Topic 1.2 — Digital Strategy & Roadmapping

A digital strategy is a small set of deliberate, defensible choices about where you will invest scarce capacity to improve care — and a roadmap is how you sequence those choices under uncertainty, so that direction survives contact with reality instead of gathering dust as shelfware.

Why this matters in health and care#

In most sectors a weak digital strategy costs money and momentum. In health and care it also costs safety, equity, and public trust. When there is no shared direction, every trust, place, and team optimizes locally: one buys a booking tool, another builds a portal, a third digitizes a paper form. The estate fragments, data cannot flow across an integrated care system, clinicians juggle a dozen logins, and patients fall through the gaps between systems that were never designed to talk to each other. A strategy is how you convert scattered activity into coherent direction that a board, a clinician, and a citizen can all recognize.

The domain makes this harder in three specific ways. First, you are spending public money under intense scrutiny, so your choices must be explicit and defensible, not merely plausible. Second, you inherit a deep, safety-critical legacy system estate that cannot simply be switched off — strategy here is as much about what you keep running safely as about what you build next. Third, the constraint is rarely ambition and almost always capacity: clinical time, engineering capacity, information-governance headroom, and change tolerance in the workforce. A strategy that pretends everything is a priority quietly prioritizes nothing, and in a health setting that means the safety-critical and the equity-critical get starved alongside the merely interesting.

The uncomfortable truth is that most digital strategies fail not at the whiteboard but in the gap between the deck and the delivery. A beautifully argued vision that no team can act on next Monday is worse than no strategy at all, because it consumes credibility. This topic treats strategy as a live instrument of direction, tightly coupled to your operating model and your portfolio, rather than a document you refresh once a year and file.

Core concepts#

Digital strategy versus organizational and clinical strategy. A digital or technology strategy is not a separate thing that sits alongside the organization's clinical and corporate strategy — it is strategic planning applied to how digital, data, and technology will help deliver the organization's actual goals. The test is simple: every material line in your digital strategy should trace to a clinical, operational, or population-health outcome the organization already cares about. If it traces only to a technology aspiration ("move to cloud", "adopt AI"), it is an activity, not a strategy.

Vision and target state. A vision statement describes the idealized future you are working towards — what care feels like for a patient, a carer, and a clinician when the strategy has landed. The target state (or target architecture) is the more concrete, testable description of the estate, capabilities, and data flows that vision implies. Vision inspires; target state lets you measure the gap. You need both, and you need them written in language a clinician recognizes, not only in language an architect recognizes.

Digital maturity assessment. A maturity model gives you an honest, repeatable read on where you are today across dimensions such as infrastructure, workforce capability, safe practice, and citizen empowerment. Maturity assessment matters because strategy is a vector: it needs a starting point as much as a destination. In the NHS, the What Good Looks Like framework (below) is the most widely used shared reference for this.

What Good Looks Like (WGLL). Published by NHS England's Transformation Directorate (originally NHSX) in 2021, WGLL sets out seven success measures for digital transformation across health and care: Well Led, Ensure Smart Foundations, Safe Practice, Support People, Empower Citizens, Improve Care, and Healthy Populations. It is a shared vocabulary and self-assessment framework, not a mandate or a maturity score you are ranked against — its value is giving boards and integrated care systems a common definition of "good" so that local strategies point in a compatible direction. Use it to structure your maturity assessment and to sense-check the breadth of your strategy, but treat it as a lens, not a checklist to game.

Who Pays for What. Published alongside WGLL, Who Pays for What describes the funding context: over time, moving away from national teams centrally funding frontline technology and instead allocating digital funding directly to integrated care systems — initially weighted towards "levelling up" less digitally mature systems, then moving towards a fair-shares basis. Accurately understood, it is a direction of travel for where digital money is decided, not a fixed formula, and the balance of central versus local funding has continued to evolve. Its practical implication for your strategy is that you increasingly make and defend your own investment choices locally, which raises the bar on having a defensible strategy in the first place.

Roadmap and sequencing. A technology roadmap turns strategy into time-phased intent. The most durable format in fast-moving contexts is now / next / later: what is in delivery now, what is committed next, and what is a direction for later — with confidence and detail deliberately decreasing as you look further out. This is honest about uncertainty in a way that a fully-dated three-year Gantt chart never is.

Gap analysis and strategic choices. Gap analysis is the disciplined comparison of current maturity against target state; the gaps become your candidate investments. Strategy is then the act of choosing among them — including the strategic build/buy/partner posture for each major capability, and the equally strategic choice of what to stop or decommission. A Wardley map — plotting capabilities in a value chain against how commoditized they are — is a useful tool here: it helps you see which capabilities are genuinely differentiating (worth building) and which are utilities (worth buying), so build/buy is a reasoned position rather than a habit.

