Integration without cyber security is integration without trust

As health and social care move towards greater integration, trust in the data that connects services has never been more important. Michelle Corrigan, Programme Director at the Digital Care Hub, explores how plans for the Social Care Interoperability Platform (SCIP) highlights the need for shared standards, shared risks, and shared accountability if integration is to truly deliver for people.

The vision for health and social care is changing. Digitisation is no longer about digitising individual services in isolation — it is about weaving them together into a single fabric of support around people. Plans to develop the Social Care Interoperability Platform (SCIP) is one of the latest signals of that shift. Designed to connect health and social care data securely and seamlessly, SCIP will underpin vital processes such as integrating GP records, ensuring smooth hospital discharges, and providing real-time updates to care plans. Together with Digital Social Care Records and access to national health data systems, it represents a step towards a more joined-up ecosystem.

But this raises an important question: what happens to trust in that ecosystem when the information that binds it together is placed at risk?

The trust chain

Every new digital connection creates an opportunity — and a responsibility. If integration is to deliver on its promise, the trust chain that runs from the citizen to their care worker, to their GP, to their hospital consultant, and back again must be unbroken.

Cyber security is what holds that chain together. Without it, the flow of data that SCIP and other programmes are designed to enable becomes fragile. A single weak link — whether a missed software update in a care home, a phishing email opened in a GP surgery, or an unsecured API in a supplier system — can undermine the integrity of the whole chain.

Shared standards, shared risks, shared accountability

Integration changes the way we need to think about risk. When data was held in silos, the consequences of a breach were largely contained. In a joined-up environment, risks are shared — and so accountability must be shared too.

This is where national, regional, and local roles become interdependent. National programmes can set the common standards and provide the architecture for interoperability. Regional systems such as integrated care systems can create the conditions for shared risk management and oversight. Local providers and suppliers bring the standards to life in practice, day to day, at the frontline.

The question is no longer “are we compliant?” but “are we collectively resilient?”

What SCIP makes visible

The ambition of SCIP highlights just how critical this collective resilience will be. Take its priority use cases:

• Access to care information for assessment and planning.
• Integration with GP records to support ongoing care.
• Smooth transitions in and out of hospitals.
• Real-time updates to care plans, including medicines and test results.
• Safeguarding alerts to protect vulnerable people.

Each of these depends on accurate, timely, and secure flows of information. Each also introduces new points of connection where a vulnerability could be exploited. If one part of the system falters, the impact is felt not just by that organisation but by every professional relying on that data — and by the individual whose care depends on it.

Moving from protection to preparedness

Perhaps the biggest shift integration demands is cultural. Cyber security is still often seen as an IT problem to be solved with stronger passwords and better firewalls. In reality, it is a collective preparedness issue. It is about whether every partner in the chain is ready to detect, respond, and recover together when an incident occurs.

For providers, this is about recognising that keeping systems updated or training staff to spot phishing emails is not just self-protection — it is protecting the entire network of care around the people they support. For suppliers, it is about building security into design, being transparent about vulnerabilities, and standing alongside customers when threats emerge. For system leaders, it is about fostering a culture where risks are openly shared, not hidden.

The opportunity in front of us

There is a temptation to view cyber security as a brake on innovation. In fact, it is the opposite. Strong, shared security is what allows innovation to flourish. Without it, platforms like SCIP cannot gain the confidence of the public or the professionals who rely on them. With it, the foundations are laid for much more: citizen access to records, secure messaging between services, population health analytics, even safe exploration of AI and automation.

The conversation, then, is not about whether we can afford to make cyber security central to integration. It is about whether we can afford not to.

A shared future

Integration across health and social care is about creating continuity around people’s lives. Cyber security, too, is about continuity — ensuring that services can be trusted to keep working, even when under threat.

As the integration agenda gathers pace, cyber security cannot remain an afterthought. It is the invisible scaffolding holding the new structures of care together. It demands that we move beyond compliance to a mindset of shared standards, shared risks, and shared accountability.

The Social Care Interoperability Platform offers us a glimpse of what the future could look like. Whether that future delivers on its promise will depend not only on how well we connect our systems, but on how well we protect the trust that flows between them.

So, as we meet at HETT to explore what’s next for digital health and care, a few questions stand out:

• If integration means shared data flows, are we ready to accept the shared risks and shared accountability that come with them?
• As platforms like SCIP expand, how do we ensure that the smallest providers — often with the least resource — are not the weak links in the trust chain?
• Are we building cyber security into integration by design, or are we still treating it as something to retrofit after the fact?

These are not questions for one sector or one organisation alone. They are questions for all of us — because integration without cyber security is integration without trust.

Join Michelle Corrigan, plus NHS colleagues at HETT discussion - Future-proofing cyber in health and care – What can we do now? Wednesday, October 8, 2025 11:40 AM to 12:20 PM

As digital transformation accelerates across health and care, cybersecurity is no longer optional, it’s foundational. This session explores the essential practices every organisation must adopt to protect against evolving cyber threats, while also tackling the complexities of national alignment, local needs, and cross-sector collaboration.

Digital Care Hub is also contributing to the following sessions at HETT:

• Red vs Blue – Interactive cyber security workshop with attacker and defender – Tuesday, October 7, 2025 10:00 - 11:00 AM
• Confronting the barriers to impactful innovation – Tuesday, October 7, 2025 11:10 - 11:50 AM
• Open Forum: Maximising what you have for cyber resilience – Ask the experts – Tuesday, October 7, 2025 12:00 - 12:50 PM

Find out more about Digital Care Hub and access free support and resources www.digitalcarehub.co.uk

Photo by GuerrillaBuzz on Unsplash