Anaconda’s documentation addressed provenance, vulnerability management, and verification
Governed packages replaced one data scientist’s dependency reviews
About DBTH
Doncaster and Bassetlaw Teaching Hospitals (DBTH) NHS Foundation Trust is one of Yorkshire’s leading acute trusts, caring for more than 440,000 people across South Yorkshire, North Nottinghamshire, and surrounding areas. It runs three main hospital sites and is a designated teaching hospital, combining patient care with research, innovation, and digital transformation.
When Simon Newey joined DBTH as its first data scientist, his mandate was clear: build a data science function that improves patient care and operational efficiency. He quickly hit a challenge familiar to many healthcare organizations: how to build advanced analytics within the NHS’s strict security requirements. The answer was the Anaconda Platform, which gave the trust’s cybersecurity team a security foundation it could approve and gave analysts managed environments that can scale open source access across the organization.
The Challenge: One Reviewer, One Bottleneck
Like many NHS trusts, DBTH relied heavily on Excel and SQL for its analysis. Those tools served basic reporting, but not the statistical analysis and machine learning modern healthcare analytics demands. The trust knew Python would be essential for building predictive models, automating complex workflows, and supporting clinical decisions.
Open source came with real security concerns. The trust’s head of cybersecurity worried about software supply chain attacks and the complexity of managing dependencies, both threats to patient data and system integrity. The trust set up a manual vetting process that reflected its commitment to security. But with one data scientist carrying the full review load, that process set the pace for everything DBTH could build. It also kept the rest of the organization from using open source tools at all.
Newey felt that weight directly. “Security reviews are essential in an NHS environment, and rightly so,” he says. “But verifying the full dependency chain for every tool is genuinely complex work, and that time adds up. There were weeks where security review was as much a part of my role as data science itself.”
The stakes were high. Since September 2024, all NHS organizations must submit annual assessments against the CAF-aligned Data Security and Protection Toolkit (DSPT). The August 2025 release of Cyber Assessment Framework v4.0 explicitly requires healthcare organizations to secure open source software, including code provenance, secure distribution channels, and continuous security monitoring. Non-compliance brings mandatory audits and penalties of up to £17 million. US healthcare organizations face similar pressure around software bills of materials and supply chain security. Either way, this is a patient safety issue.
Why Anaconda: A Curated Source Security Could Trust
When the security conversation over open source access intensified, Newey went looking for options. Anaconda stood out quickly. “From pretty minimal searching, Anaconda was clearly the sensible way of accessing open source, [with its] emphasis on security,” Newey says. “Having a curated source where packages are vetted and verified is reassuring.”
Newey worked with the trust’s head of cybersecurity to focus on what the trust needed: provenance, vulnerability management, verification, and ongoing oversight. The Anaconda Platform’s curated, governed package repository addressed each one, and the documentation did the convincing. “I sent him Anaconda’s security documentation, which quickly satisfied him that this was a safe way to source packages,” Newey recalls.
The Platform’s governance supports the CAF-aligned DSPT requirements NHS cybersecurity teams work to, including the framework’s software supply chain security and vulnerability management outcomes.
The Shift: From One Person to a Team
Before, Newey was the bottleneck. With a curated, governed repository, the rest of the team can build in a safe environment without needing his constant intervention. “Anaconda allows us to keep our models running with fewer days performing manual security checks,” Newey explains. “Going beyond that, I’m hoping that allows us to roll out Python usage more broadly.”
As of writing, the rollout is still in its early stages. The goal is for developer teams to integrate external data sources, and for analyst teams to use the statistical testing toolkit Newey has built to answer causal questions that previously went unanswered, both under governance that satisfies DBTH’s cybersecurity requirements. Newey’s hope is that the software can reach people beyond Python specialists. “I’m hoping it will be possible for that software to be available to people with a less Python-focused skill set, and not require endless amounts of my time maintaining that environment for them,” he says.
That broader rollout supports a priority in DBTH’s Digital Enabling Plan. Under its Digital Workforce, Engagement and Culture ambition, the plan commits to a digitally empowered workforce with the skills to make the most of digital tools. The Anaconda Platform’s managed environments and training resources lower the technical barriers to open source adoption.
What’s Next: Analytics for National NHS Priorities
DBTH’s investment in secure, scalable data science infrastructure positions the trust to become data-driven and information-rich, using analytics to shape clinical care and support excellent clinical decisions. With governed open source access across teams, that capability can now grow beyond a single data scientist.
As NHS organizations nationwide work to become digitally enabled, DBTH’s experience offers a model: governed access to open source builds organizational capability as well as individual productivity. With the Anaconda Platform, NHS trusts can close the gap between cybersecurity requirements and analytical ambitions, turning data science from one person’s skill into a team capability that supports better patient care.
Want to scale AI from development to production on your own terms? Contact our team for a personalized demo.
“Anaconda allows us to keep our models running with fewer days performing manual security checks.”
Simon Newey
Data Scientist, DBTH
AI Artifacts
Vetted packages, models, agent skills, and MCPs your security team can trust.