Glossary

Definitions of the key terms used throughout Ways of Working for Digital Health & Care. Where a term has a good encyclopaedic entry, a Wikipedia link is provided for further reading. Cross-references point to the topic where the term is developed most fully.

A#

Accessibility — Designing services so people with disabilities can use them; in UK public services, measured against the Web Content Accessibility Guidelines (WCAG) and a legal duty. See Topics 1.9, 3.0.

ADKAR — Prosci's individual change model: Awareness, Desire, Knowledge, Ability, Reinforcement. A people-centred complement to organizational change models. See Topic 8.1.

Agile — A family of iterative, incremental ways of working that deliver value in small increments and adapt to feedback. See Agile software development. See Topics 1.0, 3.5.

Alert fatigue — Desensitization caused by too many low-value safety alerts, so clinicians begin to override important and trivial warnings alike. See Alarm fatigue. See Topics 4.7, 4.8.

Alpha — The lifecycle phase where a team tests solutions to the problems found in discovery, usually with throwaway prototypes. See Topic 3.5.

Arden syntax — A standard for encoding shareable medical knowledge as executable rules (Medical Logic Modules) for clinical decision support. See Arden syntax. See Topic 4.7.

Architecture decision record (ADR) — A short document capturing one significant design decision, its context and its consequences, kept close to the code. See Topic 10.3.

Artificial intelligence (AI) — Computer systems performing tasks that normally require human intelligence; in health, increasingly delivered through machine learning. See Artificial intelligence. See Topic 8.4.

Assisted digital — Support for people who cannot use a digital service independently, so they are not excluded. See Topic 1.9.

Asynchronous consultation (e-consultation) — Store-and-forward clinical contact where patient and clinician are not present at the same time. See Topic 3.11.

Autoscaling — Automatic adjustment of cloud capacity to match demand, a core lever for cutting idle spend. See Autoscaling. See Topic 6.5.

Airlock (output checking) — In a Secure Data Environment, the holding area and human review gate through which analytical results pass, checked for disclosure risk, before release. See Topic 4.10.

B#

Budget impact analysis — An estimate of the total cash cost of adopting an intervention across a health system; something can be cost-effective yet unaffordable in-year. See Topic 6.1.

Behaviour Change Wheel / COM-B — A framework explaining behaviour through Capability, Opportunity and Motivation, used to design adoption interventions. See Topic 8.3.

Big bang adoption — Switching an organization onto a new system on a single cut-over date, with no parallel-running period. See Big bang adoption. See Topic 4.6.

Business continuity — Keeping critical services running, and recovering them, through disruption. See Business continuity planning. See Topic 3.9.

Business intelligence — Tools and practices that turn data into reporting and insight for decisions. See Business intelligence. See Topic 4.5.

Balanced scorecard — A strategic performance framework balancing financial, customer, internal-process, and learning-and-growth measures. See Balanced scorecard. See Topic 10.0.

Benefits realization — The discipline of identifying, planning, measuring and actually achieving the benefits a change is meant to deliver. See Benefits realisation management. See Topics 5.2, 5.3, 8.1.

Beta — The lifecycle phase where a team builds and iterates a working service with real users, first privately then publicly. See Topic 3.5.

Bus factor — The number of people who would have to be lost before a system or service could no longer be run or understood; a measure of key-person risk. See Bus factor. See Topic 10.3.

Business case — The justification for an investment, in the UK public sector usually the Five Case Model (strategic, economic, commercial, financial, management). See Topics 6.0, 9.1.

Bioinformatics — The computational pipelines that turn raw genomic sequence into interpreted, clinically actionable variants. See Bioinformatics. See Topic 4.11.

C#

Cost–benefit analysis (CBA) — An economic evaluation that expresses both costs and health benefits in monetary terms. See Cost–benefit analysis. See Topic 6.1.

Care Quality Commission (CQC) — The independent regulator of health and adult social care in England, whose remit includes digitally-enabled and well-led care. See Topic 1.5.

Chargeback — Recovering technology cost from the consuming team's own budget, as opposed to showback, which only reports it. See Cost allocation. See Topic 6.5.

Chief Clinical Information Officer (CCIO) — A senior clinician accountable for the clinical design, safety and adoption of an organization's IT; with the Chief Nursing Information Officer (CNIO), leads clinical informatics. See Chief medical informatics officer. See Topics 4.6, 4.7.