Strategy, operating model, and portfolio. Strategy sets direction; the operating model (see Topic 1.1 — The Operating Model) is the machine that delivers it; the portfolio is where money and capacity are actually committed (see Topic 5.3 — EPPM). A strategy that is not wired into portfolio decisions and enterprise architecture has no hands. This wiring is what separates digital transformation that changes care from digital transformation that changes only slide decks.

Best practices#

1. Anchor every strategic aim to a clinical, operational, or population outcome. Start from the outcomes the organization already owns — reduce did-not-attends, cut avoidable admissions, close an inequity in access — and derive digital aims from them. Express the aims as measurable objectives (see Topic 10.0 — OKRs & KPIs) so progress is visible. An aim that cannot name the outcome it serves is a candidate for the cutting-room floor.

2. Assess maturity honestly before you set direction. Run a structured maturity assessment using WGLL's seven measures as your frame, and involve clinicians, operational leaders, and information-governance colleagues, not only the digital team. The point is not the score; it is the shared, evidenced picture of where you genuinely stand, which prevents a strategy built on flattering assumptions. Repeat it annually so you can see the vector, not just the position.

3. Write a target state clinicians and citizens can recognize. Describe the future in terms of what changes for the people using and delivering care, then translate that into the target architecture and capabilities. If your target state reads only as a technology diagram, it will not survive a board conversation or earn clinical buy-in. Pair the inspirational vision with a concrete, testable target so the gap is measurable.

4. Sequence with now / next / later, and decrease certainty with distance. Commit in detail to what is in delivery now, hold "next" as a firm but adjustable queue, and keep "later" as direction rather than dates. This format tells the honest truth that the future is less certain than the present, and it lets you re-sequence as evidence arrives without every change looking like a failure to plan. Resist pressure to fully date the whole multi-year horizon; false precision is the enemy of credibility.

5. Make build / buy / partner an explicit strategic posture, capability by capability. For each major capability, decide deliberately whether it is differentiating (build), a commodity (buy), or best delivered with others (partner) — a Wardley map or simple value-chain view makes this defensible rather than habitual. Buy commodities and open-standard platforms; reserve scarce engineering for what genuinely differentiates care in your context. Require open standards and exit rights so a buy decision today does not become lock-in tomorrow (see Topic 4.0 — Technical Architecture, Cloud & Legacy).

6. Wire the strategy into the portfolio and spend control. A strategy only bites when it governs where money and capacity go, so connect it directly to portfolio prioritization and staged funding (see Topic 5.3 — EPPM). Every significant investment should be traceable to a strategic aim, and proposals that trace to nothing should be visibly harder to fund. This is the single most effective defence against strategy-as-shelfware.

7. Prioritize ruthlessly on a constrained estate, and decide what to stop. Capacity, not ambition, is your binding constraint, so an honest strategy names what you will not do and what you will decommission. Protect capacity for running safety-critical systems and for reducing the legacy and technical-debt burden, not only for shiny new builds. A strategy that only adds, never subtracts, will collapse under its own weight.

8. Treat the strategy as a living instrument on a review cadence. Set direction firmly, then review it against evidence on a regular rhythm — quarterly for the roadmap, annually for the strategy itself — rather than treating it as fixed for three years. Base changes on evidence (see Topic 1.3 — Evidence-Driven Decisions), and communicate re-sequencing as learning, not failure. Direction under uncertainty means holding the destination steady while adjusting the route.

Questions to discuss with your team#

1. Can we trace every major line of our strategy to an outcome a clinician or citizen would recognize — and where can't we? This question tests the topic's central discipline: that a digital strategy is organizational strategy expressed through technology, not a parallel technology wish-list. It matters in health and care because public money and clinical attention are scarce, and anything that cannot name the care outcome it serves is competing for that scarcity on weak grounds. The honest work is to take your current strategy line by line and ask, for each, "which outcome does this move, and how would we know?" — and to sit with the discomfort when several lines trace only to a technology aspiration like "adopt cloud" or "use AI". Those orphaned lines are not necessarily wrong, but they need either a real outcome attached or a demotion. Watch for the subtler failure too: aims that trace to an outcome on paper but that no one is actually measuring. A good discussion ends with a shorter, clearer strategy in which the survivors each have an owner and a measure.

