Equality and Social Justice Committee

So, for the first of our sessions on data justice and the use of personal data by the Welsh NHS, I'm very pleased to welcome Chris Carrigan, who is an expert data advisor for Use MY data, as well as Dr Robert French, and who are both here in the Senedd, and Ann John from Health Data Research UK, who's joining us online. So, welcome to all three of you. And I just wanted to start off by asking if you could just give me a summary, briefly, on how well healthcare data in Wales is being collected and used at the moment. As we've had a paper from Use MY data, do you want to say something very briefly? We've got your paper, obviously, and is there something, a headline, that you want to tell us?

I think, interestingly, the headlines tend to work across the UK as well. So, there is a significant amount of health data that is now being collected that wasn't collected before. If you look at the entirety of data that is collected about us as individuals to manage our healthcare, only a small amount is actually used for healthcare planning and research, particularly because a lot of it is recorded in ways that are either difficult to understand from a research analytics perspective, or inaccessible in terms of it sitting in different places and isn't linked together very well. But I do think you have in Wales, and had for many years, a research environment within the Secure Anonymised Information Linkage Databank, which brings those data together and which has really driven research at a national level far more quickly than other parts of the UK. So, there's a real asset there that I think can be built upon.

Other problems tend to be shared across other parts of the UK. So, there's a general lack of understanding among people about how their healthcare data is used—it's difficult for a patient to understand what is in their healthcare data because, by and large, they can't see it all—and a lack of understanding among the public about the real benefits that usage of healthcare data for the NHS, for planning and research, can bring. What the public tend to hear are largely negative messages about data loss, data hacking and risk, and therefore that engenders the perception of the public that data is something that maybe can't be trusted, when actually we want to move the agenda forward to something where it says, 'Data can be trusted. Use it in the right way and we can really use it to save lives'. I do think Wales is in a really strong position to be able to build on what SAIL has done for many years in bringing together data for research, more so than other parts of the UK, which tend to be a little behind, I would say.

Thank you for that excellent summary. We'll just move over to Sarah Murphy, who's got some questions for you.

Thank you very much. It’s really good to have you here today. I’m really pleased that we’re doing this inquiry. I’ve been having a look through your website and some of the projects and things you've been doing, and I was particularly interested in the national opt-out project, I suppose, or system, that was created in England. My impression has been that, in theory, obviously, it sets out to achieve all the aims of what you would like to see, which is to promote the benefits of sharing and using data to improve patient outcomes, but also the safeguards against that mistrust, I think. So, from Wales, looking at what happened, it looks like the intention was there, but maybe the execution wasn’t ideal, and there has been some trust that has been lost, which has meant that people have opted out. So, it would be really useful for us to hear today from you how that happened, I suppose, and what you think are the pros and cons, and where we are with it now, because, obviously, most of this happened back in 2018, and anything we can learn from, I guess.

Shall I start? So, I think you're right—it's a very good summary. In England there is a national data opt-out, so, as an individual you could go on as an English NHS patient with your NHS number onto a website and you can decide whether you want your data, your confidential patient information, to be used for research and planning. It's a pretty simple yes/no. Now, on the one hand you think that's quite a straightforward way of working, but, of course, the nuances and complexities about how health data is used in a variety of settings with various safeguards is very different. So, how to encapsulate something into a very simple message when the answer is quite complicated can be difficult. So, I think, first of all, the concept about giving people a choice about how their health data is used outside of their direct care is very good. There's no doubt about that. That's certainly what people want. How you describe those choices to people, and the choices they can actually make, and the impact of those choices, is a much more nuanced, much more difficult thing to communicate, and I think that's where there are some of the lessons we could learn from how England have done it to how it gets implemented in other parts of the UK. There are some good lessons to be learned on that. By and large, choice is a good thing. It does engender trust. But around it goes the whole issue of things around transparency. So, if I want to make a choice about how my health data is used in Wales, I would love to know what's in my health data, where does it go at the moment, who can use it, what are the safeguards, where do patient voices sit around understanding those safeguards and making sure that organisations use them correctly, what choice can I make and what's the impact of the choice, and, around that, what are the benefits of using healthcare data rather than just the risks.

Excellent. Thank you very much. Who'd like to add to that?

Just to add to that, firstly, on whether people know what they’re opting out of and what they get with the opt-out, I think a lot of people would think, ‘Right, that means my data’s not used for anything other than clinical care’, when, actually that’s not quite the case, and I think there’s a real chance for Wales to do something much better than we’ve seen in England. I think it’s a smaller country that has better communication, possibly. So, I think there are more benefits that we could illustrate from the data sharing that’s already happened.

And the second point is that the English model is quite a blunt tool—you’re in or you’re out, and there might be things that, really, you don’t want your data shared for, because of something to do with you, or perhaps a data user that you don’t want to use the data. So, you end up opting out of everything because of this one simple yes/no. I think those are the two points I’d add.

Thank you very much.

Sarah, could you—? Ann John wants to come in on this point.

Yes, of course.

So, I just wanted to highlight—. I’m a professor of public health and psychiatry at Swansea University. I also am a co-director of DATAMIND, which is a mental health hub in Health Data Research UK, and the mental health lead of Administrative Data Research Wales. So, I did really want to highlight what a flagship SAIL is for the secure storage and safe use of data. So, in many ways we have learned the lessons over the years of how to make data available for service planning and research in terms of patient and public benefit. I guess the real lesson to be learned is about having really meaningful public involvement. If you look at any of the initiatives through HDR UK or other organisations, that’s the thing that makes a difference, and that happens on many different levels. So, on the one hand, we need to have a whole-public campaign about understanding what we mean when we’re talking about the use of data and how data is stored. So, within DATAMIND we’ve developed a data literacy course because, often, researchers, policy makers, NHS staff and the public are not all talking the same language. There's lots of evidence out there about what the public feel comfortable with and don't feel comfortable with, and I think there are lots of conversations to be had around that.

But, as well, we need to involve the public in the meaningful design and use of data. So, they need to be involved in all of the bodies that are approving data for research and use. I think there are lots of ways we respect the public's rights about the use of their data, but also inform those conversations. I think the reason why this is so important is because we saw really clearly during COVID that trust is one of the fundamental issues upon which people make these decisions. Often, it's the most vulnerable, marginalised and underserved—you know, the very people we want to do this work for and with—who will be the people who opt out, which basically means they stop having a voice. So, I think it's going to be really important to do that work at a population level, but also very specific work with underserved populations.

We've recently done a piece of work looking at the mental health needs in routine data. I do a lot of work in SAIL with the Gypsy and Traveller community. Us data scientists worked with researchers who have really strong relationships with those communities, and then we worked with the communities themselves. I think, once you embed that in how we're working with data, the insights for everyone are huge.

How reliant is healthcare research on good-quality data, and what's needed to ensure that data is reliable and sufficiently comprehensive so that you are able to predict these disease patterns?

Well, it's a mix. When you're working with data at scale, there are real relationships between looking at trends, looking at how things are changing, looking at how people are accessing services—from that planning and delivery to discovery science. However, routinely collected data is not collected for research purposes, so I think it's really important to understand the strengths and weaknesses of the data that you're using. So, within HDR UK and ADR Wales, we do lot of work in SAIL to understand how we're finding people and what it means. What we've found with certain populations, and we've seen it a lot during COVID, is that the poor quality recording of ethnicity data was a real issue. I think, as we use this data more, we have to also be doing the work to understand where people are represented and where they aren't. Within HDR UK, there's what they call the 'phenotype library'—an innovation gateway—where researchers from across the UK share those insights. So, I think it's really important that, in the doing of this work, particularly when we start using more artificial intelligence and more innovative analytical techniques, that people understand what's there and what's not, and that we combine that with work to improve the data quality.

Yes, thank you very much. Just my last question, then, to—

Chris Carrigan, I think, wants to come in.

Right, sorry. Yes, of course.

On your question about the opt-outs, you asked whether there were any lessons to be learned. I should have said that if you were a patient in England, the first thing you heard about data usage, which initiated the opt-outs, was in the media, because there was a whole void of information about how health data gets used. Negative news stories went in the media and then lots and lots of people—millions of people—chose to opt out. That's happened twice now in England. So, the lesson to be learned here is: be active about the ways you communicate to the entire population about the benefits of the use of health data. Don't let the first thing they see to be bad news about health data, because that's very difficult to recover from.

Absolutely, I agree. I can see you nodding as well, Ann. Just the last question that I was going to ask you, then: what evidence is there that public trust and confidence in data sharing varies depending on the organisations with whom the data is being shared? Can you provide any examples? We've talked about how we can lose that trust, but are there any in particular that patients like and trust?

A very good resource, to give you the evidence—this is the web resource that was brought together by Understanding Patient Data. What they did was pull together whole sets of research. Essentially, there are no surprises here—the further a person gets away from their treating clinician, the less trust they have in who's using their data. So, high trust in GPs and then hospitals, and then academia, universities, and then out to commercial companies. So, the level of trust goes out like that, so it drops off. People trust commercial organisations less than they trust their GP practices to use data, which is probably what you'd expect.

I think the answer to some of those things is to address what commercial organisations or universities do with data. What data do they get, what are the safeguards, what are the checks and balances? Where's the patient voice in understanding whether that's the right thing to do, and what are the benefits that we intend to see or have seen from the uses of data across the pathway? That's really where you begin to build public trust in different levels of use of data by different organisations.

Thank you.

Just to follow on from that, my specific research is on type 1 diabetes and young people, and we did a session last year where we had 80 young people come in and we did workshops with them, and we asked that very question. So, we listed a bunch of different organisations and, 'Could you rank them?' and 'Would you be happy to share, or would you not be happy to share?' Of course, there were certain ones, with your hospitals, your clinicians and so on, they were very happy, and other ones, they weren't happy. Chris mentioned the usage, and once we explained different uses—that a teacher might have their data, or someone from the council, all of these different uses—they could start to say, 'Well, for that purpose, yes, I'd be happy'. So, I think the purpose is critical and then that follows on from that point of transparency about saying what we're going to use the data for and who's using it and why. There were certain uses—we always talk about commercial companies as one that people are sceptical of, but I think when the transparency is there and the explanation of what they're going to do with that data is clear and the public benefit that arises from it, I think people can be more supportive.

Excellent. Thank you very much. Thank you, Chair.

Thank you. The NHS has long had quite a complex process of permissions before people can do research on randomised control trials and that sort of thing and it has felt to researchers quite bureaucratic and really extensive to-ing and fro-ing, but how has that system, which that has long existed, well before the digital years, helped us navigate this difficult path between personal data and the good of society and understanding better why some people are affected by a particular disease, rather than another?

I guess there's a lot to that question, but, in my experience, I've been working with data linkage or linked data for about 10 years, but since 2016, I've been trying to actively link data and bring in data from different people, and that process takes a long time; it can take a couple of years to get some data sets linked, and then you do your analysis. So, I think one of the things that the patient groups were really surprised at was the time it took to do it and the effort and the resources just to link data—data that they support for uses that they support. So, I think the challenges are there. COVID has made a difference for certain research and people's perceptions, but I don't think it has necessarily sped up non-COVID research, from my perspective, at least.

Okay. Ann.

Just a quick return to the last question, and I'll say something about this one. So, in that communication, I think one of the really important things—people want to trust that their data will be used safely, and the concept of trusted research environments or secure data environments is something that we really have to communicate and that those environments are reading libraries rather than lending libraries. So, it's not that data goes out to people. So, we operate under a thing called the 'five safes', so you know that the data protects confidentiality concerns, it's safe data; you've got safe projects, so they're approved by data owners for public benefit; safe people, so the researchers are approved; safe settings, so that's that environment; and safe outputs that get screened. I think that's really important.

There is absolutely no doubt, and I've worked with data for many years, that, for certain types of data, the approval processes can take so long; it's a huge barrier to our learning and to how responsive we can be to what's happened. Now, there are really good governance and approval processes out there that we can learn from. SAIL is a flagship—it absolutely is. So, in Wales, we are slightly ahead of the game in terms of how it can be done well, and I guess one of the general principles for me, if you think about general research, so trials and things, eventually, we set up a much more simplified—the identification and referral to improve safety programme, a centralised application process, and I think that's what we need to move towards. That work is being led, in many ways, in Health Data Research UK through their data and analytics research environments programme and different programmes. So, I think we need to be moving towards one process. Sometimes, you're applying to all sorts of different places, so streamlining those processes in the way that has happened within SAIL I think will be a huge step forward.

I just wanted to pursue, really, the state of data management in NHS Wales, because obviously, somebody with a chronic or acute illness doesn't want to be telling their story 65 times, but equally, there will be different organisations involved, so the GP, the pharmacy in the community, and then, secondary and tertiary care services. And if they're not talking to each other, we still have some practices where people are still sending that 'dear Doctor' letter, either to the hospital consultant or back to the GP in a paper form. So, where are we at on this, and how much is it about people using different systems that they've always had, and they're not talking to each other?

You're right, in that the more systems, the more technology and computer systems are involved in the process, the more difficult it is to bring that data together. So, SAIL, for instance, has brought data together retrospectively to facilitate research. So, from a personal perspective, my data is somewhere in the Welsh healthcare system. It's quite often going to be within the SAIL database linked with other parts of my different data—primary care, secondary care, for instance.

From a personal perspective, I'd actually quite like to see that, because it comes back to one of your earlier points around can you trust the data; is the data good enough to be able to be used? Well, I would argue, and the members who've used my data—the patients, relatives and carers—would argue that the best person to look at whether the data is correct, complete, accurate, and consistent, is probably the patient, because they sort of know a bit about their own health, and at the minute, they're the last ones in the equation about being able to get access to their records.

So, huge amounts of effort that SAIL have done over the years to bring data together for research, which is fantastic, and being built upon, as Ann said, all the time. What I don't yet see in the equation is where an individual fits within that. So, all the money is going into research, technology, big research environments. Very little is actually going into being able to facilitate me to see what is in my full health record. We've tested with some of our members, where they've had to write freedom of information requests and things to hospitals and to GPs; huge reluctance for them to release their own data to them, and eventually it happens and it's pretty difficult to understand. But we couldn't, in the three cases that we've tried, bring together the data from all the different places that your data exists, so it's really difficult from a personal perspective to see what's in my entire health record, whereas all the technology, all the impetus has been put into bringing the data together retrospectively to drive research, planning and improvement; not for me to be able to manage my healthcare. And I think that is beginning to shift, but it's very slow, and I don't see an end point that I could answer to say, 'When will I be able to see my own healthcare record?' I couldn't answer that, but I could say, 'When can all my healthcare data be ready for research?' Yes, you could definitely see that.