Clinical decision support (CDS / CDSS) — Health IT that delivers person-specific, filtered knowledge to a clinician at the point of care to improve a decision. See Clinical decision support system. See Topic 4.7.

Clinical engineering — The discipline (also biomedical engineering) that manages medical devices across their lifecycle — inventory, maintenance, safety and decommissioning. See Topic 4.4.

Clinical informatics — The discipline joining clinical practice, information and technology; the professional home of the CCIO and CNIO. See Health informatics. See Topic 4.7.

Closed-loop medication administration — An unbroken electronic chain from prescribing to dispensing to barcode-verified bedside administration, enforcing the "five rights" of medication. See Topic 4.8.

Committed-use / reserved capacity — Discounted cloud pricing exchanged for a one- or three-year commitment to a baseline level of usage. See Topic 6.5.

Computerized physician order entry (CPOE) — Electronic entry of clinical orders (tests, drugs, referrals) by the ordering clinician; also called order communications. See Computerized physician order entry. See Topics 4.6, 4.7.

Content design — Designing the words, structure and formats that help people complete a task, in plain language and accessible forms. See Topic 3.1.

Cloud computing — Delivering computing services over the internet on a public or hybrid basis. See Cloud computing. See Topic 4.0.

Caldicott Guardian — A senior person responsible for protecting the confidentiality of health and care information and enabling appropriate sharing. See Caldicott Guardian. See Topic 1.7.

Change management — The structured approach to moving people and organizations from a current to a future state. See Change management. See Topic 8.1.

Clinical safety (DCB0129/DCB0160) — Mandatory NHS standards for managing clinical risk in the manufacture (DCB0129) and deployment (DCB0160) of health IT, overseen by a Clinical Safety Officer. See Topic 1.6.

Continuous delivery / integration — Engineering practices for releasing software frequently and safely. See Continuous delivery and Continuous integration. See Topic 3.5.

Conway's law — The observation that a system's design mirrors the communication structure of the organization that builds it. See Conway's law. See Topic 7.0.

Cost-effectiveness analysis — Comparing the cost of interventions against a common health outcome (often the QALY) to judge value for money. See Cost-effectiveness analysis. See Topic 6.1.

Cost of delay — The economic cost of not having something finished yet; the numerator in prioritization methods such as WSJF. See Cost of delay. See Topic 2.2.

Cyber security — Protecting systems, networks and data from digital attack; in the NHS, guided by the NCSC and the Data Security and Protection Toolkit. See Computer security. See Topic 1.7.

Cynefin — A sense-making framework distinguishing clear, complicated, complex and chaotic contexts to match the response to the situation. See Cynefin framework. See Topics 1.3, 2.1.

Concentration risk — The exposure created by depending too heavily on a single supplier, platform or region. See Concentration risk. See Topic 6.6.

D#

Digital public infrastructure — Shared, reusable digital platforms and services (identity, data exchange, national APIs) that many organizations build on. See Topic 4.1.

Design system — A single source of truth of reusable, accessible interface components, patterns and guidance (e.g. the NHS and GOV.UK design systems). See Topic 3.2.

Digital social care record (DSCR) — A digital replacement for paper care records in adult social care, supplied from an assured list. See Topic 9.3.

DevOps — A culture and set of practices uniting development and operations to release software frequently and safely. See DevOps. See Topic 3.6.

Digital literacy — The capability of the whole workforce (not just specialists) to use digital tools confidently and safely. See Topic 7.4.

Data cleansing — Detecting and correcting or removing inaccurate, corrupt or duplicate records. See Data cleansing. See Topic 4.9.

Data ethics — Doing the right thing with data beyond legal compliance; social licence and public trust. See Big data ethics. See Topic 1.8.

Data migration — The one-off transfer of historical records from a legacy system into a new one; technically routine but clinically high-risk. See Data migration. See Topic 4.6.

Data profiling — Examining existing data to measure its actual condition before cleansing, migration or reporting. See Data profiling. See Topic 4.9.

Data quality — Fitness of data for use, judged across dimensions such as accuracy, completeness, timeliness, validity, consistency and uniqueness; in care, poor quality is a clinical-safety hazard. See Data quality. See Topic 4.9.

