In May 2021, a ransomware group calling itself Wizard Spider locked Ireland's Health Service Executive out of its own systems. Outpatient appointments vanished from screens. Radiotherapy machines went dark. Maternity units reverted to paper. The Conti attack, one of the most damaging cyber incidents ever inflicted on a public health system, forced the HSE into a rebuild it had spent years avoiding. Five years on, that rebuild has produced a national electronic health record programme, a unified cloud domain, a standing cybersecurity operations centre, and virtual wards now managing hundreds of patients at home. The HSE did not choose this path so much as have it chosen for it.

That distinction matters for anyone watching NHS technology policy from London. The English health system has its own history of digital ambition undone by circumstance, from the abandoned National Programme for IT to the 2017 WannaCry outbreak that cancelled thousands of appointments, to the 2024 ransomware attack on a pathology provider serving several London hospitals, which disrupted blood testing and contributed to at least one patient death. The pattern is familiar: legacy infrastructure, fragmented procurement, and a security posture that improves only after failure has already occurred. Ireland's experience is not a hypothetical case study. It is a preview of what forced modernisation looks like when a comparable system finally gets it.

The substance of the HSE's programme deserves scrutiny rather than admiration alone. Its electronic health record procurement has been years in motion and remains only partially live, a reminder that unifying patient data across a national system is a multi-year undertaking regardless of political urgency. The current government's ten-year health plan for England leans heavily on exactly this kind of infrastructure, betting that a single patient record and an expanded NHS App can underpin a shift toward neighbourhood-based, preventive care. Ireland's slower, harder path through EHR procurement is instructive about the gap between announcing a national record and operating one.

Where the HSE's results are more immediately persuasive is in remote monitoring. Virtual wards in Dublin and Limerick tracking cardiology and respiratory patients have removed thousands of bed days from hospitals already under strain, and the SMILE2 programme for patients with multiple chronic conditions has cut emergency department attendances and urgent GP visits by margins that would be transformative if replicated at scale in England. NHS trusts have pursued virtual wards with variable enthusiasm and inconsistent funding since the concept was formalised in 2022. The Irish figures give English commissioners a concrete benchmark rather than a policy aspiration, at a moment when winter pressure and elective backlogs make any credible reduction in avoidable admissions politically valuable.

The automation numbers matter for a different reason. Robotic process automation freeing hundreds of thousands of administrative hours speaks directly to the productivity argument now dominating Whitehall's approach to the NHS, where ministers have made clear that additional funding will be contingent on demonstrable efficiency gains rather than headcount growth. A health system proving that back-office automation can absorb some of that burden, without touching clinical decision-making, offers a lower-risk entry point than the AI diagnostic tools generating more headlines.

The clearest lesson, though, sits underneath the technology itself. The HSE's appointment of a permanent chief information security officer and its move toward NIS2 compliance reflect a system that treated a catastrophic breach as the trigger for structural change, not merely a one-off remediation. NHS organisations, still governed by a patchwork of trust-level IT maturity and inconsistent investment in resilience, face the same exposure that Dublin faced in 2021. The 2024 pathology attack showed that exposure is not theoretical. Ireland rebuilt because it had no alternative. England has the alternative of doing so before the next attack rather than after it, and the evidence from across the Irish Sea suggests that choice carries a measurable cost either way.

‍