2. Where are we being dishonest about our current maturity, and what would an outsider using WGLL see that we don't? Strategy is a vector, so a flattering read of the starting point quietly corrupts everything downstream, and teams have every incentive to overstate maturity to leadership and to national bodies. This question invites the team to name the areas — often smart foundations, safe practice, or genuine citizen empowerment — where the gap between the narrative and the reality is widest. It matters because building an ambitious "improve care" or "healthy populations" strategy on shaky foundations is how you end up with clinical-safety incidents and stalled delivery. Ground the conversation in evidence: incident logs, infrastructure age, adoption data, and inequity in who actually uses your digital services. Bring in voices from outside the digital team, because clinicians and operational leaders often see the foundations differently from the people who built them. An honest answer identifies two or three areas where the strategy must first shore up the foundations before it can chase the more exciting aims.

3. What are we choosing not to do, and what are we willing to stop or decommission to make room? The topic argues that capacity, not ambition, is the binding constraint, so a strategy that only adds is not really a strategy at all. This question forces the trade-off into the open: with finite clinical, engineering, and change capacity, every "yes" is a "no" to something else, and pretending otherwise means the safety-critical and equity-critical work gets silently starved by whatever is loudest. It is politically hard, because stopping a project or decommissioning a beloved legacy system has named owners and real feelings attached, whereas starting things wins applause. Make it concrete by listing what would have to be dropped or delayed to fund your top three aims, and by naming at least one system you will actively retire. Discuss how you will protect capacity for running safety-critical services and paying down technical debt, not just for new builds. A mature answer treats "what we will stop" as a first-class part of the strategy, published alongside "what we will start", rather than an awkward footnote.

4. For each major capability, have we made a deliberate build / buy / partner choice — and are we sure today's "buy" will not become tomorrow's lock-in? This question probes the posture the topic treats as strategic rather than technical: deciding, capability by capability, what is differentiating enough to build, what is a commodity to buy, and what is best delivered with others. It matters acutely in health and care because scarce engineering capacity spent re-building a commodity is capacity stolen from the work that genuinely improves care, while an unconsidered purchase can trap safety-critical data behind a proprietary format your successors cannot escape. The honest work is to lay out your major capabilities — the shared record, interoperability, identity, analytics — and name the posture and the reasoning for each, ideally against a value-chain or Wardley view so the choice is defensible rather than habitual. Interrogate every "buy" for exit rights, open standards, and data portability, because lock-in in this sector is measured in decades and paid for in clinician workarounds. Watch for the two symmetrical failures: building by default because the team enjoys it, and buying by default because procurement is easier. A good answer leaves you able to explain, to a board and to a future buyer, why each capability sits where it does.

5. How will we hold direction steady while re-sequencing the roadmap as evidence arrives — and can we do that without every change looking like failure? The topic insists that certainty should decrease with distance and that now / next / later is more honest than a fully-dated multi-year plan, but living that discipline is culturally hard when boards and funders reward the appearance of a fixed plan. This question surfaces the real tension between the credibility that comes from commitment and the credibility that comes from adapting to what you learn. It matters in health and care because the ground genuinely shifts — national policy, funding allocations, clinical priorities and safety incidents all move faster than a three-year Gantt chart can absorb. Discuss the concrete mechanics: what review cadence you hold for the roadmap versus the strategy, what evidence would trigger a re-sequence, and how you will communicate changes as learning rather than as a plan that failed. Name the "later" items you are deliberately refusing to date, and be honest about the pressure to over-commit to keep a stakeholder happy. An honest answer describes a strategy that holds its destination firm while treating the route as revisable, and a team that has rehearsed how it will explain a change of route without losing trust.

6. Does our strategy actively close the digital-access gap, or does it quietly widen it for the people with the greatest need? The topic warns that in health and care a weak strategy costs equity and public trust, not only money, and that the people least likely to use digital services are often those with the greatest clinical need. This question asks whether "empower citizens" is a genuine aim with a measure attached or a slogan that assumes a confident, connected, digitally literate patient. It matters because every channel you digitize can improve access for the many while silently removing it for the few — the housebound, the digitally excluded, those without data, language, or trust — and a strategy that averages these together will look successful while care becomes less fair. Ground the discussion in who actually uses your services today, segmented by deprivation, age, language and disability, and in what non-digital or assisted routes you are committing to preserve. Discuss the trade-off between the efficiency case for "digital by default" and the equity duty to leave no one behind, and who at the board owns that tension. A good answer names inclusion as an explicit strategic aim with its own measure, not a caveat buried in the delivery detail.

