Apogee found that 85% of NHS trusts do not proactively monitor the digital experience of frontline staff, based on Freedom of Information responses from trusts across the UK.

The data points to major gaps in how trusts track everyday technology problems that affect staff access, system performance and communication with patients. According to the figures, 28% of trusts could not say how many IT outages they experienced during the reporting period, while 40% could not confirm the total duration of clinically significant outages.

Among trusts that were able to provide figures, the reported disruption was substantial. Those organisations disclosed more than 1.1 million device-related incidents in a single year, alongside more than 360,000 IT-related incidents and more than 13,000 cumulative hours of downtime.

Average incident resolution times exceeded 48 hours. This suggests some trusts can count major problems once they occur but still lack a clear picture of how often disruption slows clinical and administrative work before it becomes a reportable incident.

Visibility gaps

The research identified three broad areas where trusts struggled to provide operational data. The first was staff access to technology. Some 67% of trusts could not say how long it typically takes staff to access their systems, and 59% did not know how many employees had access to a designated workstation.

The second was information flow through digital and paper-based processes. Despite the continued shift towards electronic records, 44% of trusts could not report how many pages were scanned into electronic patient record systems, while 41% were unable to confirm how many outpatient communications had been sent by post or hybrid mail.

The third area was patient communication. Trusts reported around five million missed or unattended appointments during the same period, yet fewer than 5% could say whether those appointments were missed because of communication failures. A further 19% could not confirm the number of missed appointments at all.

The findings come as the NHS faces pressure to expand digital services while improving productivity and reducing waiting times. In that context, the inability to measure basic points of friction such as login delays, workstation access and communication breakdowns raises questions about how easily trusts can judge whether existing systems are helping staff or hindering them.

Apogee said its methodology was based on two Freedom of Information requests sent to 203 NHS trusts across the UK between January and March 2026, producing 244 responses. It combined those responses with NHS workforce data to estimate wider time lost to access delays, document handling and other system interruptions.

Using that approach, Apogee estimated that patient-facing and administrative staff lose around eight minutes each working day to routine operational friction. Scaled across a modelled workforce of 1.2 million staff over 220 working days, that equates to about 35.2 million hours a year.

Applying a blended hourly cost of £30, the company put the annual productivity loss at about £1.06 billion. It said the calculation used conservative assumptions drawn from published data and trust responses.

Operational strain

The figures add to a wider debate over the resilience of NHS technology infrastructure. While policy discussions often focus on new digital tools, artificial intelligence and record modernisation, day-to-day operational strain still depends on whether staff can log in quickly, retrieve information and communicate with patients without repeated delays.

Poor visibility makes it harder for trust leaders to prioritise investment. If organisations cannot identify where outages occur, how long they last or which parts of the workflow create avoidable delays, they may struggle to decide whether to invest in end-user devices, network resilience, workflow redesign or communications systems.

Apogee also pointed to an example at Newcastle upon Tyne Hospitals, where changes to how information was accessed and managed across systems reduced duplication and improved operational flow. The company said the work freed up time for frontline activity, though it did not quantify the impact in the figures released alongside the research.

James Clark, Chief Executive Officer at Apogee, said the issue was not simply the choice of new systems.

“The debate about technology in the NHS often focuses on which systems trusts should buy next,” Clark said.

“But our data shows a more basic problem: many trusts do not know how well current systems are working for staff each day.

“You cannot improve what you cannot measure. Right now, many trusts have limited insight into basic indicators like access times, outage impact and patient communication failures. This makes it incredibly difficult to improve workflows, prioritise investment or demonstrate the value of digital transformation.

“Before adding new tools or looking at how AI can help, trusts need a clearer view of how work happens today. Better operational visibility gives NHS IT teams the evidence they need to remove friction, improve reliability and make better-informed decisions about future investment.”

Junkyard Golf Club is a popular activity for families, groups and parties in the heart of Oxford’s busy shopping centre.

The popular crazy golf and cocktails chain fire opened in November 2017in the 10,000sqft premises, which hosted a themed nine-hole course and multiple cocktail bars.

READ MORE: Opening date for Abingdon Hickory’s Smokehouse announced

But the popular venue has announced a change – though customers won’t have to go without their crazy golf fix for long.

Crazy golf (Image: Carl Sukonik)

A statement on the Junkyard Golf Club website said: “We say goodbye to Junkyard at the end of July.”

A new mini golf operator, Ted’s Crazy Golf, will be taking over and hosting at the same venue from August 1.

A statement on the new golf host’s website said: “Ted’s Crazy Golf replaces Junkyard Golf Club on August 1.

“Step into Ted’s twisted world and take on two fun and creepy nine-hole crazy golf courses.

