is not between “local” and “central” in the abstract, but between decisions that must vary by place and decisions that must be standardised to scale safely.
The practical test is whether a local choice affects cross-organisational workflows, data sharing, security, reporting, or clinical consistency. If it does, the choice usually needs a common standard, even if the implementation detail remains local. That is how NHS organisations preserve flexibility without fragmenting the programme into parallel versions of the same transformation.
This is why collaboration should be treated as part of delivery design, not as a late-stage coordination activity. Shared patterns for architecture, identity, data governance, and change control reduce rework and help each organisation move faster because fewer foundational decisions are being renegotiated repeatedly.
Where local discretion should remain, and where standardisation matters
Local discretion is most defensible where the change is close to frontline workflow, service configuration, staffing model, or local operational sequencing. Those decisions often need to reflect different clinical pathways, supplier constraints, and maturity levels. Forcing uniformity there can create resistance and increase the risk that teams work around the programme rather than with it.
Standardisation is more important where the programme depends on shared infrastructure, common data definitions, common reporting, or consistent access rules. If every organisation handles those foundations differently, the system pays for it through integration effort, duplicated assurance, and harder recovery when something fails. Common foundations are what make local variation sustainable.
A useful approach is to separate the “what” from the “how”. The “what” should be agreed across the system, such as the service outcome, the data that must be exchangeable, and the assurance threshold. The “how” can then be adapted locally, provided it still fits the shared architecture and governance model.
That separation also helps prevent collaboration from becoming a lowest-common-denominator compromise. A shared roadmap should not erase local priorities; it should define the non-negotiables that keep the whole programme coherent while leaving room for place-based execution.
How to organise governance so collaboration does not become bureaucracy
Joint governance works best when it is decision-oriented rather than report-oriented. NHS programmes often slow down when they create additional meetings without clarifying who can decide, what can be delegated, and which issues need escalation to the system level. Good governance should make it easier to resolve dependencies, not harder to ship change.
One practical pattern is to give local teams ownership of delivery detail while reserving system-level control for shared architecture, interoperability, information governance, security baseline, and programme milestones. That reduces churn because the rules are clear in advance. It also makes it easier to compare progress across organisations without forcing identical delivery methods.
Collaboration also works better when the shared operating model includes a visible dependency map. If a change in one organisation affects others through data flows, user journeys, or support processes, those dependencies need to be explicit early. Otherwise the programme appears locally efficient but systemically fragile.
For NHS organisations, the best governance question is not “who is in charge?” but “which decisions must be made once for the whole system, and which decisions should stay close to the point of care?” That question keeps collaboration grounded in operational reality rather than abstract alignment.
Risk and Threat Considerations
When autonomy is too unconstrained, the main risk is fragmentation: incompatible platforms, duplicated controls, inconsistent data definitions, and uneven service resilience. When collaboration is too rigid, the risk is local workarounds, weak adoption, and programmes that look coherent centrally but fail operationally in individual organisations.
Failure mechanism: A system-wide programme breaks down when local exceptions accumulate faster than shared standards are agreed, or when central rules are applied to problems that actually require place-based adaptation. The result is often delayed delivery, integration debt, and avoidable operational risk across organisational boundaries.
Impact: The organisation can end up with higher support costs, poorer interoperability, slower change, and weaker frontline benefit. In the NHS context, that can also mean more variation in user experience and a harder path to safe scaling of new digital services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organisational Context | NHS transformation depends on aligning local delivery to system context and priorities. |
| GV.RM-01 — Risk Management Strategy | Balancing autonomy and collaboration is a risk decision about consistency, interoperability, and delivery exposure. | |
| GV.SC-01 — Cybersecurity Supply Chain Risk Management Strategy | Shared platforms and joint delivery create dependency and coordination risk across organisations. | |
| Recommendation — Define the system context and delivery boundaries before delegating local implementation choices. Set a shared risk strategy for exceptions, dependencies, and cross-organisation change. Define shared control expectations for common platforms and interdependent suppliers. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Shared digital services need consistent access rules when users work across organisational boundaries. |
| A.5.23 — Information security for use of cloud services | Common platforms in transformation programmes need agreed governance for shared service delivery. | |
| Recommendation — Standardise access rules for shared services and document local exceptions. Apply common security requirements to shared cloud services across participating organisations. | ||
Practitioner Guidance
What to prioritise: Set the common rules first for architecture, data, security, and assurance, then allow local teams to choose the implementation path within those boundaries. If the programme has not defined those boundaries, autonomy will usually turn into inconsistency rather than innovation.
What to verify: Check whether each local decision can be justified without breaking shared reporting, interoperability, or supportability. If the answer is no, it is probably a system decision, not a local preference.
Practitioner takeaway: The right balance is achieved when local teams can adapt delivery without changing the system-wide contract, because that is what preserves both pace and coherence.
Related resources from NHI Mgmt Group
- How do organisations balance collaboration and accountability in certificate compliance programmes?
- How should healthcare organisations balance secure access with clinician productivity in digital identity programmes?
- How should organisations adapt cybersecurity programmes when digital transformation accelerates across remote work and online services?
- Why do collaboration tools create such a large secrets risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