Okay. But it is a complex issue, isn't it, because a GP might want to write on the notes for the benefit of their colleagues, 'This patient can be aggressive', or something like that, which you wouldn't necessarily want the patient to see.

And I think there have to be safeguards—I mean, what I was talking about was a generalisation. But, from a clinical perspective—and I'm not a clinician, by the way—there would have to be safeguards where certain data would be held back because it could put me at risk as an individual. So, I think that's quite true, and that isn't an easy job for primary care particularly to do.

Okay. Robert.

If I just give some specifics from my research, then, in terms of the data quality, I think the audit data, the diabetes audit data, that's collected to produce reports and so there's a feedback loop there, where the data is constantly improved. So, each year, they try to do tables of which clinics are doing better, and so on. And so, they feed back to the clinics and the clinics improve their data. So, there's that way to improve that data. So, that data is of the highest quality. For the GP data, so we were looking at the number of appointments, contacts and so on, I think we cover about 80 per cent of GPs in the SAIL data at the moment. So, there's not complete coverage there. There has been a project to try to improve that coverage in SAIL, but I don't think they were able to actually increase it that much; I'm not quite sure what the barrier is there. And then, I think for the out-patient data, that wasn't particularly high quality for the diabetes appointments and picking that up. So, I think there are definitely data quality issues that are affecting research, but I'm not sure what the solution is or what—

For the benefit of the general public, could you just explain what 'SAIL' is, because this word has been used a couple of times?

Yes. So, you can think of it as a data repository or a place where people can access data, and the mechanism they use is that data comes in, but rather than using people's name, date of birth, postcode and NHS number as the identifiers, that's actually sent separately to another organisation, Digital Health and Care Wales, who actually then process those identifiers and get rid of all the identifying information and use a pseudo ID to then link that data set to all the other data sets they hold, and so they've got all kinds of hospital data, GP data, education data, social care data, and so on. So, they're able to link those without compromising people's privacy.

Thank you. That's very useful.

I'd like to add to that—

So, Ann, what role does your organisation, or indeed, coming back to our witnesses in the room, what roles are you playing in helping to improve transparency for the individual patient, but also streamline access to important data to enable us to treat people more effectively?

So, for SAIL, which is based at Swansea University but covers Wales-wide data, I think it's really highlighted how important it is to have that linkage across organisations. And that helps our learning. So, we did a study where we linked education and mental health data, highlighting the levels of mental health need in those with high levels of absence and exclusion. So, there are real lessons across settings that we can learn. Welsh Government has invested in the development of the national data resource, which will basically share information efficiently and securely between health and care organisations in Wales. That's a project under development and I think you're going to hear more about that later on today. I think you highlighted a really important point. So, I do lots of self-harm and suicide prevention work, and that concept of people in distress having to tell the same story over and over again is something where these sorts of united data systems can help us improve the quality of care in relation to that telling of stories over and over again, but also the sharing of information from one area to another. So, I think that's really important.

In terms of HDR UK, HDR UK is a national institution across the four nations that was funded by a consortium of UK funders, and they basically have done a lot of work in terms of how to design those sorts of trusted research environments, of which SAIL would be considered one, and secure data environments. There has been a massive investment in secure data environments in England that are about bringing those health and social care organisations, their data, together. So, within HDR UK, they've got a couple of—they've got the pan-UK health data research governance group so that we can both learn from where it's working effectively, and SAIL has massive presence there because it's worked so well, but also DARE.

I think that within Wales we can build on what we've done really well, but also need to be part of those UK conversations, for two reasons: (1) for learning, so that we can all piggyback off each other in terms of how to do this effectively, but (2) within SAIL we have a depth of data. We've linked across health and social care organisations, Ministry of Justice data, but our population size makes that—. We all talk to each other, and I think that really helps in terms of making these things happen, but for some of the questions, we need to be looking at UK-wide data. I think we need to really think about breadth across the UK and depth within the nations. We can't all do this in isolation, I guess, would be my major message.

One of the things we're doing in DATAMIND, because I think we've talked about—. The public are relatively comfortable—there's been lots of research done, and we've done it with people with lived experience of mental health problems and self-harm—with people in the NHS and academics accessing their data for public benefit, so long as it's effectively anonymised. However, there's an issue with industry and trust in industry. Sometimes, some of that is about understanding how that would happen. So, one of the things we're going in DATAMIND is a lot of PPIE work. There is a strong patient and public involvement, both in HDR UK and DATAMIND. We've got an industry forum and we're developing a data literacy course so that people from all sectors can try and have those conversations from a common ground. One of the things we found when we first started was that even the idea of profit is not something that's understood in the same way across the public, academics, NHS and industry. So, I think that real active communication and involvement is going to be fundamental going forward.

You were asking about two things: one is around transparency and the other one is streamlining access and what we at Use MY data do. As a reminder, Use MY data is patients, relatives and carers. That's it—that's the movement. We brought their voices together in terms of the transparency question and developed a set of transparency standards, which were written by patients. Really positively, HDR UK were one of the first organisations across the board to pick those transparency standards up and they built those into their ways of working, as have many other organisations across England, Scotland and Wales. So, that was patient voices coming directly to the question about, 'How can we be transparent? What sort of things should we be doing?' Then we went a step further and developed something for organisations that use our data, a position statement that's titled, 'What we expect of organisations that use our data', a set of principles, a set of practical things that we as patients would expect them to do. It's nothing earth-shattering. It's just pretty common sense. It's largely, 'Say what you do and do what you say' and the things around that.

We also developed a patient data citation, which was using patients' own words—a citation that said, 'This was only possible because it used patient data.' I can't remember the exact words, and I will get a ticking off for not remembering the exact words. But it's very simple, and it goes on the bottom of reports, of a presentation, of a slide—anything that just begins to build the knowledge in the public that none of this was possible without the ability to use patient data. So, that's around the transparency agenda.

On the bit about streamlining access to data, that was why Use MY data was formed, because many years ago, access to data for researchers stopped after a scandal media story. That's why Use MY data was formed, explicitly for that reason, and that's at the heart of what we've tried to do.

The last thing I was going to mention is that Ann mentioned the data literacy course that they're doing within DATAMIND. We do similar things with Use MY data, but for patients, members of the public, relatives and carers. We run education sessions for our members, about a whole set of data topics. We also run patient-focused webinars where we bring people together to answer the difficult questions, like the last one, 'Does the NHS sell my data?', which was the title of the webinar. We brought together the people from across the UK that hold the data, that allow the data to be used, and examined the question, 'Does that mean that you're selling data?', and we answered those questions directly. So, they are some of the practical things you can do with patients, relatives, carers, members of the public, which are actually doable, and we've seen huge strides in bringing people's voices to those agendas and making a significant difference to the organisations who hold our data, who want to use our data and want to do the research, to try and unblock some of the barriers that we don't think are sensible.

Very good. At the most basic level, if I'm away from home and I lose my glasses or I break them, I don't want to be searching around for a little card that I get given at the opticians; I want to be able to go to the nearest shop and say, 'Give me some glasses so I can get back on the road'. Most people do use mobile phones that are capable of having an app that tells you about the basics. Where are we at on that, and what are the barriers to enabling people to carry data that could save their life, in some cases?

Rob can come in on this as well, but from a technology perspective, mobile phones are all over the place. Not everybody has them—and I think we need to be careful not to ignore the ones who don't have these—but if people do have them, then, by and large, you've got the ability to hold the app, an NHS-related app or, indeed, other apps on the phone that would let you see part of your record. I know lots of our members carry their own health records around them on the phone, in notes or a PDF document, because of what you just said, because what's in the app isn't complete. I do think technology could play a large part in helping you use your health data with whoever you see, wherever you see them, but it needs to be reliable. But we cannot afford to leave behind people who don't have access to that, otherwise we're going to serve a group of people, but increase inequality for others. I don't know whether Rob wants to say anything.

I agree with that. I mentioned before that type 1 diabetes is my specialist area, and I think with that, a lot of people will have devices and so on that are connected to their phone, record their health data. They're absolutely used to sharing their data. They might go into a consultant appointment and download their information. So, I think that's already possible, and that is the way things will hopefully progress. I don't see it being a technological limitation; it's more about, as you mentioned, digital exclusion for those who perhaps haven't got the devices or perhaps people who don't want to share their information. Maybe it's more about societal and people's perspectives and the transparency of what will happen to that data and so on, and a trust issue, perhaps, rather than a technological issue.

Ann, obviously you're an expert in patients with mental health challenges. They won't want everybody to know about something that's happened to them in the past. How do you, in your research, ensure that it's on a need-to-know basis and no more?

There is a sense that people feel that mental health data is more sensitive. Some of that is to do with stigma; some of that is to do with the fact that when you're taking a mental health history, you're asking much more personal details than sometimes you would ask in a physical health history. However, the patterns are really similar. People trust the NHS, they trust the people involved in their direct care, they trust academics. There can be a bit more mistrust with industry. But I think it goes back to that active involvement, transparency and engagement at all levels, and communication with people, and that has to go hand in hand. Often, mental health problems are much more common in those from our more deprived communities. So, when we're talking about these advantages, these innovations, we really need to also be doing that—as well as the communication, as well as the technology development, addressing digital exclusion. That all has to be hand in hand. And by that, it's not just access to devices; it's access to Wi-Fi. There are lots of those programmes and initiatives happening, but we really, really have to be mindful of that when we're talking about any of these initiatives.

I know that Jane Dodds wants to come in on this, but just quickly, Sarah, you had a question.

Just in the interest of transparency, can you talk us through who funds you?

The only funded part of Use MY data is the people who work in the secretariat. At the minute, there are three of us in the secretariat, all working part time. We've had funding over the years from organisations such as Cancer Research UK, Public Health England and others, and organisations have supported us as well. HDR UK gave us some funding to support us with meeting rooms, because we don't have an office. We always put the funding on the website. There's a full set of funding organisations and history on the website as well. The key thing is the funding we receive means we can still be independent. NHS Digital, now NHS England, provided funding for our co-ordinator role as part of the secretariat, but it was a hands-off grant. They just said, 'We're happy you're working in this area, but we don't have any control about what you do and what you say'. In fact, we've been one of the organisations that has worked hardest with them to improve their transparency as well. But that's where our funding comes from.

Thank you. Here it says NHS Digital and NHS England, Health Data Research UK—who, Ann, you work with—Bowel Cancer Intelligence UK, and previous funders have been DATA-CAN hub for cancer and Cancer Research UK. I suppose the point that I'm making is—and, Ann, you made this point really well earlier on—about the money and how much money is being put into all of these systems. I think what's becoming clear is that, disproportionately, money is being put into systems about the research and promoting the data for collection for research, because, ultimately, that's where the money is. The money is in using our data for research, whereas we're hearing that with the systems in our GP surgeries, people are having to submit freedom of information requests to see their own data, they're having to send in forms to be able to see it. The systems that are there to actually improve the patient's clinical experience, as well as safety, the money is not being put into. We're way, way behind. But then the money that NHS Digital in England is putting into other things, including your organisation, can you see that that might come across as disproportionate?

I think from a patient involvement perspective, it's very difficult to find somebody to fund that sort of work. Within individual research projects—Rob's is a good example—part of the project is to do with involving patients. But, quite often, it's quite a small part, and when it's finished, it's finished. Those patients, those people that have been involved, sort of don't have anywhere to go. So, whereas we can develop our research community as a whole, it's quite difficult to develop a public informed community as a whole. That's much more difficult.

There are some good examples where significant money has been put into proper at-scale involvement. The one I would quote is in London in England, where they've put a significant amount of money into it, involving patients and the public particularly in conversations about data. They took 100 patients and worked with them for several weeks and months in several sessions to begin to build their knowledge, and that became a really useful resource for them. Scotland are currently doing exactly the same thing with a group of 25 people—a select group of people that Ipsos MORI, I think, selected for them. They've been working with them for several months to equip them with the knowledge to have a better understanding of data, to be able to get their voices to be more effective in terms of policy making and other things. That sort of investment, I think, is often lacking. That's part of the reason why we exist.

Absolutely, and I feel that, Ann, you said this as well. All of you have highlighted projects, but very small numbers of people who are getting this data literacy and being taught how to do this. I would probably argue myself—and Ann, I know you want to come in, if you've got any thoughts on this—that, really, it's more of a political, citizen and societal decision that we have to make about where this money goes—does it go into improving our systems for our care, and then we can start using it for the research? I also have real concerns that the data that is being collected—as you said, because we can't check it ourselves—is even accurate. Do you think we're maybe putting the cart before the horse?

What I would say is we shouldn't be separating them. There's a lot of evidence out there that shows that research-active organisations providing care provide better quality care. So, I think the dichotomy shouldn't happen. I think it's important to do the research, I think it's important to have—. There's a real capacity issue in data science—people who have both the programming skills, the data skills and the domain skills. I think, on that cross-over between care organisations and research organisations, I think we need to bring them closer rather than pit them against each other.

In terms of what you were specifically highlighting, in research, the reason why there was a lot of investment in doing work with patients and the public is because both the funding organisations and the people who publish the work made it a criterion. So, even if you weren't inclined to do it, you had to do it. Most of us are very inclined to do it because it has so many benefits. And I think there has been a lot of investment in the digital transformation of the NHS and care organisations, but that emphasis on having meaningful involvement of the public needs to come from the people funding it. And then it becomes very much a part of everyday practice. I wouldn't think of starting a research project without having those discussions. And so, I really think you need a bottom-down and a top-up approach in terms of meaningfully involving the public. But I do think that there shouldn't be so much of a gap between research and the NHS, because they improve each other constantly.

Thank you. Can I bring Jane Dodds in?

Thank you very much. I will ask my questions in Welsh. Ann has touched on this earlier—that is, inequality in the data field. And I just want to ask more about that, please. Does the health data that are collected represent the population as a whole? That's the first question. And are there any gaps that exist, and what are the reasons for that? Are there any initiatives to address those gaps? Thank you. I don't know who wants to go first. Ann, do you want to go first?

