An Empirical Analysis of the "Red Queen Effect" in NHS Cyber Assurance

Supplementary materials for: Shabad, V. (2026) "Beyond Compliance: An Empirical Analysis of the 'Red Queen Effect' in NHS Cyber Assurance and the Case for Ecological Rationality." SSRN Working Paper. https://doi.org/10.2139/ssrn.5643210 A revised version of this analysis is also under peer review at an academic journal. Contains the complete analytical pipeline (Jupyter notebook) and source data for reproducing the statistical results of the revised version of the analysis: a cross-sectional analysis of NHS Trust financial returns (2023/24) paired with DSPT compliance outcomes (2024/25) for 169 trusts in England (105 compliant, 64 not), using Welch's t-tests with Cohen's d effect sizes (validated with Mann-Whitney U), chi-squared tests for categorical associations, and multivariate logistic regression assessing total staff costs against compliance status, controlling for Foundation Trust status and organisational type. Version 3.0.0 corrects the cohort and updates the classification file. Two trusts (Cambridge University Hospitals, University Hospitals Birmingham) had been linked to unrelated register entries with the same city name, so the cohort is 169 trusts, not 171. DSPT records are now restricted to the NHS Trust sector before linkage, and the notebook checks that the register code of every linked trust equals its ODS code and stops if it does not. The classification file is now version 1.1 of the NHS Trust Classification Dataset. The notebook states the date of the DSPT register export it uses, because published statuses can be revised. No conclusion changes: staff costs do not differ between compliant and non-compliant trusts (p = 0.88) and remain non-significant in the adjusted model (OR 1.001 per £1m, p = 0.42). The SSRN working paper, as posted on 24 June 2026, reports the results of version 2.0.0 (n = 171), which remains available. The full list of changes, with the old and new results side by side, is in CHANGELOG.md. Files File Contents md5 Supplementary Material.ipynb The analysis: linkage, cohort, tests, regression, Table 1 data, Figures 1 and 2. Executed, with its outputs – nhs_trust_classification.csv NHS Trust Classification Dataset, version 1.1, unchanged d284b33f9c55ed661d1eaa324a588773 DSPT search results 03_01_2026 13_58_38.csv DSPT register export, 3 January 2026 4c0882cfac695c9c24ad9ac664e90498 TAC-data-published-in-NHS-trusts-accounts-for-2023-24.xlsx Trust Accounts Consolidation, NHS trusts, 2023/24 5e6a242cae290019585f86fe3b16ae82 TAC-data-published-in-NHS-foundation-trusts-accounts-for-2023-24.xlsx Trust Accounts Consolidation, NHS foundation trusts, 2023/24 63fbdb7a423e3bbd3c492e5d4e9caf8a CHANGELOG.md What changed at every version, and why – Reproducing the results Put all files in one folder and run the notebook from top to bottom. The results in this record were produced with Python 3.14.7, pandas 3.0.3, NumPy 2.4.6, SciPy 1.17.1, statsmodels 0.14.6, Matplotlib 3.11.0 and openpyxl 3.1.5. The first code cell installs the packages the notebook needs. The DSPT register changes after publication. Results depend on the export date, so the export of 3 January 2026 is deposited here. A later export can give a different cohort status for some trusts. Data sources NHS England. Data Security and Protection Toolkit: Final status reports 2024/25. https://www.dsptoolkit.nhs.uk/OrganisationSearch (accessed 3 January 2026). NHS England. NHS providers: Trust Accounts Consolidation (TAC) data publications. https://www.england.nhs.uk/financial-accounting-and-reporting/nhs-providers-tac-data-publications/ (accessed 4 January 2026). Shabad, V. (2026). NHS Trust Classification Dataset (England, 2023/24), version 1.1. https://doi.org/10.5281/zenodo.22056700 Earlier versions Versions 1.0.0 (9 February 2026) and 2.0.0 (20 June 2026) are unchanged and remain available under their own DOIs, listed on this page. Licence CC BY 4.0.