Crazy Golf

READ MORE: Helicopter search in Headington after teens stole e-scooter

“Alongside the Deadbeat Diner – a spin on a retro diner where you can reload with pizzas, hot dogs, milkshakes, ice blasts, coke floats, themed cocktails and a fully stocked bar – you’ll never forget a trip to Ted’s.”

The summer holiday opening times for the new spot are midday to 11pm Tuesday to Thursday, midday to 11.30pm on Fridays and Saturdays, and midday to 9pm on Sundays.

The new mini golf operator will be in and hosting at the venue from August 1.

Junkyard Golf Club has been approached for comment.

When investigating the cause of a cybersecurity crisis, “You can’t improve what you can’t reconstruct and what you’ve forgotten,” stated Marie Hargraves, Principal Crisis Management Consultant at Semperis. Adding, organisations build genuine cyber resilience not during the acute phase of an incident, but in the post-incident review that follows it.

Hargraves, who supported and exercised national crisis and incident response teams across government and healthcare sectors in the United Kingdom, said real-time documentation captured during a crisis is central to making that review effective.

The approach: applying the concept of continual service improvement to a crisis. Examining where an organisation’s processes, people or technology fell short. That might mean an escalation path that was missing, or an unplanned piece of shadow IT that only became apparent once the organisation was forced to work around it. 

“It should be part of your crisis plan, it shouldn’t be separated,” said Hargraves. “The post-incident review should happen straight away.”

She said a mature organisation would typically aim to close most gaps in its people, processes and technology within six months of an incident, though full recovery can take longer where digital infrastructure has been affected, and staff have had to revert to manual processes in the interim. A separate challenge then emerges when digital systems come back online: someone has to transfer manual records and processes back into digital systems, a task she said is often overlooked in recovery planning.

Semperis’s crisis management platform, Ready1, is designed to operate independently of an organisation’s main IT and communication systems, so that it remains usable if a network is degraded or compromised during an incident. Hargraves said the tool automatically timestamps actions and tasks in both GMT and local time as a crisis unfolds, which she said matters for organisations with a global footprint, and allows teams to manually add context around decisions as they are made.

“If anyone has ever been in a [cyber] crisis, you’ll know that memory degrades quickly during high-pressure incidents. Critical decisions, assumptions, and pivots are often lost if they’re not documented as events unfold. This is where the resilience happens post-incident. So it’s these nuances and these pivots that, if you can document them in real time in one single source of truth, you’re going to be able to look at those lessons identified and action them, which is going to increase your resilience overall,” she said.

The platform stores contact details, cyber insurance policies and third-party retainer information that teams often struggle to locate quickly during a live incident, alongside documents that remain accessible even if an organisation’s own network is unavailable. This extends to verifying, in advance, that contacts such as a firewall vendor or retainer partner are still current, rather than an organisation discovering during a crisis, in the early hours of the morning, that a contact has since left the role.

The aim is to allow any team involved in a crisis, whether cyber, legal or finance, to reconstruct a full and accurate timeline of what happened once the incident has ended, using a single record rather than piecing one together from separate systems and handover notes.

Hargraves worked within the UK Home Office Digital Data and Technology Directorate, and said the experience shaped her approach to post-incident review at Semperis. She contrasted this with what she described as a common pattern in organisational exercises, where teams run a scheduled test every six months without anyone committing to a decision, then repeat the same exercise later having changed little, often because staff are reluctant to take ownership of a call.

She said she would instead re-exercise her team against a previous real crisis roughly every six months, testing whether lessons identified at the time had actually been acted upon. She said this mattered because of high turnover in cybersecurity functions, citing what she described as an average turnover of around 40 per cent a year in security operations centres, which she said meant lessons risked being lost if they were not embedded into process rather than left with the individuals who identified them.

Hargraves was supporting incident response during the SolarWinds Orion compromise in 2021, which she described as a supply-chain failure with dependencies across many systems that few organisations had anticipated. She said the episode underlined the need for organisations to complete business impact analysis in advance of a crisis, understanding which dependencies exist and what losing them would mean, rather than discovering that during the incident itself.

Organisations need to translate technical detail into terms the wider business understands, framing incidents around business outcomes rather than purely technical detail, so that leadership, operational teams and cyber specialists are working from the same account of events. She said this is only possible if the decisions and context behind them are captured as they happen, rather than reconstructed from memory afterwards.

“I think communication is one of the biggest cybersecurity vulnerabilities we have, because we are still siloing digital teams from the operational businesses,” said Hargraves. ” So perhaps we need to get a little bit better at positioning how we’re talking through a crisis and put it into terms of business outcomes, so we’re all talking the same language.”