So, absolutely there are gaps. When you're working with healthcare data, we know that people do not access healthcare data in the same way. We've got the inverse peril. So, there are people that you see and people that you don't. However, there's lots of work being—. I guess what I would say is that more of the population has that contact with services, whereas when you're asking people to participate in research, that can be quite a burden. So, they may even be less represented. There are lots of movements at the moment about improving the representativeness of women in trials, or people with protected characteristics or ethnic minorities. So, research as we had it before wasn't ideal. I think the breadth of routinely collected data does capture people and gives them a voice, but it's not perfect. So, I'm always really conscious when I'm doing research in schools, or looking at schools data, there are lots of young people who aren't in schools. And so I think you have to be conscious of that. So, basically, researchers—. There are movements now at a national level that researchers need to be thoughtful and consider equality, diversity and inclusion both in the people that they're directly working with and within their data. And what you're finding now with lots of journals is that they're asking you to explicitly state how representative your data is. Now, when we're working with routinely collected data, we do lots of work where we take that data and we link it across to smaller subsets that we know are more accurate. So, we recently did some work looking at childhood maltreatment in hospital and GP data, and we linked it to a small, anonymous link—so, privacy protecting—to a health child protection data set, so that we could look at who was there and who wasn't there in both data sets, and both have weaknesses. So, making sure that the infrastructure and funding highlights that that work is being done, that we don't just run away with what's in front of us, I think is the way forward, and HDR UK does lots of work in that field.

Thank you very much. Is there anyone in the room who wants to respond to that as well? Anybody in the room wanting to respond to that?

There was a problem with the translation earlier, but I assume you've picked up what the question was from the answers.

So, it's just gaps in the data rather than any specific gaps.

Yes.

So, in my data, we've got population coverage, because we know people who are diagnosed with type 1 diabetes and then they'll be in the data. But, of course, people might miss appointments year on year and not turn up for annual reviews, and so on. Because we've got that population level at the start, we know who's in and who's not attending. But, in general, when you do your statistical analysis, you're looking for averages across a population, and so there tends to be a tendency to get rid of that data and not worry about those people who aren't attending, and so on, and you get your answer for the average across a population and you can publish on that. And it takes an extra bit of work to go and actually think, 'Well, what's happening with this group?', and it can be an afterthought, because you're not so incentivised as a researcher to look at those. So, I think it's great that there are researchers like Ann who then try to dig a little deeper and try and find those subsets. And we've had the same experience with our engagement activities as well. So, I mentioned before that we tried to recruit people last year, and it was a real challenge to try and get people from lower socioeconomic status areas or different ethnicities, and so on, and it took an awful lot of extra work, and we had to work with another agency who helped us target those populations, and that all cost money and time. So, I think, both at the research level and the engagement level, there are big challenges and it takes a lot of extra work. It's perhaps not well incentivised in your regular research.

I'd really like to strongly concur with that. I think one of the weaknesses of the system as it is now is that there are small pockets of short-term funding to do this work and then you lose touch. So, I think it's really important to understand the resources it takes to reach underserved groups, but also work out the ways to make sure they have a voice in the data and in all the work we're doing across care and research. So, I think having consistent funding to do that work and keep people engaged—. And, for lots of these groups, you have to do that work in communities. You have to build relationships with the community leaders in those areas. That comes both from a perspective of trust in use of data and for people from those communities to not form the majority of people who opt out, but also for the development of our understanding of where the greatest need lies, so that we do that work across the population, the greatest good, but also where the highest need is.

Thank you very much. I have another question about developments in services and whether there is any impact on that. So, is there any evidence that the availability of data is driving developments in services that lean more towards certain conditions or certain groups of people rather than smaller, other groups? Thank you.

I could go first on that.

Okay, go ahead.

Absolutely—there is absolutely no doubt. So, both within services and research, if you look at the funding amount leveraged for mental health research, and also the funding of services, we do not do very well compared with people with cardiovascular disease or cancer. MQ, the mental health research charity, did a report a few years ago that showed how wide that disparity is. So, I think it's important that those things are built into all research, and so, if you're doing research in cardiovascular disease or you're looking at services, that you consider equity and mental health problems.

Thank you for that. Just to be clear, you're saying that that affects the services as well. So, the research affects services, just to be clear. Thank you.

Absolutely, there's evidence that shows that, where research is very active, and data research as well, that improves the care for people, historically. I think things have changed a bit in the last five years, but we've got our historical underfunding of both mental health services and mental health research, and that has an impact. There was a report that came out from Birmingham five or six years ago that showed, across the UK, if you wanted to make up for the underfunding—it was always known as a cinderella service—in child and adolescent mental health, you'd need 150,000 new practitioners, and we don't have that. We're not going to have that. So, that both highlights the issues that you're talking about, but also highlights the concept of prevention, and I think linking across different services and different sectors—the data—is where you can really inform that prevention initiative.

Thank you very much. Back to you, Chair.

Do either of you want to add—? If not, I'll move on to other colleagues.

I suppose I would just add that, from a data perspective, where the data has existed over time, that's where you generally see more research. Without the data, it's difficult to do research. You mentioned cancer and cardiovascular disease. We've had cancer registration in Wales for 40, 50, 60 years now, so the data goes back a long way and it's always been an essential driver of research. As we've got more data that has been generated and collated more effectively, that has begun to see research improve into things like mental health, through charities such as MQ and other things, which I think is a positive thing. So, it's a bit of a chicken-and-egg, in a way. If the data doesn't exist, it's very difficult to do the research, and if you're not in the data, you're not in the research, and if we've got groups or characteristics of people that aren't represented in the data, then they won't be represented in the research and you won't see research innovations implemented across healthcare that improves people's care. So, it's a bit chicken-and-egg. I think the key point is to make sure that the data is there, and then that begins to drive research and, suddenly, people become visible. I know it's very simplistic, but it's actually quite true. So, the emphasis on your individual healthcare records and putting investment into that pays benefits for ongoing research as you move down the line.

Thank you very much, Chair.

Just to talk about how things feed back, it is obviously a challenge. You do some research and you want to feed back. So, in type 1 diabetes, there are 14 paediatric clinics across Wales, and we had lots of information about who was doing better in different domains, but it wasn't considered a good idea to name clinics and say, 'This clinic's doing this really well,' or not. We tend to pick up things like, 'These smaller clinics are doing better,' so it's characteristics of the clinics rather than actually naming them, and I think there's a fear there that if we say too much about what different clinics are doing, they'd be less willing to share data and less willing to improve on data. So, I think there's a risk there that if people think they're being evaluated, ranked or anything, they might be less willing to share the data. And I'll just add the example of audit as well; so not specifically research, but where data's collected for audit and that feedback loop. I think that's a very successful model that overlaps with research.

You've opened up a can of worms there. Sioned Williams, can I bring you in? And you can either run with that, or go on with the other questions you have.

Yes, thank you. I wanted to ask questions specifically about e-prescribing, because systems such as e-prescribing could operate across primary, community and secondary care. It has been seen in Germany for a long while, since 2009, and in England since 2019. So, what are the potential benefits and concerns, considering what's been happening in those countries and the evidence that we have from those countries? And what can we expect to see in terms of benefits and concerns when it does come to implementing it here in Wales?

I thought Ann was best placed to pick that one up; my expertise is not directly in e-prescribing. I think, in terms of the principles, the ability for something like e-prescribing to span primary care, secondary care and community has been beneficial to patients; there's no doubt about that. Equally, what we've seen in England is some of the data that gets generated can actually therefore be used for research. The only question comes down to: where does the data sit, who controls it, who determines what research is important or what gets done and what are the safeguards? And that's all about transparency and including patients and the public in that conversation. So, I think e-prescribing is an interesting example, where it does span multiple traditionally separate sectors of primary care, secondary care and community for real benefits to patients, and actually there can be real benefits to drive research as well.

I'd completely agree with that. So, if you are working with e-prescribing data within that 'five safes' environment, where you've got all the things that we've just talked about there, then the risk of re-identification is really low, and, if you're working within those secure environments, then you're reading the data; you're not lending it to people. So, I've worked a lot with primary care prescribing data in mental health, and the benefits can be huge. So, back in 2015, we looked at antidepressant prescribing in children, and we were able to highlight which ones had increased; we were able to highlight the age groups antidepressant prescribing had increased in, we were able to highlight—. So, NICE guidance says that children—and most people, in fact, but children is what I do—should have talking therapies for mild and moderate, and we were able to look at how many were accessing that. The first-line therapy is an antidepressant called fluoxetine. We were able to show whether that was the one that was being prescribed in the first instance. For older adolescents, it wasn't, and so both the Welsh mental health tribunal and also Welsh Government issued guidance about prescribing.

So, there are huge opportunities both to improve care, but also potentially to highlight where there are risks in prescribing things together. So, I think it's going to be a really important innovation. The weakness we have within SAIL at the moment in the work that we do on prescribing is that we don't have access to secondary-care prescribing. So, in mental health and many other conditions, that's really important, because it highlights the different contexts. There are certain drugs that will only be prescribed in secondary care, and it's important that, when you're both looking at improving patient care and looking at long-term outcomes, you understand all of that. So, I think so long as e-prescribing operates within those five safes, it will be a good thing.

Thank you. What can we do to ensure that that happens, therefore? What should the Government be doing to ensure that it does operate within those five aims of safeguarding? And I like to ask also whether there are any specific areas of concern around e-prescribing. For example, could it be used to monitor adherence to a programme of medication, when they take that medication et cetera? And also, just considering the journey of that e-prescription through primary care and secondary care, is there going to be a reduction of anyone's voice within that process—for example, the pharmacist looking at something that's come from primary care, from the GP, thinking, 'I'm not entirely sure about this', and in the same way when that goes on for example to secondary care, a doctor in the hospital, or a pharmacist in the hospital, thinking, 'I'm not entirely sure about this'? And also, what's the voice of the patient in all of this? If we have one smooth system, I do understand that there are a lot of benefits, but of course there'll be more prescribing happening.

Very good. Sioned's connection to the meeting is imperfect, but I think we've all heard what Sioned's questions were, even though we can't actually see her saying it. Who'd like to start on this? Anybody?

Go on, then. [Laughter.] As a non-medical person—. I think there are some basic principles based on what the question was. I think you started by asking could data like this be used to monitor adherence to a particular protocol. So, to a degree, yes; to a degree, no. Whatever data is there can be used for lots of different purposes. So, can you clearly say that somebody—if they'd been administered a drug, a prescription, are they going to take it? Well, you don't know that. So, there are questions around that. But you could certainly say that, if drugs have been prescribed, if prescriptions have been made and if the data is being held and managed centrally, that's there for analysis and research. That then comes down to the governance—the information governance rules, the data-sharing rules, the protection rules, the data access rules, all of which have been defined for years and years and years across the NHS and research to be very clear to say that not just any old Joe can get the data. There are huge restrictions around ethics and security before anybody gets access to the data, from a research perspective, and, when they do, by and large they can't see who a person is; they just see numbers in their data. So, there are whole sets of safeguards around that, and maybe we've not explained that well enough to the public, what those massive safeguards are. A researcher has to jump through hoops to get access to the data—months, years sometimes—and then sometimes wait another two years to get the data. So, there are huge safeguards around that that maybe we haven't communicated well enough to people. I suppose that would be my overarching perspective.

Yes, I would really agree with that. So, when we're looking at prescribing data, we're looking at what was prescribed. That doesn't even mean that it was dispensed and given. You'd have to link to the dispensing data. Then, even if the drug was dispensed, that doesn't mean that someone took it. But, if you think back to those 'five safes' principles, if people are accessing this data through that sort of environment, confidentiality is protected, so you can't identify individuals. The projects are safe. So, those projects have been reviewed by the data owners and a good way of working in that information governance framework is in SAIL, where members of the public are also involved in the approvals of those projects, that they're for public good or benefit. Then you've got the researchers. So, the researchers need to be trained and accredited to use the data safely within the confines of that project. And then they're in that trusted, secure lab—so, it's a reading library; it's not a lending library—and then the outputs are screened before a researcher can even take them out of the environment. So, those protections, those general principles, protect against some of the concerns that you've said there. Within SAIL, we never do anything that can be interpreted as feeding into performance management, and so when we present our data we might say there's variation across geography—rural, urban, health board—but we don't know which health board it is. We don't know those things. But what you can do when you present the data in that way is learn from best practice: what worked well, what outcomes were best for patients. But you want patients and the public to be involved in what those outcomes are. So, in mental health, we might be interested in mental health and well-being, but patients are interested in their sleep and eating. So, I think all that work has to be built into the process.

Altaf Hussain, did you want to come in?

Yes, thank you very much, Chair. I think I have a few questions, really, but I'll make it short, Chair. I'd heard of the commission, and my concern has been always about the reliability and completeness of the data, really, and the clinical data, especially when it's not verified by the patients. So, you have clinical data, you see the patients, but the patient has no access. He doesn't know what you have written and what you have seen. And then you go and you do the research. That research is always selective, because you have an idea. Now, that does not make it very uniform—that uniformity we were talking about is not there. So, you're selective, you want to have research on this, and then you come up with some evidence, and then you put it into clinical use and then you don't do any audits. Audits would have made it evidence based. We go for research, we have technologies, but we never come up with those results and apply them. I remember, as an orthopaedic surgeon, we would get many of these implants in their pockets, and they would show it to the orthopaedic surgeon and we would apply them, without knowing what the results would have been. In a 90-year-old, people would be doing operations on the hand when it was not needed, you see. So, we have problems, and we know that no two patients are alike.

Leaving that aside, really, my important question is: what impact, if any, do you see the timed culling of digital records having upon a patient's health data? You are developing now the health record. Do you have to cull them? And if you are doing that, what will be the effect of that? Because, I know, in the clinic, when I wanted to have a case note of a patient, they would tell me, 'Oh, it's not there—probably it has been culled.' Gosh, how can you do that? Now, about the data which is there, which will be, what are we going to do if you're going to cull it?

Okay, we're running out of time. You may have gathered that Mr Hussain used to be an NHS surgeon. Who wants to go first? Robert.

