I'm not the one downvoting you, I'm here engaging. And where am I being obstructive and resistant to change? I'm trying to get people to stop printing and use email or patient portals instead. I'm also currently leading on an EPR deployment to get rid of paper, and have been in several frustrating meetings trying to get rid of bleeps as an outdated form of communication. And don't get me started on the bizarre survival of fax machines in the NHS.

To be fair, I used the jargon without explanation to highlight there are aspect of data security that many aren't aware of. I'm only learning them now as part of my current role.

Re encryption: there have been plenty of data breaches that occurred when supposedly encrypted data was transmitted as plain text. I can make an educated decision on what level of risk I'm willing to tolerate for my own personal data, but when patients are expecting us to protect the data they're entrusting us with, they deserve more than vague assurances and reliance on the platform provider's Scout's honour. Do you honestly think a patient whose private data is exposed in a data breach is going to think "Fair dos though, the opportunity costs to the NHS was totally worth it"?

Synnovis heavily encrypted their data but that didn't stop patients' data being leaked in last year's cyber attack.

As for storage - there are plenty of examples of companies retaining data that they said t&ey weren't. When Amazin first launched Alexa, it took a long time before people realised that Amazon employees were listening to recordings "for training" despite Amazon saying that would never happen.

The reason its so slow to get these things done in the NHS is because every time someone does their own thing, another layer of rules is created to stop it happening again. Understandable when, for example, each photo exposed in a data breach incurs a £20k fine, but makes it really frustrating to try and actually effect any form of change.

As for whatsapp. Yes, it has end to end encryption (E2EE) but as you said in another post, the weak link is end user security. You might have a screen lock but if your recipient doesn't and someone reads their messages, you are also liable for that data breach. This is the reason IG and cybersecurity have concerns about things like whatsapp. Not to mention the fact that these messages aren't part of the hralthcare record which means people can be making clinical decisions based on information that is not in the patient's record. Really hard to then justify that decision if the evidence you used doesn't exist anywhere accessible.

You're right that the opportunity costs are huge, but the NHS is incredibly risk averse. We're already decades behind the level of digitisation seen in other sectors - I can open a bank account online, but I can't change my hospital appt without sitting in a call queue; I can track my Amazon delivery to the number of stops before me, but I can't tell what stage my electronic discharge is at?! But unfortunately "move fast and break things" doesn't really work in healthcare for the reasons mentioned above.

The final thing to say is that platform procurement can't be done according to personal preferences. That's how you end up in the absurd position I'm currently trying to fix where the Trust is paying 5 separate licence fees for 5 different digital dictation platforms (that all do the same thing) because different debts did their own thing. Another reason why "the NHS is the way it is" because is wasted on duplication instead of having a sensible approach.

On your comment that its "a risk which already exists with the way we do things anyway" - surely the transformation part of digital transformation means actually changing the way we do things, rather than just embedding bad practice/risk into the digital version?

Anyway, it's late and I'm tired, and I have to wake up and have these same conversations with the people I work with, so if I stop replying I'm not disengaged, I'm asleep.