Data Quality Maturity Index (DQMI) — NHS England's measure of the quality of the data organizations submit in national datasets. See Topic 4.9.

Data steward — The named role accountable for the quality and fitness of a defined data domain. See Data steward. See Topic 4.9.

Digital strategy — A statement of digital vision, priorities and roadmap aligned to organizational and clinical strategy. See Topic 1.2.

Disaster recovery — The technical recovery of systems and data after a major failure, measured by RTO and RPO. See IT disaster recovery. See Topic 3.9.

Dictionary of medicines and devices (dm+d) — The NHS standard terminology giving every medicine and device a unique code for unambiguous recording and interoperability. See Topic 4.8.

Data Security and Protection Toolkit (DSPT) — The annual self-assessment NHS and social-care organizations complete to show they meet data-security and information-governance standards. See Topic 1.7.

Demand management — Capturing, understanding and shaping the flow of incoming requests so supply can meet it. See Topics 2.0, 5.3.

Diffusion of innovations — Rogers' theory of how new ideas and technology spread through a population over time. See Diffusion of innovations. See Topic 8.0.

Digital inclusion / exclusion — Whether people can access and use digital services; exclusion (the digital divide) maps closely onto health inequalities. See Topics 1.9, 3.11.

Discovery — The first lifecycle phase: understanding users and the problem before committing to a solution. See Topic 3.4.

DORA metrics — Four key measures of software delivery performance (deployment frequency, lead time, change-fail rate, time to restore). See DevOps. See Topics 3.8, 10.0.

Double Diamond — The Design Council's model of divergent-then-convergent thinking across "discover/define" and "develop/deliver". See Double Diamond. See Topics 3.0, 3.4.

DTAC — The NHS Digital Technology Assessment Criteria: a baseline for clinical safety, data protection, security, interoperability and usability of digital health products. See Topics 1.6, 8.4.

Data re-identification — Matching supposedly anonymous data against other datasets to reveal who someone is; genomic data is inherently re-identifiable. See Data re-identification. See Topics 4.10, 4.11.

Dynamic consent — A digital, ongoing consent model letting people see and change how their data or samples are used over time. See Dynamic consent. See Topic 4.11.

E#

Externality — A cost or benefit of a treatment falling on people not party to it, such as herd immunity from vaccination. See Externality. See Topic 6.1.

E-iatrogenesis — Patient harm caused or enabled by health IT, such as a pick-list or default-dose error. See Iatrogenesis. See Topic 4.8.

Electronic patient record (EPR) — A provider's core clinical system: the digital patient record plus the tools clinicians use to order, document and review at the point of care (also EHR/EMR). See Electronic health record. See Topic 4.6.

Electronic prescribing & medicines administration (ePMA) — A hospital system, usually an EPR module, managing the whole inpatient medicines process from prescribing to recorded administration. See Electronic prescribing. See Topic 4.8.

Electronic Prescription Service (EPS) — The NHS England service that sends prescriptions electronically from prescriber to pharmacy. See NHS Electronic Prescription Service. See Topic 4.8.

Enterprise architecture — A disciplined view of an organization's business, data, application and technology layers to guide change. See Enterprise architecture. See Topic 4.0.

Equality, Diversity & Inclusion (EDI) — Fair treatment, representation and belonging in the workforce, underpinned by the Equality Act 2010 and duties such as WRES and WDES. See Topic 7.6.

Enterprise Project Portfolio Management (EPPM) — Managing the entire portfolio of change initiatives as one coordinated whole. See Project portfolio management. See Topic 5.3.

Enterprise Resource Planning (ERP) — Integrated software for finance, HR, payroll, procurement and supply chain that acts as an organization's system of record. See Enterprise resource planning. See Topic 5.4.

Evidence hierarchy — A ranking of evidence types by susceptibility to bias, from expert opinion up to systematic reviews of randomized trials. See Hierarchy of evidence. See Topic 1.3.

Experience-level agreement (XLA) — A commitment measuring the outcome a user actually experiences, complementing component-level SLAs. See Topic 6.6.

F#

FHIR — Fast Healthcare Interoperability Resources, the HL7 standard for exchanging health data. See Fast Healthcare Interoperability Resources. See Topic 4.3.