When you say 'cull', you mean if someone's not got the right data quality and we're cutting them out?

Yes. You'll have so much data.

Yes. So, what I'd say, in most research, it actually doesn't matter too much. In AI and other things, they almost don't care about data quality at all. They just let the model run, and that's almost part of the predictive power. So, I'd say it almost doesn't matter. If you're looking for average effects, then it probably doesn't matter if some people are missing from the data. It might if they were people who have something different about them, or there's a reason why they're missing that is relevant, but typically it generally doesn't make a big difference, I'd say. That's why people who are using these massive data sets aren't really that fussed about these things, and it actually takes researchers like Ann to say, 'Well, actually maybe there's a reason those people are missing, and that reason might relate to their health and be important, and so we need to look at that group,' but I'd say, on average, for the majority of research, people are happy to let those cases go. Ann, you'll probably want to come back on that.

Okay. Ann, did you want to come in first?

Yes. So, lots of research was based on small populations, so addressing that patient average using large-scale data sets is great. It gives many more people a voice. When we start talking about new analytical innovations and artificial intelligence, at the moment, what the concern is is that, because we do have issues with data quality, some of those biases may be enhanced. It's not always the case, but I think—. At the moment, for me, if we deploy AI technologies that will impact on patient care, they need to be seen as health interventions and they need to be trialled.

So, there was a frailty index that was analysing data on primary care to try and prevent admissions. So, it would highlight who was frail, who might be highly likely to be admitted as an emergency patient. So, they just looked at those who had been flagged and saw that admissions reduced. That's great. But then, when they looked and analysed the data at an all-patient scale, they found that those who hadn't been flagged, their admissions increased. So, there can be unintended consequences. I think these things need to be properly evaluated, in the way that we would a drug treatment or anything else. If things are going to directly impact on patient care, we need to see them as interventions.

Thank you very much. Mr Carrigan, do you want to say anything, finally—thirty seconds?

I suppose in terms of the data side—artificial intelligence was just mentioned—we're now on the cusp where, if we look at our children and younger people in this country, they're generating data about themselves, whether it's on fitbits or apps, or whatever. They've got a digital footprint that's going to be there that we've never had. Now, the data is going to get huge, massive, massive—beyond all recognition. The only ability to use that is through things like artificial intelligence. That's a whole new world about how you involve people and the right things to do, the ethical things to do. So, I think, maybe for a future session, you want to think about how we're only scratching the surface of the potential for uses of data. It's going to be huge, and hasn't yet been talked about enough with the public, I don't think. I'll finish there.

Thank you very much indeed. This has been a fascinating session, but we have come to the end of our time. So, thank you very much. You'll all be sent a transcript of what you've said, and please use it as an opportunity to correct any inaccuracies. Otherwise, we thank you very much indeed for your attendance today.

The committee will now break until 13:30, but I'd be grateful if Members could come back at 13:25 so that we can just have a brief conversation, but to involve Ken Skates as well.

Welcome back to the Equality and Social Justice Committee. We're now going to have our second session on data justice and the use of personal data in the Welsh NHS. We're very pleased to welcome Rhidian Hurle, executive medical director and chief clinical information officer for Digital Health and Care Wales, and your colleague Ifan Evans, who's the executive director of strategy, as well as Darren Lloyd, associate director for information governance and patient safety. Thank you very much indeed for your written evidence, so, you don't need to repeat that, but just to start us off, I wondered if you could just tell us briefly how well is healthcare data in Wales being collected and used at the moment.

I'll start and then I'll bring in my colleagues, if I could. So, I have a clinical role as a consultant surgeon in Bridgend, and I've been working in Wales since 1995, and I've seen a progressive increase in the volume and availability of patient data for the delivery of care to the point that now, I can see every single citizen's GP record, with their consent, and I can see every single blood test everywhere in Wales. I can see every single x-ray done everywhere in Wales from a laptop, either remotely or within the hospital. That has delivered massive benefits in terms of reducing duplication, starting conversations with patients on what matters to them rather than trying to validate their history, accurate medicines reconciliation, reducing harm by being able to see things.

So, there's been a progressive journey through an all-Wales, once-for-Wales approach that has delivered benefits to over 35,000 of our healthcare professionals across Wales. In addition to that, there is process information that has been collected through a patient administration programme, which is allowing us to understand who's presenting where and allows us to facilitate the development of services in terms of service redesign. Now, to do that, we've built on some foundations that have come from policy and from the previous organisations and their collaborative approach with the Caldicott Guardian network across Wales, and the cyber-security approach that we've taken collaboratively across Wales to ensure that data is securely shared along the patient journey. And I'll bring Darren in first just to talk about the information governance model that has allowed us to do that.

Okay. Darren, unless there's a burning issue, I suggest we leave your remarks to the questions that I know Members will have.

That's fine.

So, thank you very much for setting out the scene and the extent of the progress to date. I'll hand over to Sarah Murphy.

Thank you very much. So, we've just heard from the previous panel that, in England, they introduced this national opt-out mechanism, and it wasn't managed, really, in the best way that brought patients with them and that trust with them, and it did result in a lot of patients then opting out. They also described it as being quite a blunt tool in terms of it was simply an opt-out, and that was it—there wasn't a kind of description of what you could and could not opt in and out of. So, I was just wondering, is there a similar mechanism in Wales? If not, why not, and if so, how is that being communicated to the public?

That national opt-out in England was a policy position, basically. It wasn't required by the law, i.e. the general data protection regulations; it was a policy position that came from the national data guardian's office. So, Rhidian referred to the Caldicott Guardians within Wales, and the Caldicott Guardian report from, originally I think it was 2006—no, 2016, sorry. So, the opt-out model was something as part of that national data guardian's review.

The ability to opt out then came, within England, as quite a far-reaching ability for patients to actually opt-out for many, many purposes for their data. It subsequently got reduced right down to aspects of research and other aspects of use of the data that fell within something called section 251 of the National Health Service Act 2006 in England—not in Wales, of course. In Wales, we have different regulation and different law that allows that to happen. So, it was a policy position. That was the position in England. In Wales, we have slightly different ways where opt-out may be applied, where the law requires that to happen under certain circumstances. There isn't a direct policy position within Wales under those circumstances currently.

And would you say, then, that that's a political decision that hasn't been—?

Yes, because it's not a lawful decision required under those aspects of the law. That opt-out, like I say, is policy rather than law.

Excellent, thank you. The previous panel, as well, was very much explaining to us the benefits of having people opt in and having this data for research purposes. We actually heard, in one case—Altaf brought it back to having a patient and not having their records available, and we were told that, from a research perspective, that's not a big deal, to have people missing, or to have, maybe, the records not completely up to date. But, from a patient perspective, obviously, that really is vital. So, I just wanted to ask: how confident are you that the data that you have access to—everything that you just described then—is accurate and readily available? Especially in light of the case of Manon, who was the young woman from my constituency, Manon Jones, who passed away because her records weren't joined up. The coroner found that, actually, there is a risk that future deaths will occur unless action is taken. So, they said that the records weren't available for her care, and also, it wasn't entered all into a single clinical record.

And then, on top of that, Health Inspectorate Wales, just three weeks ago, undertook an inspection of the discharge arrangements of adult mental health wards at Cwm Taf, and found, again, that not all staff have access to the records that they need to, and some of them are only 'read-only'. They've set out recommendations 19 and 20, so the health board must continue to provide HIW with updates on the plans to implement the unified patient clinical records system, and they also have to mitigate against any risks associated with staff access to clinical records. So, at this moment, I suppose, what I'm asking is not so much now whether the data can be used for research, but for the everyday, for the patient, for the treatment that you're able to offer and staff are able to offer. How confident are you that the systems are all joined up, and that everybody has access to what they need to be able to do?

Pardon me for saying there's a lot in that question. Let's start with the process of enabling an individual who's a healthcare provider to have access to those systems, and they are robust. So, there is information governance training and the single unique identifier, and what we call a 'national active directory and exchange' identity, to use the applications that are provided by Digital Health and Care Wales to get access to the large amount of information that's held in the care repository, in the image repository and the results repository.

The complexity of the legacy of the healthcare record, as you can imagine, is a difficult one to solve. There's a paper record, so, in some situations, that is lost, destroyed or scanned, and then there's digital yesterday, so that's been created in systems that aren't joined up and labelled in a way that they can be exported and therefore safely collated within the digital record. And then there's digital today and digital tomorrow. So, if you bring all those together, the confidence that the record is complete—I can't be confident as a clinician, and I believe my colleague here who was a clinician will tell you that medicine is full of risk and assumptions, and the history from the individual and those who care for the individual. However, the situation has dramatically improved, as I outlined at the beginning. The fact that I can see things now that I couldn't see five years ago is a benefit to those individuals. We have a strong plan for the delivery and integration of the systems that are used across the health boards. And I might bring Ifan in, if I can, because the strategy is how do you connect all those systems.

Absolutely. Timelines would be great, or some kind of idea, because, obviously, this is risking lives, as we've heard from the coroner.

If I could, I'll just say something briefly about the role of Digital Health and Care Wales as part of the wider system. So, as a statutory organisation, we're relatively young, established 1 April 2021, but we've built on predecessor organisations, NHS Wales Informatics Service and, over the last couple of years, we've also taken on some major digital programmes that were in the hands of other parts of the NHS in Wales. So, we manage the core national infrastructure, let's call it—so, data centres and the main connectivity. We manage everything for GPs—so, their desktops, their printers, the software that is on those and the connections between them—and we manage the majority of national systems that are in use—for clinical use, anyway—in secondary care. There are some things that we don't. So, the Welsh ambulance service delivers certain digital services, and the shared services partnership also delivers, particularly, administrative—finance and HR—and prescribing, actually, as things currently stand. We work very closely with the NHS organisations to do that, but, ultimately, we are providers of platforms and services and digital tools that are used by clinicians in the field, and mainly by clinicians. Our integrated medium-term plan for next year—which has just been published, and our board will be considering it later on this week—does demonstrate a shift towards or beyond the hospital walls, to some extent. So, there's more emphasis on primary and community care and mental health, and also on direct access for patients.

But there are years before we will have a comprehensive, fully accurate and all the history and timely digital health records. The NHS is data-rich and information-poor from a digital perspective. There is a lot that is still on paper, and there's a lot that is on paper before it reaches the digital record, because digital information has to be inputted by someone somewhere. So, we are working very, very hard on it and I think you can see from the IMTPs that we've published—we are a very transparent organisation now compared to previously, because we're a statutory organisation—how much more, or how much progress has been made in the last few years. And COVID did accelerate that; not that we would have wished the pandemic to have happened, but it did accelerate certain things, and we're setting out very clear plans for where we want to go, but working closely with Welsh Government and with others to do that.

Okay.

Can I just further add that the access to the systems within a health board are controlled within the health board? So, staff access is something that we facilitated in terms of the belts and braces, in terms of security and information governance and identity, but the actual access is allocated by those employing the staff.

That was going to be my next question, then. So, at the moment, if I want to make an e-appointment, do an eConsult for my local GP, I have a load of questions that I have to answer, including things like, 'Have you ever had an abortion, and when did you have that abortion, and how did you have that abortion, and who knows that you've had that abortion?' So, you're giving that information over in an eConsult, and then you press the button and you send it off, and you have no idea who sees it; it's irrelevant to—usually—what you're getting in touch about; it should already be on your medical records; you can't complete the form without doing it—I've had people explain this; you can't complete the form without providing that information. And I understand that to give your data and all the things—I understand all the benefits, I really do. And obviously, that is not illegal in our country, but there is still a huge stigma associated with it. And how do I know where that's gone? How would we know who has access to see that? What if there is actually somebody working in the GP surgery or in the local pharmacist or in any part of the NHS—? Like you said—. So, you said the employer decides who sees it. Shouldn't it be the patient who actually has a say as well in who sees that? And I guess, at the moment, as well, I suppose that, as you said, there are a lot of people who are able to see all of this, and I totally understand it is in the best interests of patients as well that you can, but shouldn't people be able to see their own health records at this point as well? Shouldn't this be happening, like, at the same time, and, if it's not, is this a question of funding? Is the funding being put into the kind of e-prescribing and the joined-up from the clinical side, but not been giving that parity of funding to bring it up to date? So, as we heard, you've got patients having to submit FOIs to see their own medical records. I know a long question there again—

Yes, so I apologise—

—but you can see what I mean.

Yes, absolutely. So, a few things I'd like to just split up between my colleagues, but I'm going to start with the e-advice. So, Digital Health and Care Wales do not provide an e-advice directing to patients. So, whatever the application that was being used is supported by a health board. So, that's the first thing. We as an organisation provide through the Welsh patient referral service the ability for general practitioners to seek advice electronically in a two-way conversation. That includes a summary of the record. There are certain elements of a record that, if identified, are sensitive. There's legislation around those. We use the ability of break glass in elements of the sensitivity. Also, our record is fully audited in terms of who looks at what where. So, in a subject access request, which is something that you're referring to, in a paper world a subject access request can never include who looked at your record, because that paper was in the system. In a digital world, we, within Digital Health and Care Wales, provide that facility. So, that's a safeguarding element, which has allowed us to develop trust with our key partners who are sharing information, particularly, initially, primary care, and we can provide that.

I'm going to bring Ifan in, if I could, about access to the patient record.

Yes. I'll say something about the NHS Wales app, which has been—. So, it's a modern digital application and we're very grateful to colleagues in NHS England for sharing the code base of the NHS app in England with us, which they did just over a year ago in November 2021. Around a year on from then—so, this would be last autumn—we've run a managed private beta programme where we've been testing the functionality that is in that app with around 1,000 users from 10 different GP practices, using different combinations of access to the record, access and control of what people can see in that record. So, we have a lot of that functionality, which works in a test environment. We're not committing to hard dates as to when that will be into the full, live application, but certainly this year we're going to be making quite significant progress, and that provides very granular control for individuals, through the app, to choose what they share with whom, including family and carers and others, and also to be able to see who has looked at the data that they have shared, and potentially there may be a tool that helps them to navigate the record, because the data of who has looked, there's a lot of it, and you don't want to look through a long spreadsheet, and so you can do some analytics on that.