In practice: a health & care example#

An integrated care system covering four places has no shared digital strategy. Each trust invests independently: one has a modern electronic patient record, another runs on ageing systems held together by heroics, and a community provider still faxes referrals. A citizen moving between services re-tells their story every time, and the ICS board cannot answer a simple question from its region: are we spending digital money where it improves care the most?

The new chief digital information officer resists the urge to write a grand three-year plan. Instead, over eight weeks, the team runs a maturity assessment structured around the seven What Good Looks Like measures, involving clinicians and operational leaders in every place. The assessment is deliberately unflattering: smart foundations are weak in two providers, safe practice varies, and "empower citizens" scores low because the people least likely to use digital services are also those with the greatest need. The board sees, for the first time, an evidenced picture rather than four separate optimistic narratives.

From the gap analysis, the team frames three strategic aims, each tied to an outcome the board already owns: stabilize safety-critical foundations, give clinicians one shared view of the patient across places, and close the digital-access gap for underserved groups. They set these on a now / next / later roadmap. Now: shore up the weakest infrastructure and stand up a shared interoperability layer. Next: a single sign-on and a shared record view. Later: population-health analytics — held as direction, not dated. For each major capability they take an explicit build/buy/partner posture: buy the commodity infrastructure, partner on interoperability using open standards, and reserve their small engineering capacity for the access-equity work that genuinely differentiates their population's needs.

Crucially, the strategy is wired into the portfolio. The ICS agrees that funding — now allocated to the system rather than bid for centrally, in the spirit of Who Pays for What — follows the three aims, and that proposals tracing to none of them face a higher bar. Two well-liked but orphaned projects are paused, and one legacy system is put on a decommissioning path. A year on, the roadmap has been re-sequenced twice as evidence arrived, and each change was communicated as learning rather than failure. The strategy is eight pages, lives on the intranet, and is quoted in funding decisions — the opposite of shelfware.

Sector lenses#

Startup#

For a digital-health startup, the strategy is mostly the founder's thesis about which clinical problem to solve and for whom, and the roadmap is short, concrete, and cash-constrained. Now / next / later is natural here because runway forbids long-dated plans, and the binding constraint is survival, not a sprawling estate. The strategic traps are different but real: over-building bespoke technology that should have been bought, and choosing a proprietary data store that creates lock-in your future NHS buyers will reject. A startup should still write down its build/buy posture and commit early to open standards, because that discipline is what makes it acquirable and interoperable later. Maturity frameworks like WGLL matter less internally but become a checklist your NHS customers will hold you to.

Small business#

For an established small provider — a GP practice, a community pharmacy, a care home or domiciliary-care provider, a single-site clinic, or a small health-tech supplier past the startup stage — the strategy is rarely a document and more often a handful of pragmatic choices made by an owner-manager with no dedicated IT function. The binding constraint is neither runway nor a sprawling estate but thin capacity: real patients and duties to meet, tight cash, and no one whose job is digital. Here now / next / later should be radically short and buy-by-default is usually correct, because scarce attention is better spent choosing interoperable, well-supported products than building anything. The strategic discipline that pays off is insisting on open standards and data portability when signing up to a supplier or a shared care record, so the practice is not trapped when a contract or framework changes. WGLL is less a self-assessment tool than a description of the connected system this organization must plug into, and the honest aim is to meet the same information-governance and safety duties as a large trust with a fraction of the resource.

Enterprise#

An NHS trust or an integrated care system is where this topic's tensions are sharpest: a deep legacy estate, safety-critical run obligations, sovereign organizations that must feel like one service to a patient, and public scrutiny of every choice. Here the strategy's hardest work is prioritization on a genuinely constrained estate and the politics of deciding what to stop or decommission across organizational boundaries. Maturity assessment via WGLL and wiring the strategy into portfolio and spend control (Topic 5.3 — EPPM) are the mechanisms that make direction real at scale. A large private health or life-sciences enterprise has more capital but faces the mirror risk — an over-engineered strategy and target architecture that outruns the organization's ability to absorb change. In both cases, the operating model, not the technology, is usually what determines whether the strategy lands.

Government#

A national body such as NHS England or a devolved health department sets strategy that other organizations must inhabit, so its choices — WGLL, Who Pays for What, mandated standards — are effectively the national frame within which every local strategy is written. The discipline is to set direction and shared definitions of "good" without over-specifying local solutions, because a national strategy that mandates one implementation for every context becomes a remote bottleneck. Funding policy is a strategic lever at this level: moving money to integrated care systems shifts where investment is decided and raises the expectation that local strategies be defensible. Accountability to Parliament means the strategy and its trade-offs are matters of public record, so honesty about what is not being funded, and why, is not optional but expected.