FinOps (cloud financial operations) — An operating discipline uniting engineering, finance and business/clinical teams to manage cloud cost as a shared, data-driven responsibility across an Inform/Optimize/Operate lifecycle. See Topic 6.5.

Five Case Model — The HM Treasury / UK government standard structure for a business case. See Topics 6.0, 9.1.

Five rights of CDS — The quality frame for decision support: the right information, to the right person, in the right format, through the right channel, at the right time. See Topic 4.7.

Frontline digitization — NHS England's national programme setting a core electronic patient record as the baseline for every provider and tying capital funding to digital maturity. See Topic 4.6.

Federated analytics / federated learning — Running queries or training models across separate data holdings so insight is combined without the raw data being pooled. See Federated learning. See Topic 4.10.

Five Safes — A framework structuring safe data access across safe people, projects, settings, data and outputs. See Five Safes. See Topic 4.10.

G#

GDPR — The General Data Protection Regulation (and UK GDPR): the legal framework for processing personal data. See Topic 1.7.

Golden record — A single reconciled, trusted version of an entity (such as a patient) assembled from multiple source systems. See Topic 4.9.

Goodhart's law — "When a measure becomes a target, it ceases to be a good measure." See Goodhart's law. See Topic 10.0.

Greener NHS / net zero — The NHS programme and commitment to reach net-zero carbon emissions across its own footprint and wider supply chain. See Topic 8.5.

Green Book — HM Treasury guidance on appraising and evaluating public spending. See Topics 6.0, 6.1, 9.1.

GA4GH (Global Alliance for Genomics and Health) — The international standards body for responsible genomic data sharing. See Global Alliance for Genomics and Health. See Topic 4.11.

Genomics — The study of the whole genome and its use in care; genomic data is large, lifelong, familial and uniquely identifying. See Genomics. See Topic 4.11.

Genomics England / 100,000 Genomes Project — The government-owned company and programme that sequenced 100,000 genomes and curates the National Genomic Research Library. See Genomics England. See Topic 4.11.

H#

Hazard ratio (HR) — The ratio of the event rate in a treatment group to a control group over time, from survival analysis; often misread because it averages over follow-up and does not translate simply into absolute risk or life-years. See Hazard ratio. See Topic 1.4.

Health literacy — People's ability to find, understand and use health information and services; low health literacy widens inequalities. See Health literacy. See Topic 3.1.

Health Research Authority (HRA) — The body overseeing research ethics and governance for health and social care research in the UK. See Topic 8.6.

Hazard log — The living register of clinical hazards, their risk ratings and controls that sits at the heart of a clinical safety case. See Topic 1.6.

Health economics — The study of how to allocate scarce resources to maximize health, using tools such as cost-effectiveness analysis and the QALY. See Health economics. See Topic 6.1.

Health inequalities — Unfair and avoidable differences in health across the population; digital exclusion can widen them. See Health equity. See Topic 1.9.

HIMSS EMRAM — The HIMSS Electronic Medical Record Adoption Model, a 0–7 international benchmark of a provider's clinical-system digital maturity. See Healthcare Information and Management Systems Society. See Topic 4.6.

Hospital-at-home / virtual ward — Delivering hospital-level acute care to patients in their own homes with daily clinical review and rapid escalation. See Hospital-at-home. See Topic 3.11.

I#

Information asymmetry — The imbalance where clinicians hold far more information about treatment than patients, one reason the healthcare market cannot be left to itself. See Information asymmetry. See Topic 6.1.

Identity & access management (IAM) — Controlling who can access what: authentication, authorization, role-based access control and least privilege. See Topic 4.2.

Internet of Medical Things (IoMT) — Connected medical devices and sensors that generate and exchange data; a major clinical and security surface. See Topic 4.4.

ICER (incremental cost-effectiveness ratio) — The extra cost per extra unit of health (e.g. per QALY) of one option versus another; compared against a threshold to judge value. See Topic 6.1.

Incident management — The service-management practice of restoring normal service as quickly as possible after disruption, with major-incident and business-continuity procedures for the most serious. See Incident management. See Topic 3.8.

Information governance — The rules and accountability for handling information legally, securely and ethically. See Topic 1.7.

Integrated Care System (ICS) — A partnership of NHS and local-government organizations planning and delivering joined-up health and care in an area of England. See Integrated care system. See Topics 5.2, 9.0.