It's been quite interesting to get the feedback from the users in general, and there are 1,000 users, so let's not draw too much from it. But in general they are very willing to share access to their records, including their own provided contributions to the records, and they take an interest in who has seen aspects of their records, particularly when they have let's call it a live treatment case, because they can see the progress of that case through the health system. So, that's very encouraging, that it does provide that engagement with the health record, which is what we want—patients to be interested in their data. It helps to validate, but it also helps them to own and to manage their condition. So, again, to manage expectations, that is not going to be immediate, but it is in the foreseeable future, because we've got workable functionality, and it is mainly focused on the data that comes from GP systems at the moment, but our ambition is to use that same platform to put in-patient and secondary care information and medicines, for example, which is part of another programme, into that same record.

Excellent. Okay, thank you. If I can just ask one more, but I can come back to it later if we're running out of time.

Go ahead and ask it, then.

I have asked this before—it was when I met you in front of the Health and Social Care Committee—but about open-source data as well—. Because, obviously, we heard in the previous panel again how rich this data is and how it can be used to come up with better treatments and to reach people who maybe we aren't reaching and there are a lot of benefits to it. So, I was just wondering: is there a policy or a look to the future in terms of making it open source so that it is more equitable for universities and researchers?

There are different types of information. Personal identifiable information, of course, is not. That is for the direct delivery of care. We as an organisation have the skill to pseudo-anonymise and anonymise data that could be used to add value to the individual, to the family, to the village, to the region. We have a risk appetite for that within our IMTP, that we want to extract value that improves the general health and the individual population health, particularly with certain chronic diseases in terms of promoting self-management and awareness. Previous experience from other nations would suggest that if you jump too rapidly down certain areas you get unstuck and you lose the trust of the patient and the citizen. Our approach is to build trust with our key partners, particularly patients, and, in the fullness of time, with the delivery of a data promise, we should be in a position to have an informed conversation across the citizens of Wales.

Okay. Fantastic. Okay. Thank you very much. Thank you, Chair.

Thank you. Altaf Hussain.

Thank you very much. It's great to listen to you, really, but there's a distinction between the clinical data and the investigations that you're talking about, imaging and other things, which are irrelevant now. No two patients are alike, and we need to keep that in mind. Now, users will be concerned about the security of the data. How confident are you that it is secure? And my concern would be also that there's increased collaboration with social services care. Do you think it will create any challenges, or it will be good for patients to have these two things together?

Okay. So, apologies, I'm not a cyber security expert; I'm a clinician. Ifan, I'm sure, will be able to tell you about our strategy for cyber security, but we haven't got cyber security expertise in the room. And often, actually, we don't discuss cyber security in a public forum, for obvious reasons.

In terms of joining up the care, the delivery of a health and care record should be available wherever the patient presents. It's not a context-specific thing. It's not a GP surgery; it's not secondary care, tertiary or some community care. It should be available. The building blocks to deliver that care are dependent on identifying the individual, ensuring that the individual understands the legislative arrangements around it in terms of their information governance training, their understanding of how we as an organisation are looking at them looking at their data, and the fact that that individual should be aware that, at any point, we can challenge that individual on what they're looking at.

The complexity with social care per se is that it's a blended approach for both those that are employed by the public sector and those that aren't, and your movement of an individual may go through a private care home, which would have different nuance and problems than—. Ultimately, though, if you give the patient the control of their information, then they, through their choice, can decide who they share it with, when they share it. So, there are options there.

That's great, yes. My concern has been always about the data—clinical data especially—and how you obtain it, because patients never verify it. What do you think about that, and about the NHS app? Will it be helpful to the patient, and will he be able to access his whole record on that?

So, focusing on validation of data is common practice; in fact, it's the best practice for a clinician delivering care to write to the patient at the end of the consultation. That isn't very much of a change from the start of my career to the end of my career. That gives the patient an opportunity to challenge the clinical record. So, I would say that's a very positive thing. Access, as was highlighted, to the content, the summary of the GP record, will allow validation by the patient of that. Of course, we're moving into a world of more structured data, more coding. We have a commitment to deliver SNOMED coding across our systems, which gives us an opportunity to expose that data in a way that it can be understood to patients.

Thank you very much. My last question is: with the inherent security risk presented by outdated, often proprietary software, what assessment have you made about the benefits of moving into open-sourced systems for all the NHS software needs?

I'll bring in my colleague. [Laughter.]

So, I'll say something about cyber security in general. So, Rhidian's response was about security of data; cyber security—we'll call it the security of systems and the security of our network. Digital Health and Care Wales hosts the NHS Wales cyber resilience unit on behalf of Welsh Government, and it's an agency for using the UK-wide NIS regulations—network and information services regulations—which includes self-assessments of cyber security frameworks, and then stepping up against those. So, we work very closely with all of the NHS organisations in Wales, and others, because we have a highly-networked system. We have a single active directory for all NHS staff across Wales. We have lots of systems that span national and local services, and we're only as strong as our weakest link. We put a great deal of effort into that through boards, with independent members, and with others.

On the question of open source, open source has cyber vulnerabilities in just the same way as proprietary software has. In some ways it's more challenging, because with proprietary software, any large company, like Microsoft for example, will have a very large team that are guarding against cyber resilience, and they'll be issuing updates and patches very, very rapidly to make that software secure as soon as something is identified. That happens routinely across all industries, whereas open source sometimes does not have the same, so you have to consider what your support mechanism for open source is.

There are elements of open source, I think, that we are very keen to embrace, in particular around standards. If you look at emerging healthcare data standards over the last two or three years, they are open source in that they are not licensable to use, like openEHR, the open electronic health record, and others. We don't use raw open source systems that much at the moment. We use open source languages for development and for coding. We use open source standards and have a preference for open source standards. But before we can use open source software packages at scale, we have to think very carefully about how we develop the required skills and expertise, because we wouldn't be able to draw on corporate partners in the way that we do for commercial software. But it is something that we're very conscious of and keen to explore.

Thank you, Chair.

Very good. Can I bring in Ken Skates?

Thank you, Chair. I'm going to ask about data engagement. First of all, how do you engage with patients—not just inform patients, but how do you actively engage with patients and the public in developing and using data?

If I say something about the app, and I'll also cover the national data resource. For the app, we've worked with the Centre for Digital Public Services and others, and we've run a private beta in order to engage with not an enormous but quite a large cohort. Then there will be a very, very strong feedback and user design mechanism throughout the launch of the app when it goes onto the app store so that we're constantly working with patients and users in order to refine the software. That is modern, digital practice, similar to the way that Government Digital Service has worked across the UK, and others. So, it's quite different, I suppose, in its approach to some of our historic products.

The national data resource is still largely in a technical space in that we are provisioning the platform for data this year and then we'll be moving data from our existing systems on to the national data resource as a new modern cloud infrastructure for data. There's been a great deal of engagement with users, but the users of that data are clinical users and developers, not directly the public. Our focus is very much on the primary uses of healthcare data from a national data resource perspective. We're seeing it as a clinical foundation, a foundation for clinical tools. But as we move data onto it, and provision that data, then the secondary uses of data and some of those wider discussions will become more apparent.

The app, though, is our main engagement tool for patients. Historically, for the NHS Wales Informatics Service and DHCW in its first few years, our user base is clinicians and health organisations and people who deliver health services, not, historically, direct services to patients. But that is changing and, as we're moving into those areas, we're engaging more with patients. And also things like digital inclusion become more apparent. The chair of our digital medicines programme is also the chair of Digital Inclusion Alliance Wales. We did quite a lot of work with Digital Communities Wales and the co-op, as it was, but Cwmpas as it's now called, during the COVID pandemic and a variety of areas like that. But on data specifically, and particularly on data policy, we don't determine data policy. The Welsh Government determines data policy, and we act on their behalf to implement whatever that policy might be.

Can I just bring in Darren regarding the consent element? Because it's important for us to understand what patients give consent for, what they don't need to give consent for, and then the context of that.

Thanks, Rhidian. There are two aspects to that element of consent, I suppose, in terms of that direct care. As we said previously about policy positions around opt-out and the right to be forgotten, they're all aspects of that consent aspect. In a lawful world, consent is just one way of actually lawfully processing data. We have to be clear in terms of what that consent actually means, either under the circumstances, 'Does it have an impact on direct care?' or, 'Is it for that secondary uses element?' That's where we have to be absolutely clear what it actually means so that individuals know what they're providing permission for under those circumstances—whether it's clear direct care purposes or other purposes that may be research orientated or for service improvement, let's say.

Rhidian touched upon the fact that there are different ways that we can present data. It's not just fully identifiable information; it's also anonymised and pseudonymised information as well, which requires certain layers or certain levels of that consent model, should that be applicable under certain circumstances. So, there's many ways that we would engage with the public under those circumstances so that they fully understand the implications of the options open to them under those circumstances. As you can appreciate, it's complex at the best of times, so in trying to convey that complexity, I think, we have to be very, very understanding of how that message is delivered when options are available, like consent, to individuals under many different circumstances.

Thank you. Do you think patients should be able to opt out of certain types of data sharing? And if you think that that should be the case, can you explain why and what the impact might be?

'Yes' is the short answer. The question is, in which context. For example, in the context of, say, a research trial, an informed consent of a patient who has capacity provides the option for that individual to remove their consent at any point of the journey. In very much the same way, when I consent a patient for an operation 10 days before they come in for an operation, they can remove their consent up to the point that they're put to sleep. So, there are mechanisms you can actively use as an individual. Once information is collated and pseudonymised, that is your identity has disappeared from the data, then by the fact that your identity has disappeared from the data, it's difficult to remove you from the data.

Correct, yes, under those circumstances.

Thank you very much. [Laughter.]

We talked about a policy position in England and Wales as well in terms of the fact that even at that direct care level, in terms of some of the applications, that access to the summary of the information retained within a GP record comes with a consent model, because we understand that it's really important that individuals have a say in terms of access to that data and which health professionals should and should not, under certain circumstances, have access to that data. It's not always appropriate that an individual has to be able to actually give their consent, because you might have an emergency situation where that individual might not have capacity to do that. So, there's always ways of overriding those aspects in the best interests of the patient, dependent on how they are presented to the service. There are always a number of different mechanisms by which that consent or that opt-out is presented to individuals, depending on the many complex ways that they may be presenting themselves into the health and social care services.

Thank you. Thanks, Chair.

Thank you very much. We'll move on to Jane Dodds.

Thank you very much. I'm going to ask my questions in Welsh, so I'm just checking that you all hear me. Great. I want to ask a question about tackling data inequality. Is the health data being collected representative of the population as a whole? Do you think that there are any gaps that exist? If so, what are the reasons for this? Also, are there any initiatives to address these gaps, please? Thank you very much. I don't know who wants to go first.

I'll just make one comment about the healthcare record. The healthcare record is only as rich as the data that's collected in the patient journey. For example, it wouldn't be a surprise, would it, that the health data of 21-year-olds within our society is very different to the complexity and detail of the data of our 91-year-olds in our society. So, it's inherent there will always be gaps. We did highlight earlier that there's a complexity of digital systems across the healthcare context, and there will be data held in those systems that, at the present time, isn't available within the national record. It is our ambition to line up the systems so that we collate that data as we go along.

I think the answer is that the data that we have reflects the people who come into contact with the health or care systems. There are people moving in and out of Wales throughout their lives, and some people are more sick than others at different times in their lives. It's possible that a significant percentage of students come into Wales and live here for three years and then leave and are almost invisible in the health records, despite the fact that they've been living in Wales for a period. And there are people who retire to Wales where we have no history of their health at all until they come into contact with the NHS, and then we do our best to obtain their health histories and records. We work with the health organisations on the border between England and Wales to try and transfer data with them.

Data sharing in Wales between one body and another has been a significant challenge over the last 10 years. I don't think that we're in a position yet where the whole record of data comes from areas of England, or other countries, into Wales. There is international work being done on that on the international health passport and similar initiatives. So, on that basis, yes, there is inequality in the data, because there are some people who live in Wales who are much more prominent in the health records that we have than other people, but not for the ordinary reasons; it's because people have come into contact with the system. And those individuals are not the ones inputting the data into the record, but it's the professional staff who deal with those cases. I can say quite confidently that everyone who comes into contact with health and care systems in Wales are treated equally in terms of how their data reaches the system, but it's not data that is complete for everyone everywhere across the country.

Thank you very much for that. Could I also please ask a question about services and how they're developed from the data? Do you have any evidence that the availability of data drives developments in services that are steered more towards specific groups of people rather than smaller, other groups?

There's good evidence of data being used to redefine services, to ensure that the outcome of those services is the best that it can be. That often happens in services that have workforce problems, usually specialised services. You've seen previously a regionalisation of vascular services, you've seen neurosurgery services redefined, you've seen trauma services redefined, and that's often based on data and numbers in terms of processes. In terms of minority or small groups, I'd be grateful if you'd expand on that for me to further understand the question.

Yes, of course. We're interested to know whether there's an inequality across Wales with regard to where people have data held in health services, and how we make sure that everyone then gets the opportunity for their data to be used, as we press ahead with developing services. I just wanted to make sure there's equality across the data that's available in health services, if that makes sense.

In terms of planning, I'm responsible for planning and the integrated plans for DHCW, and I work with the network across Wales. I can't think that there is any reason to think that there are groups that have been excluded from that data that is used for strategic planning within the health boards in terms of the form and shape of the services that are available. I think that we do have some examples of where we've used the information in the data very effectively in order to target services at groups in need or who are vulnerable.

And I think that the best example of that was during the pandemic, when we built—and we did a lot of this manually, to tell you the truth—the shielded patient list, and we then used that list in order to recognise those people who were in most need because they were clinically vulnerable, and then directed services to them, or prioritised access to those services for them, and, unusually, as well, some commercial services, such as supermarkets, and so forth. So, I would argue that we need to do more of that across the system in the future, because if the ambition in the health strategy generally is to identify illness before it happens—preventative healthcare—then we have to look at the data in order to identify the first opportunity we can do something about that, and ensure that we co-operate closely with patients in order to do that. But I think that the shielded patient list was a good example of using data that we have for the benefit of a cohort of people who needed that in particular.

Thank you very much. Just one final question—

Jane, Altaf just wanted to add something to what you were saying.

