Digital health
Fractional CTO for UK digital health businesses
A fractional CTO in digital health is an experienced technology executive engaged for an agreed part of the month to own technology decisions alongside the security, information governance, clinical and regulatory obligations those decisions sit inside. The commercial answer and the governance answer have to be the same answer, which is the part that catches founders out.
Digital health technology carries a constraint ordinary SaaS does not. A decision has to work commercially and also sit inside the organisation's security, information governance, clinical and regulatory obligations. I am Timothy Ng, and I have worked in digital health both operationally and as an adviser.
The role
Where a fractional CTO fits in digital health
Technology strategy that fits the regulatory environment
A plan the board can read, where the commercial priorities and the security, information governance and clinical obligations are weighed in the same decision rather than in separate meetings.
Architecture and platform decisions
Build against buy, hosting and data residency, integration with clinical and pharmacy systems, and what each choice commits you to once patient data is involved.
Development team and supplier oversight
Reading what an in-house team or a development supplier actually shipped against what was promised, and holding the technical standard on your behalf rather than theirs.
Security and information governance leadership
Someone senior accountable for the security posture and the governance work, so it is led rather than delegated to whoever has capacity that week.
Technology evidence for scrutiny
The material investors, enterprise customers and assurance processes ask for, prepared before it is requested rather than assembled under time pressure.
Scaling without splitting the two questions
Growth decisions on infrastructure, team and suppliers taken with their regulatory consequences attached, so nothing has to be unpicked later.
The general shape of the work, across every sector I take engagements in, is set out on Fractional CTO .
Governance
DSPT and information governance
DSPT is the NHS Data Security and Protection Toolkit. NHS England describes it as the self-assessment tool used by organisations with access to NHS patient data and systems to provide assurance around data security and the appropriate handling of personal information. That scope matters: it is not the case that every digital health company is legally required to complete it, and the honest first question is whether it applies to you at all.
DSPT replaced the former Information Governance Toolkit in April 2018. The framework has evolved since, and relevant organisations may now work to CAF-aligned DSPT requirements rather than the original assertion set. My own current work includes practical DSPT activity alongside GDPR and ISO 27001. I am not an accredited DSPT auditor and do not present myself as one. What I bring is senior technology leadership that treats the governance position as part of the technology plan rather than a form filled in at the end of it.
I also have earlier experience with the NHS Information Governance Toolkit, which is mentioned here as history. It is not a current framework and has not been since DSPT replaced it.
Fit
When this type of support is useful
- A founder-led health technology business with no senior technology leadership in post.
- A regulated product that has become commercially important and now carries real exposure.
- Development suppliers who need senior oversight from someone with no stake in the size of the build.
- Preparing for investment, or for the technical scrutiny an enterprise or NHS buyer applies.
- Security, information governance and product decisions that have become interconnected.
- A permanent CTO hire that is not yet proportionate to the size of the business.
Experience
Digital-health experience
- Chief Operating Officer, Now Healthcare Group, 2015 to 2020.
- Current CTO advisory work with Infohealth.
- Designing and developing a digital healthcare platform from inception to launch, combining remote consultations with doctor and internet pharmacy services.
- Current practical involvement with DSPT, alongside GDPR and ISO 27001, and earlier experience with the former NHS Information Governance Toolkit.
The full career history, sectors and dates are on Who I am . Client work is not described here in detail, because most of it is confidential.
Shape of the work
Fractional rather than full-time
A fractional CTO carries the same accountability as a full-time one, for an agreed part of the month rather than a salary. In a health business that usually means a standing slot, availability between visits, and named ownership of the decisions that cannot wait for the next board meeting. The wider UK picture is on Fractional CTO in the UK , the comparison with a permanent hire or an agency on Fractional CTO vs full-time vs agency , and market cost context on What a fractional CTO costs . I quote against the scope we agree after a first conversation.
Enquiry
Talk through the situation
Tell me what you are building, where it sits in the healthcare system, and what decision is getting difficult. I will tell you whether a fractional CTO is the right shape.
Send me a note
Sources and review
The description and scope of DSPT, and the April 2018 replacement of the Information Governance Toolkit, are taken from NHS England's Data Security and Protection Toolkit service pages, including its CAF-aligned guidance. Roles, dates and experience on this page match the career history on Who I am .
Last reviewed:
Not sure whether this is the right shape?
Describe the product, where it sits in the healthcare system and the decision that is stalling. If a fractional CTO is not the right answer, I will say so.