Interoperability — The ability of systems to exchange and use information, at technical and semantic levels. See Interoperability. See Topic 4.3.

ITIL — A framework for IT service management, including incident, problem, change and service-request management. See ITIL. See Topic 3.8.

Incidental (secondary) findings — Clinically significant discoveries unrelated to the reason a genomic test was ordered, raising consent and feedback questions. See Incidental medical findings. See Topic 4.11.

K#

Kanban — A pull-based method for visualizing and limiting work in progress to improve flow. See Kanban (development). See Topics 2.1, 2.2.

Knowledge management — The discipline of capturing, sharing and reusing an organization's knowledge, both tacit and explicit. See Knowledge management. See Topic 10.3.

KPI — Key Performance Indicator: a metric tracking progress toward an objective. See Performance indicator. See Topic 10.0.

Kotter's 8 steps — John Kotter's model for leading organizational change, from creating urgency to anchoring change in the culture. See Topic 8.1.

Kraljic matrix — A supplier and purchasing segmentation model classifying items by business criticality and supply-market difficulty. See Kraljic matrix. See Topics 6.6, 6.3.

L#

Legacy system — Ageing hardware or software still in use, often unsupported — a safety, security and cost risk. See Legacy system. See Topic 4.0.

Lean — A philosophy of maximizing value and eliminating waste, originating in the Toyota Production System. See Lean manufacturing. See Topics 2.0, 2.2.

Live — The lifecycle phase where a service runs in production and is continuously improved and eventually retired. See Topics 3.5, 3.8.

Logic model — A diagram linking inputs and activities to outputs, outcomes and impact, used to plan and evaluate. See Logic model. See Topics 1.3, 6.1.

M#

Model for Improvement — A quality-improvement method pairing three questions with Plan-Do-Study-Act cycles. See Topic 10.2.

Machine learning — A branch of AI in which systems learn patterns from data rather than being explicitly programmed. See Machine learning. See Topic 8.4.

Master data management — Governing an organization's core shared data about key entities — patients, staff, organizations, medicines, suppliers — so it is consistent and authoritative across systems. See Master data management. See Topics 4.9, 5.4.

Maturity model — A staged description of capability from initial to optimizing, used for self-assessment. See Capability Maturity Model. Used in every topic.

Medical algorithm — A computation, formula, score or look-up used in care; the basis of clinical calculators and rule-based decision support. See Medical algorithm. See Topic 4.7.

Medicines reconciliation — Building an accurate list of a patient's current medicines and comparing it against what is prescribed at every transfer of care. See Medication reconciliation. See Topic 4.8.

mHealth — Health services and information delivered through mobile devices and apps. See mHealth. See Topic 3.11.

MHRA — The Medicines and Healthcare products Regulatory Agency, which regulates medical devices including software and AI as a medical device. See Medicines and Healthcare products Regulatory Agency. See Topics 1.6, 8.4.

Minimum viable product (MVP) — The smallest version of a product that delivers and tests value. See Minimum viable product. See Topics 5.0, 8.0.

MLOps — The practices for deploying, monitoring and maintaining machine-learning models in production, including watching for model drift. See Topic 8.4.

MoSCoW — A prioritization method: Must, Should, Could, Won't have. See MoSCoW method. See Topic 2.2.

MSP (Managing Successful Programmes) — AXELOS's programme-management framework. See Topic 5.2.

Multidisciplinary team — A team combining the different skills needed to deliver a whole service. See Topics 1.0, 7.0.

N#

Nudge theory — Shaping the choice environment to make a helpful behaviour easier without removing options. See Nudge theory. See Topic 8.3.

NHS App — The national patient-facing app (with NHS login) for access to records and services. See NHS App. See Topic 3.3.

NHS number — The unique 10-digit identifier for every patient in England and Wales; correct use is the foundation of safe record matching. See Topic 4.9.

Net zero — Balancing the greenhouse gases emitted with those removed; the NHS has committed to net zero across its carbon footprint. See Net zero emissions. See Topic 8.5.

NICE Evidence Standards Framework — NICE's framework for the evidence digital health technologies should show for their effectiveness and economic impact. See Topics 6.1, 8.4.