I'll make it more clinical. So, for instance, if you take the example of sickle cell anaemia, which is more common in black and ethnic minorities, and cystic fibrosis, which is common in the white population, now, 50 per cent more of the population of black and ethnic minorities have sickle cell, whilst less of the population has cystic fibrosis. But when it comes to the funding and other things—such as research—30 per cent more is going towards the cystic fibrosis than towards the sickle cell anaemia, when the population is more. I think that that is the inequality.

All I can say is that that is an observation. Obviously, we don't do the research; we collate data, and, therefore, no citizen is disadvantaged if they've given their consent for the data to go into the repositories.

Fair enough. Fair comment. Jane Dodds.

Thank you very much. Just one final question. We heard from the first panel that there was a concern with regard to data in the mental health sphere, and, therefore, there were people who were being treated in different ways within the mental health service, especially under-represented groups. So, do you have any experience of that, or any opinion on that, please, any comment to make on that, please?

The only comment that I can make in terms of the recommendations made regarding access to the health record in mental health environments, I'm aware of two areas—one in north Wales and one in south Wales—where I personally went into the unit to check that their computers were there, with access to the Welsh clinical portal. I can't make people use the record, but I am passionate about making it available should they wish to use it. And I think that that's the key—it should be available wherever patients present, regardless of the healthcare context. In terms of the mental health care record, and the sensitivity around that, traditionally, that record has been separate from the general medical paper, as the sexual health record of an individual. What we are—. Our ambition is to combine all the information in a digital way that is segmented within the regulations that are required in terms of access and particular things regarding, say, for the Mental Health Act 1983.

Thank you very much, Chair.

Okay. Thank you. So, just to be clear, are you saying that, if it's a mental health issue, or a sexual health issue, it requires a higher level of permission to be able to access that information?

So, there are certain aspects of legislation that would infer that there needs to be more protection around the data. So, there's some information that can be defined as sensitive—all information in the health context is defined as 'sensitive', but there's also a concept of almost 'highly sensitive' data as well, so, aspects of termination of pregnancy, HIV—aspects where the legislation supports more control over that data.

So, part of Digital Health and Care Wales's responsibility is to understand how that control is applied under those circumstances. So, we're not segmenting the data or making it unavailable; we ensure that the access controls within those systems are adequate to the needs of those health professionals and those individuals accessing the data, so that it is appropriate at the time it is required. And that requires quite a number of different factors and a certain element of intelligence within those systems and those services to allow that to happen, but that means then that we have a fully comprehensive record that is available at the point of care under different circumstances, because those controls are within those systems and services.

I'm not entirely clear what you're saying. For example, the receptionist in the health centre, do they have access to all the patients' records?

Right, yes. I think I know what you're getting at. So, traditionally, it was kept in a record that was paper and therefore it could be locked in a cupboard, and it would only be used in a certain environment. Once you put that digital record available across a transparent platform, you need role-based access. So, there are certain things that we can do to prevent so that only the people who need to see the record see the record. We've previously touched on the ability to uniquely identify our users, and the ability to ensure that we know who they are and what they do. And that gives us the ability to assure the public that, if we put a particular thing in a record that is sensitive, there are break-glass mechanisms that mean there are barriers to get into it.

Okay. So, that would include some of the things I just mentioned.

Yes.

Thank you. Okay. Sioned Williams.

Thank you, Chair. I just have a few questions about e-prescribing. Systems such as e-prescribing could operate across primary, community and secondary care, so what are the potential benefits and concerns of this? Are there any lessons to be learnt from Scotland or England, where e-prescribing has been working for a while?

So, the benefits are easy to articulate and are well documented across the literature. Electronic prescribing, digital prescribing, is one of the areas that can reduce harm and increase patient safety dramatically, and the fact that clinical decisions support within systems means that the dosage of drugs is more likely to be correct. And the facilitation of pharmacists to be able to read the handwriting of a doctor to prescribe being a very good example, and to collate.

Are there any concerns? I think that the concern that I would have as a professional is that any new system needs to train individuals. Some of you may be aware of the work that Ruth Hussey brought in at the turn of the century with Professor Routledge—the introduction of a single prescribing drug chart for secondary care. That brought massive patient safety, because medical students are prescribers across the system where a trainer wants to use one user interface. So, that's another thing that needs to be considered.

The digital medicines programme—and I'll bring Ifan in shortly—is a national programme to join up a number of elements of the record, and the one that I think is probably the most exciting is the shared medicines record, because that will mean that there's one source of the truth for wherever the patient presents. And, at the moment, you'll probably be aware through your own personal experience or those with your family, you can often find yourself going to different healthcare providers, be that primary care or secondary care, and they've got a different set of medications in terms of how up to date they are. So, the ability to provide one source of the truth, which is updated, will bring massive benefits in terms of patient safety, in addition to—and this is a key advantage—allergies and adverse reactions. People die within the UK from penicillin allergies, despite the fact that, sometimes, in the record, it says, 'Me, I'm allergic to penicillin'. So, the benefits of safety that come from this investment are key.

Thank you, Rhidian. The medication plan and transforming digital medicine is very close to my heart. I worked in the Government in a previous role where I was part of the planning for that programme, and for a year, I’ve been with DHCW where I’m the director responsible for that. I think that Rhidian has mentioned the advantages. They are very significant, and we continue to learn a lot from what’s happened in those other countries because they have introduced these systems before us by bringing in experts, and we’ve used networks in order to learn from their experience. It’s not a disadvantage, but the biggest challenge is that driving significant change in a complex digital system is very difficult to do, and there is no shortage of digital transformation programmes that have taken a long time to introduce, and moving people onto those new systems and training them is a challenge.

We’re very aware of how ambitious the programme is because it is a programme that has four elements to it, in the hospitals, so secondary care, namely EPMA, electronic prescribing and medicines administration, and transfers in the initial care system. There is a lot that’s digital already, so the prescription is already processed digitally, but it’s transferred by paper, so we’re changing that to be digital. And then, making the record accessible through the app, and then the medicine record, and doing that at the same time, alongside each other, rather than one after the other. And so, there is great ambition there. The timetable is challenging, and the health boards are now purchasing at the moment, and we’re co-operating closely with them. But on the whole, I’m a lot more hopeful about where the system will take us over the coming years than having any concerns.

Thank you, and apart from the challenge, of course, of getting these things to work, and training—all these things that you’ve mentioned—and making these things connect with all the aspects of the health infrastructure and the systems that you’ve described, do you have any concerns from the perspective of data sharing? Are there any concerns, for example, with regard to using it to monitor whether a patient is adhering to a programme of medication?

No, I don’t think there’s any concern, and I think the digital system will give us a better view by far. We now have a way of tracing whether a patient is taking the medication they’ve been prescribed. That is part of the app scheme, and as well as that, it will be possible for patients to add to the record of over-the-counter medicines that they bought themselves—that is, medication they haven’t been prescribed—so that we have a full record.

And we also foresee that we will have a better sense of the medication that has been given to patients throughout their time in hospitals. At present, we track the prescriptions that they have when they are admitted and at the end of their hospital stay, and then at times there are details in the discharge letter of what’s happened between those two time frames, but not with the transparency and detail that we would hope to have. And the digital system will allow us to have more of those details. So, it’s not a concern, aside from the fact that getting this to work together is very complex. But we’ve thought a lot about the architecture of these systems in order to ensure that they can be as streamlined as possible, and that we have as much confidence as possible in the programme.

And in that respect, clearly, a high number of people have access to a mobile phone now. They’re able to use the app. But there are still a number of people who aren’t able to do so. So, in terms of your plan in that regard, how serious is the problem of digital exclusion, and what are you doing to address that? What can we do to address that?

So, there is an element of Government policy in this area. So, I’m speaking from my previous role, in Wales, the policy perspective is that the digital methods are in addition to the paper methods that we already have, and there is no intention to force people to use digital methods by turning off the current systems. In some countries, that's been different; that is, policy has tried to drive people towards digital systems, and we're not doing that in Wales. We're encouraging people to use those digital systems.

The chair of the programme on digital medicines transformation, Hamish Laing, is also the chair of Digital Inclusion Alliance Wales at the moment, so I can assure you with some confidence that he's ensuring that those issues are being considered, and have been considered from the outset, and they're very prominent in the programme's thinking as its operational methods are being planned.

Hamish is also on the programme board for the app to ensure that we have the same priority, and that there is a close link between the app and the medication programme. Within DHEW, I am responsible for both programmes and for the national data resource programme as well.

Thank you, and one final question, as I just wanted to ask more of a technical question now about the work that goes on to create the e-prescribing system, et cetera. How are algorithms used in managing and classifying data?

So, as part of the prescribing system, there are rules-based algorithms that analyse the choices and help the doctor or whoever is making the prescription. That will look at allergies, it will also look at the medications that have already been prescribed and it will provide a warning. From time to time, we also introduce systems that offer generic medications instead of branded medications, where they have the same content. So, these are not artificial-intelligence algorithms that do a neural-net analysis or deep learning on the system, but usually they are rules-based algorithms to ensure that errors are not made by drawing the attention of the people using the system to those.

We don't have plans in place at the moment, but, in future, we will be able to do more by looking at—what is value-based healthcare in Welsh?—the link between prescribing and the medication people use, and the outputs and the health outcomes that they achieve at the end of it. There is a separate programme that is gathering that feedback from individuals. Now, if we can do that on a wide scale, if we can do it consistently and if we can do that in a timely fashion, it will be possible for us to gain a better understanding of the impact or the lack of impact that medication has on people compared with other things. That's not something—. We have to get these systems working for everyone and get all the data into the medication record before we can do that work.

Thank you, Chair.

Okay. Health is not just the business of the health service, clearly, so how does the management of data respond to the complexity of the need to know or the right to know, or the right to withhold, in the sense that expanding this into social care—? Clearly, the social carer, once somebody is discharged from hospital, needs to know the basics about this individual's needs, but social prescribing introduces the individual to a whole other set of organisations that the patient may or may not wish to share information with. On the one hand, somebody doesn't want their trauma to have to be relived every time to know that X will trigger an adverse reaction, but, on the other hand, how does the system respond to whether the patient wants to share information with a widening group of people?

It's a very good question, because we have that on a daily basis with medication, so things that you can buy that you might not want to tell your medical healthcare professionals that you're buying, and that's an example of—. It's the patient's choice to divulge their clinical history, their medical history, their personal history, and it's entirely their choice. The relationship between a healthcare professional and an individual is based on trust. People's life experiences don't necessarily mean they trust people, perhaps, in positions that they might perceive as authority. I think that comes down to clinical skill. I don't think there's any digital system that should or, indeed, could change that situation.

Thank you very much. There are clearly some groups of people that you engage with very actively. People with type 1 diabetes, somebody with a peanut allergy are clearly people who—. There's a need for people to know things about those individuals. Could you just explain how you recruit patients to, if you like, feed back whether your systems are appropriate, in line with the rights of the citizen? Is your engagement with specific conditions?

Well, up to this point, we haven't delivered patient-facing applications, so the need to engage on design of that user interface hasn't happened. Ifan's explained the work that Digital Services for Patients and Public are doing with engagement of the citizen voice and user groups. We do engage with networks, so if there's an ask from, say, cardiology, we'd engage with the cardiology network, with the planned care network. Perhaps a better example would be inflammatory bowel disease. During the COVID period, we were able to work with that network to provide them with the ability to deliver remote consultations, and the feedback from that specific group of people was very engaging, very grateful and very complimentary. We have a number of disease registry groups. They're not held by us; they're interested parties who approach us about certain things, and, therefore, we engage via the networks, the domain experts, who are providing that clinical care.

I think, as Rhidian has said, so we, as Digital Health and Care Wales, have not engaged very much directly with patients historically, because all of our services are directed at clinicians and they generally, historically, have been used in secondary care. But, from the wider NHS, there are some really good practice examples, and they tend to be—and it's not surprising, and I think you referred to it—from patients with chronic conditions and ones that have got a lifetime interest, for obvious reasons, in their own condition. And I think the national renal network in Swansea is a really good example of a particularly strongly engaged patient group, because they come in three times a week for dialysis, and there is a digitised patient record. Those individuals have been able to provide outcomes data back into the system, they've been able to see elements of their prescription for quite some time, but that is a relatively small group. And I wouldn't go so far as to say that enabling that to be possible for all patients in Wales is where we're headed, but a lot of the underlying technology and practice there, providing visibility onto the record, giving patients the opportunity to own and to manage their own records, to see their prescribing record, and to understand where their appointments are and to have a degree of management around those, that's our ambition for the whole system. But moving into that non-hospital setting, having individual users, that is public—3.2 million people in Wales—is a very different territory to where we've been as an organisation historically, although individual health organisations have managed over the last few years more large-scale interaction. And Swansea bay has also been doing some stuff with Patients Know Best and some other applications, and the NHS Wales app team has been working very closely with those in order to make sure that we can include that functionality in our road map for the app.

Futhermore, you will be aware that there are a number of commercial suppliers that are engaged within Wales who are trying to get their footprint, as it were. We don't provide those. So, that direct engagement—. I go back to the point that we provide data for the delivery of care, and there are some networks who've chosen to provide that to their patient population through specific consent-enabled applications. We don't run those.

Okay. I'll give Sarah Murphy the final word in a minute, but, I suppose finally from me, Rhidian, you explained the huge amount of data that you have access to, and with that comes a massive responsibility. As one individual, you can't possibly be spotting things that are cause for concern, but how do you use the depth of the data that we now hold digitally to try and prevent the sorts of things that are now the subject of criminal investigations going on in relation to the Countess of Chester Hospital? How do you know that the clinical governance is—?

Okay. So, the information governance programme across Wales is strong. We have application of software that I've previously highlighted in other committees, the national intelligent integrated audit solution software, which monitors individuals' behaviour and over a number of parameters. So, you're actively being watched when you've been given permission to use the record. That is the responsibility of the Caldicott guardians within the health boards. Each health board has a responsibility to use that and, because they are the employers of those staff, they have disciplinary procedures in place to deal with that. What we do is we provision the availability of that software for them to enact.

Thank you. Sarah Murphy.

Thank you very much. And thank you very much for coming in today and answering all these questions. Having heard everything, for me, this very much comes back to the Welsh community care information system that has no live date—I know, and I understand. But, you have about 1,000 staff—am I right?

