An infrastructure-level governance model for managing risk when care moves between organisations.
Because data can flow without safety — but care cannot.
The NHS Ten Year Plan places neighbourhood health at the centre of care delivery. What it does not address is the governance gap that opens when care moves between organisations.
Every time a patient, clinical signal, or decision crosses an organisational boundary, a handover occurs. Each handover creates risk — unless a small number of clinical governance conditions are made explicit and enforced.
This is the hidden hazard in distributed care. Not technology. Not willingness. Governance that stops at organisational walls.
The Seven Flows define the conditions that must hold for neighbourhood health to scale safely.
The Seven Flows framework for healthcare handover governance, clinical interoperability safety, and distributed care oversight.
The Seven Flows are a healthcare-specific governance framework for clinical handovers, interoperability, and distributed care delivery.
They define the minimum governance required to keep patients safe when care, data, alerts, or clinical responsibility move between:
The Seven Flows address questions that interoperability alone does not answer:
In short: Fast Healthcare Interoperability Resources (FHIR) enables data to move. The Seven Flows enable care to move safely.
Traditional clinical governance frameworks — such as the widely used Seven Pillars of Clinical Governance — focus on organisational quality, accountability, and continuous improvement within a care provider.
The Seven Flows address a different problem.
They describe the safety-critical information flows that must be governed when care moves between systems, teams, and organisations — particularly in interoperable, distributed, and digitally mediated healthcare.
Where traditional governance asks "Is this organisation delivering safe and effective care?" the Seven Flows ask "Can this patient safely move from here to there without loss of identity, consent, context, or accountability?"
The Seven Flows are therefore an infrastructure-level governance model, rather than an organisational quality framework.
Digital systems are very good at managing activity within organisations. They are far less effective at governing what happens between them.
When care crosses organisational boundaries:
These failures are not visible inside any single system. They emerge between systems — which is why they are so difficult to see, measure, or govern.
Interoperability answers one question: Can data move?
The Seven Flows answer the harder ones: Should it? Who owns it? And what happened as a result?
The Seven Flows are governance invariants.
They define the minimum conditions that must hold whenever care, data, alerts, or clinical responsibility move across organisational boundaries — regardless of:
If any Flow is missing, risk accumulates silently.
The Seven Flows are governance invariants. Each Flow defines a condition that must hold when care moves across organisational boundaries.
Who is this about — and who acted?
Ensures confident patient and practitioner identification across organisational boundaries.
Is this permitted — right now, for this purpose?
Ensures patient permission is explicit, portable, and enforceable across organisational boundaries.
Where did this come from — and can I trust it?
Ensures information lineage, confidence, and currency are visible at the point of clinical decision.
Why is this happening?
Ensures the purpose of access, sharing, or action is explicit and appropriate to care needs.
Who owns the next action?
Ensures escalations are explicitly assigned and acknowledged across organisational boundaries.
Where should this go — and why?
Ensures referrals and escalations reach the right service with appropriate context.
What actually happened — and did the episode close?
Ensures care episodes close deliberately and feed learning across organisational boundaries.
They sit beneath integration — making handovers safe without dictating how care is delivered.
The Seven Flows do not operate independently. They function as a set of reinforcing governance invariants that must hold together at each handover point.
Identity anchors who the handover concerns. Consent and Clinical Intent determine whether and why it should occur. Provenance establishes what can be trusted. Alert & Responsibility and Service Routing govern who acts next and where care moves. Outcome closes the loop, ensuring that actions complete and learning feeds back into the system.
When all seven hold, handovers are safe, auditable, and intelligible. When one fails, pressure shifts to the others — and risk accumulates silently between systems.
Interoperability focuses on movement. Governance focuses on appropriateness, responsibility, and closure.
Standards such as FHIR answer a necessary — but incomplete — question:
Can data move between systems?
They do not answer:
As a result, data can flow perfectly while care becomes unsafe.
This is not a failure of interoperability. It is a gap in governance.
The Seven Flows sit alongside interoperability — not above it, and not instead of it.
They ensure that when data, alerts, or decisions cross organisational boundaries:
In short: Interoperability enables data to move. The Seven Flows ensure care can move safely.
This is the boundary where neighbourhood health succeeds or fails — and where governance must travel with care.
From a clinical safety perspective, the Seven Flows address systemic hazard classes, not isolated incidents.
They target risks that arise between organisations, systems, and teams — where traditional safety controls are weakest and responsibility is most diffuse.
Specifically, the Seven Flows mitigate hazards including:
These hazards are rarely visible within any single system. They emerge at handover boundaries, often without triggering conventional incident reporting until harm has already occurred.
Rather than generating safety evidence after the fact, the Seven Flows make safe handover conditions explicit at runtime:
Auditability and assurance emerge as a byproduct of care delivery, not as a parallel governance burden.
The relationship between the Seven Flows and clinical safety hazards can be expressed simply:
| Flow | Hazard class addressed | Typical NHS scenario |
|---|---|---|
| Alert & Responsibility | Missed or unowned escalation | Remote monitoring alert breaches threshold but no team is explicitly accountable to act |
This pattern repeats across all Seven Flows. Each Flow controls a known hazard class that manifests during real-world handovers — not theoretical failures.
(A full mapping can be expanded where needed for safety cases, DCB submissions, or local assurance.)
This approach supports a DCB 0129 / DCB 0160-aligned safety posture across:
— without requiring system centralisation, workflow replacement, or wholesale platform change.
In short: the Seven Flows operationalise clinical safety at the point where risk actually arises — the handover.
The Seven Flows are applied at handover points — not to whole pathways or systems.
They should be made explicit whenever any of the following occur:
The Seven Flows are not required for:
They are invoked when governance matters, not when activity alone occurs.
If something can go wrong between teams, the Seven Flows should be explicit.
When governance travels with care, the difference is structural — not procedural.
This is not optimisation. It is basic clinical safety made dependable.
The Seven Flows are implemented as governance infrastructure that sits beneath existing tools — not as another system to log into.
| Flow | What it governs | Risk it prevents | Typical NHS moment |
|---|---|---|---|
| Identity | Who the patient is, who acted | Misidentification, misattribution | Cross-org referral, record matching |
| Consent | Whether sharing is permitted now | Unsafe disclosure or restriction | Community ↔ GP information exchange |
| Provenance | Source, lineage, confidence | Decisions on untrusted data | Shared test results, AI outputs |
| Clinical Intent | Why access or action occurred | Alerts without purpose, data drift | Monitoring thresholds, reviews |
| Alert & Responsibility | Who owns the next action | Unowned alerts, missed escalation | Virtual ward alerts, abnormal obs |
| Service Routing | Where care should go — and why | Patients bouncing, lost context | Referrals, escalation routing |
| Outcome | Whether the episode closed | Safety loops left open | Discharge, monitoring completion |
FHIR lets data move. The Seven Flows make sure care moves safely.
How the Seven Flows enable system oversight without centralising care.
How ICBs use the Flows →How governance protects teams at handovers.
How providers use the Flows →How alerts become safe escalations.
How monitoring uses the Flows →Healthcare does not fail because clinicians don't care.
It fails when responsibility, intent, and outcome are left implicit.
The Seven Flows make them explicit — and make neighbourhood care governable at scale.
This is governance you can reason about — before harm occurs.
Talk to us about your handover risk