O#

OKR — Objectives and Key Results: a goal-setting framework pairing an ambition with measurable results. See OKR. See Topic 10.0.

Operating model — How an organization is arranged to deliver value: value streams, capabilities, teams, governance, technology, data and suppliers. See Operating model. See Topic 1.1.

Order set — A bundled group of orders (tests, drugs, instructions) appropriate to a clinical situation, presented together to speed and standardize care. See Topic 4.7.

Organizational development (OD) — Planned effort to improve an organization's health, capability and culture. See Organization development. See Topic 7.5.

Outcomes vs outputs — Outputs are the activity a service produces (e.g. appointments delivered); outcomes are the change in health and wellbeing that results. Measuring both consistently is central to demonstrating value. See Topics 6.1, 10.0.

P#

Platform (as a product) — A shared capability run as a product with internal users, so teams build on it rather than rebuilding it. See Topic 4.1.

Patient administration system (PAS) — The system managing admissions, discharges, transfers and outpatient appointments; historically the administrative core of a hospital. See Hospital information system. See Topic 4.6.

Prototyping — Making low- or high-fidelity versions of a service to test ideas with users before building. See Software prototyping. See Topic 3.2.

PDSA — Plan-Do-Study-Act: the small-test-of-change cycle at the heart of quality improvement. See Topic 10.2.

Personal health record (PHR) — A record of health information controlled or accessed by the individual. See Personal health record. See Topic 3.3.

Polypharmacy — The simultaneous use of multiple medicines, common in older and multi-morbid patients and a driver of harm and interactions. See Polypharmacy. See Topic 4.8.

Population health management — Using data to segment and stratify a population and target interventions to those who benefit most. See Topic 4.5.

Pilotitis — The anti-pattern of endless small pilots that never scale. See Topic 8.0.

PRINCE2 — A structured project-management method widely used in UK government. See PRINCE2. See Topic 5.1.

Procurement (public) — Buying goods and services under public-procurement rules (in the UK, the Procurement Act 2023), via routes such as framework agreements. See Government procurement. See Topic 6.3.

Product management — The discipline of leading a durable product team to deliver outcomes for users and the organization. See Product management. See Topic 5.0.

Productivity dip — The planned, temporary fall in clinical throughput that typically follows an EPR go-live as staff learn the new system. See Topic 4.6.

Programme management — Coordinating related projects and products to deliver strategic outcomes and benefits. See Program management. See Topic 5.2.

PROMs / PREMs — Patient-Reported Outcome Measures and Patient-Reported Experience Measures: standardized ways to capture outcomes and experience directly from patients. See Topic 6.1.

Psychological safety — A shared belief that it is safe to speak up, admit mistakes and take interpersonal risks. See Psychological safety. See Topic 7.5.

Pharmacogenomics — Using a person's genome to predict which medicines will work or cause harm, ideally surfaced as an alert at the point of prescribing. See Pharmacogenomics. See Topics 4.11, 4.8.

Precision (personalized) medicine — Tailoring prevention and treatment to an individual's genome, characteristics and circumstances. See Precision medicine. See Topic 4.11.

Pseudonymization — Replacing direct identifiers with key-linked tokens; the data remains personal data in law, unlike true anonymization. See Pseudonymization. See Topics 4.10, 1.7.

Q#

Quality improvement (QI) — Frontline-led, iterative improvement using methods such as the Model for Improvement and PDSA. See Topic 10.2.

QALY (Quality-Adjusted Life Year) — A measure combining length and quality of life into a single unit, used to compare the health value of different interventions. See Quality-adjusted life year. See Topic 6.1.

R#

Retrospective — A regular team review that turns what happened into concrete improvements to how the team works. See Topic 7.1.

Regulation & compliance — The terrain of statutory regulators, mandatory standards and voluntary assurance that digital health must satisfy. See Topic 1.5.

Record linkage — Matching records across different sources that refer to the same real-world entity; the basis of patient matching. See Record linkage. See Topic 4.9.

Reference data — Data used to classify or categorize other data (code lists, value sets, organization codes), usually externally defined and slow to change. See Reference data. See Topic 4.9.

Remote patient monitoring (RPM) — Streaming of physiological readings from a patient's home to a clinical team who review and act on them. See Remote patient monitoring. See Topics 3.11, 4.4.