Yes.

Yes. People in England have had this, basically, since 2018. You were given the code in 2021, and people in Wales still don't have it. What's happening is you've got Swansea health board now using an application called Patients Know Best. As we mentioned, you've got 50 per cent, according to the Centre for Digital Public Services, using this surgery app that I discussed earlier on because there's an absence of these one-Wales platforms and systems to be able to do this in the patient's best interest. And, as you said, you don't have patient-facing applications and systems at the moment, so there just aren't none, and it's not all joined up. It's very obvious that the clinical side and the clinical digital system has been prioritised, and it does seem to be going really well. All seven health boards, as well as front-line staff at Velindre University NHS Trust are on it. I can see on your website that you're doing a whole Wales-wide survey now to find out how clinicians are finding it and using it, and there's no patient voice. But this is, at the moment, your responsibility, and on you. So, my question is: why is it taking so long? We have heard from other Members of the Senedd who have given evidence in the health committee that it could take up to seven years, and that's okay, but if it's not going to take seven years, give us some indication.

Secondly, if you aren't able to deliver this basically now, this year—because you are delivering the other systems—if you aren't able to give the parity to the patients, which is at the moment under your authority and responsibility, does it need to go to somebody else to do that so that we can have that?

Okay. There's a lot in that, so bear with me. I'm going to start with the presumption that everything is in the record for the clinician. History tells us, if you look at the National Programme for IT England investment, it took over 20 years to digitalise primary care through significant investment from central sources. It's taken us at least, I would say, the eight years that I've been in position as the first chief clinical information officer in Wales to convince people of the value of sharing. The value of sharing is based on clinical champions understanding that patient pathways go across many different organisations. That's a journey; we're getting there. There are things missing from our record that we're trying to get to. We have seen it as our mission to provide information at the point of clinical care that reduces the risk and improves the chances of best outcome for the individual. I completely take on board your comment about making that information available to the individual. There is some complexity about an individual organisation doing that in terms of the data, in that the person that they're providing it for may have treatment across a number of health boards—if you've got cancer, if you've got a chronic disease or if you're having urgent care. So, those records themselves are incomplete.

The beauty of Digital Services for Patients and Public is that there's one approach, one gateway in, one password for an individual, and then for them to onboard the things that matter to them. I'll go back a little bit to this self-care and more holistic approach. You may want, if you're a type 1 diabetic, to understand your HbA1c, your blood test within the system. But also, you may want to access community groups that support the disease that you have, or, indeed, local shops that provide specific support for your diet. That holistic, all-Wales approach has required some herding of cats over a period of time, requires some central investment—it now has central sponsorship—and will deliver something that I believe will be much better than anything that you or I could experience in any other country, because we've adopted an all-Wales approach. We're all frustrated at the pace of change. That comes because of the complexity, clinical engagement, hardware availability, software capture, structured data. Our standards approach, our information governance approach, our strategic approach to do it properly, to do it once for the benefit of the citizen, unfortunately does take time.

Can I just ask you as well, when it is done—and I do understand everything you're saying as well; it is frustrating, and I know it's frustrating for you—will you have the power to enforce it so that it has to be all Wales?

Will I personally? If only. [Laughter.]

Do you have the powers, or is that a political decision?

We work with our policy leads, we work across executive boards, we work with community care trusted partners. A collaborative approach rather than a competitive approach has always been our approach. We will work with anyone and everyone to make sure that we can deliver the benefits within the financial envelope that we have.

It'll never be 'done'. Digital is never going to be 'done'. There will always be more to do. We don't have the authority to force—you know, that is to mandate and to require—and in fact, I'm not sure that mandating and requiring works that well in a NHS context. This is not unique to NHS Wales; this is the NHS in general. Shouting at it is not usually the way to get the NHS to do things.

We are very, very focused on providing better tools and tools that make it much easier for people to do their job, that they embrace because they are better. And sometimes, it's easy to do that when you're developing new tools that do not previously exist. I think the COVID experience is a real lesson for us in that. Contact tracing was a new thing and it was a very simple standard configuration across Wales, delivered from the cloud, with a joint data controller agreement behind it. It did not require anybody to let go of anything, not really, although local authorities did have their own contact tracing arrangements. And I think that helped us to deliver, compared to other parts of the UK, a very effective vaccine delivery programme and contact tracing programme.

You said, 'You better deliver it in a year.' This is a very, very important 12 months—and I think you can see that in the IMTP that's been published in our board papers just before the weekend, which the board will consider at the end of this week—for the NHS Wales app, for the digital medicines transformation programme, and for the NDR particularly. I've been in digital for five or six years, previously with the Welsh Government in terms of policy, and then moving to Digital Health and Care Wales. I moved to Digital Health and Care Wales because of the experience of working with the pandemic. I think things have both accelerated and expanded—arguably they've expanded too quickly.

It's difficult to take on lots and lots of major new strategic transformation programmes every single year. The meds, the NHS Wales app and the NDR are all new in the last three to four years. It's hard to find the talent and it's hard to compete against the market at the minute, because the digital market is—. Well, you can just see what's happening with artificial intelligence in different areas. But I'm still very, very excited. I've never regretted for one moment moving to work for Digital Health and Care Wales, and I think it's a very exciting 12 to 24 months ahead of us. And what encourages me most is the close working with health boards and with trusts.

The survey that you referred to is funded by us, but it's being done in partnership with all of the digital directors across Wales, as have the digital maturity assessments and other things. There is genuinely a collaborative approach, which—I choose my words carefully here—may not have been there always throughout the last two decades. It is in a very, very different place, but it is still an enormously challenging task, and it is an expensive task as well. It's going to take a great deal of our attention and effort, but I'm still very much glass half full about it.

And it's very high on the Minister's list, so happy days. Thank you very much indeed for all your evidence. We've run out of time; we could go on for another hour. We'll send you a transcript of what you've said; just check to make sure that we've captured accurately what you intended to say. Thank you very much indeed for your time. It was a really interesting session.

We'll now take a short break. Our next session starts at 3 o'clock, so if we come back two or three minutes beforehand.

Welcome back to the Equality and Social Justice Committee, where we are going to conduct our final session this afternoon on data justice and the use of personal data in the Welsh NHS. I'm very pleased to welcome Professor Ronan Lyons, co-director of SAIL Databank at Swansea University. Welcome. Just as an opening question, how well do you think healthcare data in Wales is being collected and used currently?

I think pretty well—probably better in the academia end of things than in the NHS in general, I would say. If I look across the UK, I think that, on the academic end of things, we lead the UK by some margin. We're always encouraging NHS colleagues to do more in the way of data linkage, so that they can better understand the relationships between people's health conditions, the treatments that they get, and outcomes. And obviously, outcomes happen after treatments, or not, and so that's why you need a longitudinal look at what happens when there are interventions, or interventions don't happen, and the outcomes.

Very good. I'm now going to hand over to Sarah Murphy.

Thank you very much for being here today. Sorry, I've just put my questions down somewhere; here we go. We were actually just saying before—. For the public at home, especially, and us, could you explain what the term 'big data' means, please?

I think it's a term that's used by different people in different contexts. But in general, I think the understanding would be bringing together complex data from many different sources on individuals, to be able to understand what happens to them and their outcomes. 'Big data' is often about the volume or variety of it. Particularly, people tend to think more in the way of images and image analysis, or genetic, or other data, which are very complex and take up lots of space, compared to more simple data, which are like diagnoses, whether they're in hospital or GP systems.

Thank you very much. How reliant is healthcare research on good data, and how is it possible to ensure that the data is reliable and sufficiently comprehensive?

It is completely reliant, a lot of research, on how good our healthcare data is. If you take the example of what happened in COVID, and our ability to bring data together from many different sources, that allowed us to understand who was getting infected and why they might be getting infected. It allowed us to look at the context of infections, whether that was in the general community, in healthcare settings, in care homes, and in school populations as well. And then, it also allowed us to look at the effectiveness of interventions. The most obvious one of those would be in the vaccine roll-out: how well did the vaccines work at protecting people; was there a difference between the vaccines; did the vaccines have side effects; what happened to people who were vaccinated compared to people who weren't vaccinated. And more recently, we've also been looking at the effect of the monoclonal antibodies and the antivirals that have been used in Wales. I think it's important to do that, because when people look at the clinical trials that first test these things, they are done in relatively small samples of people—all clinical trials are. And often, clinical trials are run in groups of people who actually have just got one condition, or even a mild version of it, because it's easier to show whether the treatment works or not. But then, those drugs and vaccines are used in the entire population, and you also need to look at what they call the real-world evidence data, as to how well they work, or not.

Thank you. You've touched on this in your first answer to the Chair. SAIL is world renowned in its ability to collect large volumes of data, test algorithms and predict disease patterns. But do you think that there is enough being done to feed that back to the individual patients or even groups of patients, and feed back what decisions have been made using their data? As you said, it comes in, it's big data, it's looking at groups, really. Is that then fed back to the people? Because, essentially, it is still their data, and, potentially, decisions have been made that will impact their lives or treatment, or other people's lives and treatment. Are they made aware of that?

There are quite a few questions there. SAIL stands for secure anonymised information linkage system. It is an initiative that we started in 2006-07, and it was designed at the very beginning with privacy at its heart. Whilst there are individual-level data, the data are all depersonalised, anonymised and encrypted multiple times. It's not possible for any of the analysts or researchers to identify a person, and because of that design, it's also then not possible to feed back data to people, because we don't have it. But what it does show then, our patterns, is how things work or don't work for groups. And what we do then is we publish that very widely in scientific literature.

We have quite an extensive public engagement set of activities at SAIL. We have a group called the consumer panel, which is completely made up of members of the public. Every time a person wishes to run a project on SAIL, there's an application, and the application goes to an independent committee. A third of that committee are members of the public. People like me who are used to it always basically go and meet and present with the consumer panel, and say, 'Look this is a piece of work that we think we would like to do, this is what we're planning to do, can we please have your ideas and what you think could make it better?' Nearly always, we have members of the public who joined a research team and help, if you like, design it and steer it and help it to feed back at the other end. Any algorithms that are developed in that are also made freely available, publicly available, and the reason for doing that is that—. We don't provide a service to patients like the NHS does, but the NHS then can adopt those algorithms if they feel that it's sensible to do. At that stage, you would then have feedback to an individual.

I have to say there is a lot of talk about algorithms and AI, and, as yet, there are not that many that are really useful, I have to say. They will be. Often, what they really do is they predict somebody's outcome, and they're often a little bit better than existing techniques. But you then also have to say, 'Are they good enough?' They might be an improvement, but are they actually good enough to put into practice? Then you have to consider them almost like a screening test. We have well-developed criteria about whether we should screen for various diseases, and so we have screening for breast and cervical cancer, and colon cancer, and we don't have yet have screening for, for instance, prostate cancer. The reason why is that the tests aren't good enough. If a person tests positive on one of the screening ones, you also then have to have a service that's available to offer that person, because otherwise they're in an invidious position, knowing that they would be, for instance, at higher risk, but, actually, there's nothing they can do about it. That causes anxiety.

No. I don't know.

And would you have thought of all the consequences of actually knowing that? Because that gets people into really difficult positions with insurance and that. So, which algorithms are used and not used is quite a complex thing, and that's why you do need expert panels, and of course expert panels that have members of the public firmly embedded within them, making decisions on which ones we should or shouldn't use.

Yes, I agree. How do you think as well that those—? I mean, it's great that there are panels and they do have patient voices on them, and members of the public, but how many people is that? That's still very small, right, compared to the population of Wales? I suppose what you're describing is a conversation that needs to be happening everywhere. And I would argue as well that it's a conversation that needs to have some political, parliamentary oversight, and at the moment that doesn't happen.

Are you talking—? I'm sorry.

What you said about the consumer panel and the—.

Yes. So, essentially, some of the core funding for the SAIL Databank comes from Health and Care Research Wales, which is, if you like, a branch of Welsh Government, and we need to compete to get some funding for that. We only do research that they have decided—and in this I include the members of the public—is in the public interest and protects privacy, and has an added bonus for the Welsh population. I've never really thought about, if you like, political oversight of it, but we're certainly very happy to come and explain, and we've attended very many events on describing what we do.

It's not so much for you, I suppose; I suppose it's a comment.

Oh, for the NHS?

Well, for the committee, actually, and for us as elected representatives. If the Welsh Government is funding this and making the decisions in some way about what is prioritised, and what algorithms are implemented, then shouldn't there be more scrutiny? And I guess that's the purpose of the committee today.

Oh, absolutely. I think if any algorithm is being used on the population of Wales, there should be some oversight as to: is this a sensible thing to be doing or not? How does it work? I think we will get to a position where there are large numbers of algorithms being used, and I think there are very good reasons for that.

So, one of the things that—. I remember seeing this research group from South Australia who actually published a paper on an algorithm that identified normality in cancer tissues. So, you think about that, and you think, 'Well, actually, what use is that?' Well, we have lots and lots of people who have biopsies, okay? And one of the things then is our ability to produce even better images from those—really high-class images as technology develops. We can produce lots and lots of slices and really in-depth stuff, but what we struggle to do is then to produce the same number of brains and eyes attached to them for the experts who have to look at them and decide if this is something that needs something done to it or not. The same happens with radiology images. So, we outgrow our ability to look at almost the answers to some of the tests that we've done. And so we do need high-quality algorithms that would assist clinicians in prioritising what they might look at first. I think that would be—. Those are really necessary.

Yes. And my last question, I guess, then: do you think that therefore there should be, or is there already, a risk assessment, I suppose, that's in place as a standard risk assessment that, as you said, the consumer panel carries out? Is there a kind of—? Is it all just getting together in a room and having a chat and then making the decision, or is there an actual process that you have to go through?

I think, on our research side, obviously we would work, if you like, on the design of that, and the involvement at the beginning, and then, once the results were out, we would publish the results, and then the question is, 'Well, okay, is this something that's good enough or not, let's say, for the NHS to take up?' And then it becomes an NHS decision, and unfortunately I don't—

You don't know if they have.

No, I don't have any say. I'm not sure exactly what they do with that. I think they must facing lots of these questions at the moment because there are lots of organisations and individuals producing algorithms and saying, 'Buy mine', but I'm not sure what the criteria are for them and how they adopt those or not.

