The short answer
Plan for approvals in parallel with development rather than after it. Information governance, security assurance and integration access each take time that is largely independent of your engineering, and running them sequentially doubles the calendar.
Start the slowest one first, which is usually integration access from whoever holds the existing system.
What takes the time
| Activity | Typical driver |
|---|---|
| Procurement route | Framework availability and value thresholds |
| Information governance | Data flows, DPIA, approvals |
| Security assurance | Standards, penetration testing, evidence |
| Integration access | Incumbent supplier's timeline and fees |
| Clinical safety | Hazard assessment and sign-off |
The fourth row is outside your control and frequently the longest. Ask early, in writing, what the incumbent requires and how long they take.
Prepare the evidence once
- Security documentation and certifications, kept current
- Data flow diagrams and a DPIA template you can adapt
- Clinical safety documentation where the system requires it
- Accessibility conformance against the relevant standard
- References and prior implementations
These get asked for repeatedly, with variations. Maintaining them as living documents rather than assembling them per bid saves considerable time.
Design for their constraints
Public healthcare environments frequently have older browsers, locked-down devices, restricted network access and shared workstations. Software that assumes a modern browser and a personal device will fail in deployment rather than in testing.
Ask about the actual environment early and test against something representative. It is a common and expensive surprise.
Be realistic in the proposal
Timelines that assume approvals happen instantly are not credible to an experienced buyer and cause problems when they slip. A proposal that names the dependencies and says who owns each is more persuasive, not less.
It also protects you, because a delay in an approval you flagged is a shared problem rather than your failure.