Role-based access control (RBAC) — Granting access by job role rather than to individuals, supporting least privilege. See Topic 4.2.

Real-world evidence — Evidence on how an intervention performs in routine practice, not only in trials. See Topic 8.6.

RTO / RPO — Recovery Time Objective and Recovery Point Objective: how fast, and to what point, a service must recover. See Topic 3.9.

RACI — A responsibility-assignment matrix (Responsible, Accountable, Consulted, Informed). See Responsibility assignment matrix. See Topics 1.1, 7.0.

RAID log — A register of Risks, Assumptions, Issues and Dependencies. See Topics 5.1, 6.4.

Randomized controlled trial (RCT) — An experiment that randomly allocates participants to test an intervention's effect. See Randomized controlled trial. See Topic 1.3.

Records management — Governing the creation, retention and disposal of records, including statutory retention of health records. See Records management. See Topics 1.7, 10.3.

RICE — A prioritization score: Reach × Impact × Confidence ÷ Effort. See Topic 2.2.

Reference genome — A standardized genome assembly against which an individual's DNA is compared; its version affects the interpretation. See Reference genome. See Topic 4.11.

Retained organization — In a multi-sourced/SIAM model, the customer-side functions (strategy, demand, architecture, commercial, duty of care) that cannot be outsourced. See Topic 6.6.

S#

Shared services — Common capabilities provided once and used by many teams or organizations, reducing duplication and cost. See Topic 4.1.

Safeguarding — Protecting children and adults at risk from abuse, neglect and harm, including risks created by digital services. See Safeguarding. See Topic 1.10.

Secure Data Environment (SDE) — A trusted platform where approved analysts work with approved data for approved purposes without extracting it; also called a Trusted Research Environment (TRE). See Topics 4.10, 4.5.

Section 251 / Confidentiality Advisory Group (CAG) — The route for lawfully using confidential patient information without consent, on independent advice, in England and Wales. See Topic 4.10.

Service integration and management (SIAM) — An operating model coordinating multiple suppliers to deliver one end-to-end service through a single integrating layer. See Service integration and management. See Topic 6.6.

Service integrator — The SIAM layer (internal, external or hybrid) that coordinates providers and owns cross-cutting processes such as major-incident management. See Topic 6.6.

Statistical disclosure control — Techniques such as suppressing small cell counts that stop published results from identifying individuals. See Statistical disclosure control. See Topic 4.10.

Service evaluation — Assessing how well a service works, distinct from formal research and clinical audit. See Topic 8.6.

Showback — Reporting to each team what its technology consumption costs, for transparency, without moving money between budgets. See Topic 6.5.

Single source of truth — Mastering each data element in exactly one authoritative place, so every other system refers back to it. See Single source of truth. See Topic 4.9.

Software asset management (SAM) — The discipline of tracking and optimizing owned and rented software, including SaaS and per-user licences. See Software asset management. See Topic 6.5.

Stakeholder engagement — Two-way involvement of the people affected by a change, beyond one-way communication. See Stakeholder engagement. See Topic 8.2.

SAFe — The Scaled Agile Framework for coordinating many agile teams. See Scaled agile framework. See Topics 2.2, 5.2.

SaMD (Software as a Medical Device) — Software intended for a medical purpose that is itself a regulated medical device. See Topics 1.6, 8.4.

Scrum — An agile framework using fixed-length sprints and defined roles. See Scrum (software development). See Topic 3.5.

Senior Responsible Owner (SRO) — The single named individual accountable for a project or programme achieving its objectives. See Topic 6.4.

Service assessment — A peer review against the NHS/GOV.UK Service Standard at lifecycle phase boundaries. See Topics 1.0, 3.5.

Service design — Designing the whole end-to-end service across channels and touchpoints, not just the digital interface. See Service design. See Topic 3.0.

Service level agreement (SLA/SLO) — A committed level of service (agreement) and the internal objective that supports it (objective); paired with error budgets in SRE. See Topic 3.8.

Service standard — The set of principles a good public digital service must meet. See Topics 1.0, 3.5.

Site reliability engineering (SRE) — An operations discipline applying software engineering to reliability, using SLOs and error budgets. See Site reliability engineering. See Topic 3.8.

