Somewhere in the 219 pages prepared for the Surrey and Borders Partnership board meeting at Leatherhead on 14 October, the trust records that it achieved Standards Exceeded in the national data security assessment, passing all 47 audit items. Elsewhere in the same pack, a risk register entry describes possible patient safety harm from spreadsheets used to manage therapy and community waiting lists, with a proper waiting list function in the electronic patient record not due until December. Both entries belong to one trust, and together they describe a problem that extends well beyond Surrey. Digital ambition in NHS mental health services is being sequenced so that the visible tools arrive first and the unglamorous infrastructure follows.
Nothing in the papers suggests that harm has resulted. The risk has been revised with new controls, the trust has a date for the fix, and it has already moved the voluntary and community partners in its children's service onto a shared record, with two more to follow in January. That migration spares families from repeating their story and lets partner activity be reported systematically for the first time, which is what good sequencing looks like.
The newer additions are more fashionable. Ambient voice technology has been approved for clinical use, and a new AI assurance group is preparing an acceptable-use policy after reviewing early data on how staff use public AI tools. National guidance is clear about where responsibility sits. Outputs from ambient scribes must be checked and corrected before they enter the patient record. In mental health that duty weighs more heavily, since consultations turn on trust and capacity and ambient listening raises sharper privacy questions. The Royal College of Psychiatrists and NHS England were reported to be developing guidance specific to those settings, with publication expected by September. The regulator published its view on the medical device status of these products only on 29 July. A trust adopting a tool in that interval is acting sensibly within the national push, and is also carrying governance work that someone has to finish.
The oversight regime adds pressure of its own. Surrey and Borders sits in Segment 3 of the National Oversight Framework, ranked 36th of 58 mental health and community trusts, with access to services and patient safety both in Segment 4. The number of children and young people waiting more than 104 weeks has fallen to 1,464. League tables reward what they measure, and a waiting list held in a spreadsheet is harder to audit, more exposed to error and slower to become the data the framework scores. Executives under that scrutiny will favour interventions that move the metrics, and a note-taking tool that returns clinical time looks attractive. The plumbing beneath the list looks less so.
The same logic applies to the policy bet on neighbourhood care. The East and West Surrey alliance agreements before the board create no financial obligations for the trust and are not legally binding, and the alliance boards hold no statutory powers. They oversee about £4 million of delegated place funding across roughly 1.2 million residents, and the agreements will be signed months before the councils around the table are reorganised into unitary authorities in April 2027. Prevention at neighbourhood scale depends on partners who can see the same patients and the same waits, which returns the argument to shared records.
For NHS leaders, the practical step is to give each manual workaround a retirement date and an owner, with a board slot as prominent as the one given to AI. For policymakers, the oversight framework could score the quality of waiting list data alongside its outcome measures. Suppliers selling scribes into mental health services should expect trusts to ask for governance evidence before contracts are signed.
A trust can exceed a national security standard and still keep some of its waiting lists in a spreadsheet.