Common failure modes#

• Strategy as shelfware. A polished document that no team can act on next Monday and that never enters a funding decision. Antidote: wire it into the portfolio and quote it in spend control.
• Technology aspiration masquerading as strategy. Aims that trace to "adopt cloud/AI" rather than to a care outcome. Antidote: require an outcome and a measure for every aim.
• The fully-dated three-year plan. False precision that treats an uncertain future as fixed and makes every re-plan look like failure. Antidote: now / next / later with decreasing certainty.
• Flattering maturity assessment. Overstating the starting point so the strategy is built on sand. Antidote: evidence-based assessment with clinical and operational voices, repeated annually.
• The everything-is-a-priority strategy. Refusing to name what you will not do, so scarce capacity is silently starved. Antidote: publish "what we will stop" alongside "what we will start".
• Build-by-default. Bespoke engineering for commodity capabilities, or lock-in from an unconsidered buy. Antidote: an explicit, defensible build/buy/partner posture with open standards and exit rights.
• Strategy divorced from the operating model. Direction with no delivery machine behind it. Antidote: design strategy, operating model, and portfolio as one system (Topics 1.1 and 5.3).

Maturity model#

Checklist#

• Every major strategic aim traces to a clinical, operational, or population-health outcome with a measure.
• A structured maturity assessment (WGLL-framed) has been run with clinical and operational input in the last 12 months.
• The strategy states both an inspirational vision and a concrete, testable target state.
• The roadmap is expressed as now / next / later, with certainty decreasing over the horizon.
• Build / buy / partner is an explicit, documented posture per major capability, with open standards and exit rights.
• The strategy names what you will not do and at least one system to decommission.
• Capacity for running safety-critical systems and reducing technical debt is protected, not only new builds.
• Every significant investment in the portfolio traces to a strategic aim; orphaned proposals face a higher bar.
• The funding context (Who Pays for What) is understood and the strategy is defensible to those who allocate money.
• The strategy has a review cadence and is quoted in real decisions — not filed and forgotten.

Key sources#

• NHS England Transformation Directorate — What Good Looks Like framework (seven success measures for digital transformation).
• NHS England Transformation Directorate — Who Pays for What (digital funding proposals and the shift towards ICS allocation).
• Simon Wardley — Wardley Mapping (value-chain mapping for build/buy and strategic choice).
• Richard Rumelt — Good Strategy / Bad Strategy (strategy as coherent action, not aspiration).
• GOV.UK Service Manual — agile phases and staged spend control (Government Digital Service).
• NHS digital service manual — NHS service standard (service-manual.nhs.uk).

References#

1. Strategic planning — Wikipedia — https://en.wikipedia.org/wiki/Strategic_planning
2. Technology roadmap — Wikipedia — https://en.wikipedia.org/wiki/Technology_roadmap
3. Vision statement — Wikipedia — https://en.wikipedia.org/wiki/Vision_statement
4. Digital transformation — Wikipedia — https://en.wikipedia.org/wiki/Digital_transformation
5. Maturity model — Wikipedia — https://en.wikipedia.org/wiki/Maturity_model
6. Wardley map — Wikipedia — https://en.wikipedia.org/wiki/Wardley_map
7. Gap analysis — Wikipedia — https://en.wikipedia.org/wiki/Gap_analysis
8. Enterprise architecture — Wikipedia — https://en.wikipedia.org/wiki/Enterprise_architecture
9. Legacy system — Wikipedia — https://en.wikipedia.org/wiki/Legacy_system
10. Integrated care system — Wikipedia — https://en.wikipedia.org/wiki/Integrated_care_system
11. Objectives and key results (OKRs) — Wikipedia — https://en.wikipedia.org/wiki/Objectives_and_key_results
12. NHS England — Wikipedia — https://en.wikipedia.org/wiki/NHS_England
13. What Good Looks Like framework — NHS England Transformation Directorate — https://transform.england.nhs.uk/digitise-connect-transform/what-good-looks-like/what-good-looks-like-publication/
14. Who Pays for What proposals — NHS England Transformation Directorate — https://transform.england.nhs.uk/digitise-connect-transform/who-pays-for-what/who-pays-for-what-proposals/
15. Wardley Mapping — Simon Wardley (Learn Wardley Mapping) — https://learnwardleymapping.com/
16. NHS service standard — NHS digital service manual, NHS England — https://service-manual.nhs.uk/standards-and-technology/service-standard