Six-step methodology — A widely used NHS/social-care workforce-planning method (define the plan, the workforce, the future, the gaps, the actions, and monitor). See Topic 7.2.

SNOMED CT — The comprehensive clinical terminology used across the NHS to record care in a coded, computable way. See SNOMED CT. See Topic 4.3.

Social value — The wider economic, social and environmental benefit a contract can deliver, which public bodies must weigh in procurement. See Topics 6.3, 8.5.

Statistical process control (SPC) — Using control charts to tell normal variation from real change; the NHS "Making Data Count" approach. See Statistical process control. See Topic 10.0.

Stakeholder analysis — Identifying and understanding the people affected by, or able to affect, a change. See Stakeholder analysis. See Topic 8.1.

T#

Technology-enabled care (TEC) — Telecare, telehealth and connected devices that help people live independently; widely used in social care. See Topic 9.3.

Telecare — Sensors and alarms that help people stay safe and independent at home; widely used in adult social care. See Telecare. See Topics 9.3, 3.11.

Telehealth — Using telecommunications technology to deliver care at a distance — consultation, monitoring, education and administration. See Telehealth. See Topic 3.11.

Test automation — Automated checks that run as part of continuous integration to catch regressions early. See Test automation. See Topic 3.7.

Target operating model (TOM) — The desired future-state operating model an organization is designing toward. See Topic 1.1.

Team Topologies — A model (from the book by Matthew Skelton and Manuel Pais) of four team types (stream-aligned, platform, enabling, complicated-subsystem) and three interaction modes; see also Conway's law. See Topic 7.0.

Technical debt — The future cost of expedient short-term technical choices. See Technical debt. See Topic 2.2.

Thinnest viable platform — The smallest platform that reduces teams' cognitive load without becoming a bottleneck. See Topic 1.1.

Three lines of defence — A risk-and-assurance model separating operational management, oversight functions, and independent internal audit. See Topic 6.4.

Total cost of ownership (TCO) — The full direct and indirect cost of a technology over its whole life, including support, integration and exit. See Total cost of ownership. See Topic 6.5.

Total triage — An access model where every request for care is assessed first and directed to the most appropriate response, rather than defaulting to face-to-face. See Topic 3.11.

Triage — Assessing and routing incoming work by urgency and importance; borrowed from clinical practice. See Triage. See Topic 2.1.

Third-party management — Overseeing external providers and their sub-contractors (fourth parties) across the supply chain. See Third-party management. See Topic 6.6.

U#

Unit economics — Expressing cost as a rate against a meaningful unit — cost per patient, appointment or API call — to weigh spend against value. See Topic 6.5.

User research — Studying users' needs and behaviours to inform design decisions. See User research. See Topic 3.0.

V#

Value management — Tracking and banking the benefits and value a change was meant to deliver, distinct from appraising it up front. See Topic 6.2.

Vendor lock-in — Dependence on a supplier that makes switching costly, often through proprietary data or interfaces; open standards and exit planning reduce it. See Vendor lock-in. See Topics 4.3, 6.3, 6.6.

Virtual ward (hospital-at-home) — Delivering hospital-level acute care to patients in their own homes, with daily clinical review, monitoring and rapid escalation. See Hospital-at-home. See Topic 3.11.

W#

WHO digital health strategy — The World Health Organization's global strategy framing digital health and digital public goods across health systems. See Topic 9.2.

What Good Looks Like (WGLL) — The NHS framework describing success measures for digital maturity. See Topic 1.2.

Waterfall — A sequential, plan-driven delivery approach. See Waterfall model. See Topics 3.5, 5.1.

Watermelon reporting — Status that looks green on the outside but is red inside; a reporting anti-pattern. See Topic 10.4.

Workforce planning — Matching the supply of people and skills to future demand. See Workforce planning. See Topic 7.2.

Workforce strategy — The long-term, evidence-based plan for the shape, capability, culture and wellbeing of the workforce. See Topic 7.3.

WSJF (Weighted Shortest Job First) — A prioritization method dividing cost of delay by job size. See Topic 2.2.

Whole genome sequencing (WGS) — Reading effectively an individual's entire genome; the most data-intensive sequencing option. See Whole genome sequencing. See Topic 4.11.

Z#

Zero trust — A security model that trusts no request by default and verifies every access continuously. See Topic 4.2.