Thank you. Do you share any of the data as well with commercial companies or are they used to build any of the tools or the treatments?

No. Essentially, the research that's conducted with us is carried out by academics and, also, Government social researchers, as part of an Economic and Social Research Council grant. We don't allow companies to have direct access to data, but what happens is that companies often partner with a university and fund the research through a university—that's how that works. But I think this is an area that's going to grow considerably over the years.

Okay, thank you very much. Thank you, Chair.

Thanks very much. We've got half an hour for the rest of the session.

Sorry.

Altaf Hussain.

Thank you. Professor, healthcare data emerges from a multitude of systems and organisations. How confident are you about its security at SAIL, and what checks are in place? If I may add, are there sufficient controls over how that information that you are holding is being shared with others and do the patients know about that?

Right, okay, so there are a number of questions there. The provision of data to SAIL is a voluntary activity; it's not required by anybody. We have demonstrated, over the years, that the system that we've designed is robust and safe. We have to have accreditations from multiple organisations, including the Office for National Statistics, the Medical Research Council and the Information Commissioner, amongst others. So, we've spent a lot of time designing how we work the system, how the system is safe and how it can be improved. We have six-monthly reviews by independent bodies to make sure that our accreditation stands up, and we have multiple penetration tests to try to show that if anybody did attempt to break into the system, what they could do.

The system is extremely robust. We've never had a major problem with it since 2007 to 2023 because of the design features. So, it is a system that has a remote-access facility, only available to the people who are accredited, safe researchers on an accredited project. You cannot take any data out of the system; you can, basically, do your analysis within it and then say, 'The following report is what we would like to take out.' Those reports are actually manually checked. We follow all of the ONS guidance on small-cell suppression, so that people can't be identified by small numbers and everything else, to ensure that everything is safe. So, effectively, it follows a system that has been described as the 'five safes'—safe data, safe projects, safe researchers, safe systems—and that aspect of it is very well observed by lots of independent bodies and the people who certify us.

On the public, essentially, we don't hold personal data, as defined by the general data protection regulation. All of the data are anonymised prior to linkage, and the anonymisation happens in Digital Health and Care Wales, who provide us with encrypted numbers. When the data arrives at Swansea, it's re-encrypted with a different key and no two persons have the key to decrypt the data.

As I said, we spend a lot of time explaining to people what we do, and we've lots of roadshows and events. We do as many of those as we can, and every time we get an invitation we're very happy to show it there. It's interesting, as actually explaining, if you like, anonymised data linkage on the doorstep is quite a challenging thing, because you think, 'Well, if it's anonymised, how can you link it?' So, you have to bring people through quite a complex diagram of how this works. When we've done that, we've never had any difficulties with people about how the data are used.

Diolch. Thank you very much.

Okay. Thanks very much. Ken Skates.

Thank you, Chair. I'm going to ask some questions about data engagement, if I may. Can you just tell us a little more, first of all, though, about how you engage with patients and the public in developing and using their data?

Right. When we started up, we engaged particularly with all the general practices and we had notices that, essentially, went out to everybody, and you were using general practices' walls about explaining what we were doing. We haven't, if you like, engaged with the entire Welsh population. We've sort of struggled to think how we do that. As you say, we have members of the public involved in every decision that we make about what is sensible or not. We always have people from the public engaged in the studies that we do. I think a good example of that was—. I think it's worth bearing in mind that we don't just link healthcare data; we also link data from other systems.

A good few years ago, we conducted an evaluation of a social housing improvement in Carmarthenshire, in which the council were spending £200 million, turning nearly 10,000 homes into homes that were really well fit for people. And, as part of that, we had members of Llanelli tenants association involved in the design and the presentation, and they actually sat on the same stage and presented along with the First Minister when we had the results of that.

We have as many public engagement activities as we can. I think we've two full-time members of staff and this is what they do altogether. It's difficult to do, I think, on an abstract basis. So, it tends to be done more about a particular question. So, let's say, if we were doing some work on a disease like multiple sclerosis, we would always engage with the Multiple Sclerosis Society UK, and use their patient advocacy groups to get involved with, rather than try to recruit somebody just from the general public with that particular disease at that point in time.

Thank you. And you also work closely with social care services, I take it.

We do. We find that one much more difficult, and the reason for that is that, I suppose, the coding systems' ontologies in medicine have been around for quite a while. So, there is an international classification of disease, as created by the World Health Organization, which is used in hospitals, read codes in GPs, and there are new sets of codes called SNOMED. And everybody uses those, and there are diaries of them, but social care actually doesn't have the same ontology, and what's happened is that systems have developed in many different local authorities that actually have different classifications. So, actually making sense and putting them together is quite a challenge, but it's something that we're really very much up for, because it's such an important component of people's lives.

Brilliant. That's really interesting. Thank you. How does SAIL determine and design the areas you include in your research programme, and does the availability or the size of data play a part in that?

Well, yes. There are feasibility studies first that say, 'Do you know, is this a question you could answer using SAIL? Do the data exist?'. But virtually all of my staff are funded by research grants, so they're not funded by the university or the health system. We look at the competitions that are out there for funding, and we particularly look to the ones from UK Research and Innovation, to the Medical Research Council, the Economic and Social Research Council, Engineering and Physical Sciences Research Council, and apply in a very competitive sense to answer those questions. We have been very successful in years, and we've brought many millions of pounds of money into Wales and employed quite a number of people in doing that. So, a lot of what we do, basically, is determined by the questions that the research funders put up, because we need to have people to be able to answer the questions.

I'd just put also in that, in COVID times, I had a grant from the Medical Research Council to embellish what we were doing and put together data from 61 different sources for the Welsh population to help understand that. We had this one Wales initiative, in which we provided access to lots of different research groups in the NHS and academia and Welsh Government to answer questions. That worked well, in part, I would say, but it also highlighted some of the skills gap we have. Actually, it's really a complex business, and making sure that two and two is four and not 22 can be quite challenging. So, it is an area where I think we need to grow the skills base right across Wales to be better at that sort of activity.

Super, thanks. Just finally, do you think that patients should be able to opt out of certain types of data sharing, and, if so, what would be the impact?

I think it's quite a complex one, because, if you like, we are secondary users of data that are collected for other purposes. I know there has been an opt-out of involvement in England for some of the data with NHS Digital, but also that's been very challenging. Because of the complexities of the data and what it means, it's very difficult to actually opt out without some of the systems falling apart. Also the NHS would have to have a list of all of the people who opt out to know that they've opted out, so that they could stick by their wishes.

We do have, actually, an opt-out system for individuals who don't want to be involved in SAIL, which is run through the GP systems, and there is a code that GPs can put into the system to say, 'This person doesn't want their data shared', and we do not receive those data.

Great, thank you. Thanks, Chair, that's all from me.

Thank you very much. Jane Dodds.

Thank you very much, Chair. I know that time is running out, and so I will just ask the first question and then Sioned Williams will be coming in. I want to focus on data inequality, if I may, and I want to ask, in your opinion, whether the health data that are gathered represent the population as a whole, or are there any gaps, and what the reasons for that may be, and whether there are any initiatives to address those gaps. Thank you very much.

Prynhawn da. So, yes, data gaps and equality. Surprisingly, the health data do represent the population to a very large degree, and I was a bit surprised when we looked at that. One of the things that we use as a population denominator for our work is, essentially, the NHS registration system, which everybody in Wales is associated with, and then we've also looked at service use across many, many different factors, and it's surprising how small a group is missing in total. But it does not, by any means, show the whole picture, and so, particularly, you will find that young men tend to be missing from lots of things. Young women tend to be reasonably well represented, because of childbearing and fertility issues that get well captured in the system.

Some of the coding in the data is quite poor, if you look at NHS coding for ethnicity or other things. I think now that we essentially have a system based a lot more on equality, with protected characteristics, we also have to use multiple other data sets to make sense. So, we applied for and were given access to link in the census data into the COVID data from 2011, and that was very important in our ability to understand who was getting sick and how the vaccines were working or not. And so we have a piece of collaborative work now with Public Health Wales that looks at vaccine, the ethics of vaccination and the uptake by different groups, and the census data allows us to demonstrate that particular groups actually are at higher risk of some diseases, and also uptake in some of those groups isn't nearly as good as possible.

A general point I would make is that, in the US, there has been quite a furore over a number of algorithms that were shown to discriminate against the black community in the way they were designed. It's really important that we bring all these data sources together in Wales to ensure that any algorithms that are developed and used do not discriminate against any subsection of the population.

Thank you very much, and just one final question, before we go over to Sioned. Are you absolutely confident that data available in health services and the collection of data from groups that are underrepresented—for example, BMAE groups, et cetera—are you confident that that data is being collected? Thank you very much.

Sorry, I think I just—. I'm not sure I quite heard which group you referred to.

Yes, I didn't understand that. Which is the MAU group, as translated?

BAME; I did say BAME. Sorry.

Ah, okay. Right, sorry.

Yes. So, no, I am not convinced that the quality of the data in the NHS is good enough for that. We have done a piece of work in which we looked at 17 different data feeds from the NHS about the quality of coding on ethnicity and also merged that in with the census, and, if we weren't using the census, we would have a very poor uptake of that. So, I know that collection of information on ethnicity has been mandatory for many years in the NHS right across the UK, but it's still not brilliant, so it is something that does need to be improved. It is quite a controversial issue, and it's not easy to know exactly when is the best time to ask the questions, but I wouldn't be confident that the NHS measurement of ethnicity is that good.

Very good. Sioned Williams.

Thank you. And just to follow on from that, therefore, you mentioned ethnicity there. What other main areas in relation to data do we need to get data and research on, better data and research, or more data and research, and the differences between them? There's been much mention, for example, of the fact that women are often not represented within medical research, and that that's led to problems for them, and treatments found aren't necessary, and women not being considered properly in the health service, because it's a male model that's been used as a basis to develop treatments. So, I'd like to know what your comments are on that, please.

Okay. Thank you. No, I completely agree with you. I think it is probably a bit more wider than sex or gender at this stage, because there are actually nine protected characteristics under equality legislation, and we do need to ensure that we have the data available to answer all of those. But you're absolutely right in that there are many treatments that were tested on men and not tested on women. There's also the same issue we have in that lots of drugs were tested on adults but not on children, and are used on children. And so we also need to be able to see how well these drugs work in the general population and subsections of it. And that's why there's quite a lot of research—using the SAIL Databank and others—on what's called real-world evidence, about, if we look at the treatments that people have and their underlying conditions, do we find the same outcome in the people who were included in the trial and the groups who were excluded from the trial. I think that part is very important, because we do need to fill those gaps in.

The thing about pharmaceuticals is that they work in some people for some of the time. They're not perfect for everything and they don't always translate from the group that they were tested in to other groups. It's really important that we find out those things, because, if they're particularly not working very well in a group, then we need to be searching for other solutions for those groups.

Thank you. So, just to be clear, you're of the opinion that, for all of the protected characteristics, there is room for improvement to get data and research on all of those. And, finally, in SAIL, do you assess the impact that your research is having?

Okay. Yes. So, we are at the moment in a discussion about the ability to access data on the protected characteristics within NHS data. We have agreement from the Office for National Statistics to do that in the 2021 census, which will allow us to do that very well. Sorry, the final question—?

I just wanted to ask you, in terms of SAIL, how do you assess the impact of your research? What impact has your research had and how do you assess that?

Right. Okay. Yes. So, virtually all research that we conduct nowadays has to have an impact statement. So, when you apply for funding, not only do you have to describe what you're going to do, but you also have to describe the pathway to impact and how you will measure impact. And we measure impact using multiple different tools and routes. Some of that impact is uptake, and that is either uptake of the research by the clinical community or the population group that we're talking about, how it fits into policy documents, whether they are Government policy documents or NHS policy documents, for how many people has that led to a change in treatments or behaviours and the impact that those have on lots of things.

I think probably one of the best examples at the moment was the work we did with colleagues across the UK—so, in England, Wales, Scotland and Northern Ireland—on vaccine safety. That was fed into two groups particularly, the Joint Committee on Vaccination and Immunisation, who look at what we do on recommendations on vaccinations, and the Medicines and Healthcare products Regulatory Agency, which looks at the licensing of drugs. So, we could actually demonstrate what the impact of the vaccination was on outcomes and compare that to people who weren't vaccinated versus the impact that people would get from the natural infection, and also do the same on some of the concerns that were there about side effects, which are fairly rare. Essentially, all of the side effects are also more common in people who haven't had the vaccine than otherwise. So, there's a context to that.

So, we work with lots of different groups on impact and use multiple different ways. And we consult fairly widely with the members of the public that we're involved with when we're in a design phase, to ensure that we measure outcomes that they feel are important to them. We were doing some work some years ago with Care and Repair Cymru, and an evaluation of what difference their services made. And so we looked at a number of indicators, and that included actually admission to nursing home, if you like, as an adverse indicator, because they were feeling that, if you like, the protection of independence and maintenance of independence was really important. So, we do look and have discussions with lots of groups on the appropriate outcomes.

Thank you. Thank you, Chair.

Just a final question from me, which is around the issue of children with protected characteristics. We saw how that played out over COVID, obviously, in that children were asked to do things in order to protect adults that weren't necessarily in the best interests of children. How would you get around that, given that children can't consent themselves to X or Y, and it's often difficult for parents to know whether this might have an adverse impact on the child?

Whilst the vast majority of the data, as I say, in this standard SAIL thing are all de-identified in that, there is also the ability to actually de-identify data from surveys and bring those into the SAIL system. I have a colleague, Professor Sinead Brophy, who has a network about physical activity and educational outcomes in children. They were involved in quite large surveys over the COVID period on children's experiences and what difference they made. Through the usual system, they anonymised that to bring it in, and actually bring in those other viewpoints. We do that also with the national survey for Wales, and we do it for a number of cohorts, like UK Biobank and others. The way things are going, actually more data on people's experiences and preferences and that built into the system would help enormously in making sure that as many viewpoints as possible are included in the analysis.

Okay, thank you. Well, it's another subject, all of a sudden.

Thank you very much indeed for your attendance today. We'll send you a transcript, in which I invite you to make sure that we've captured what you've said accurately and to correct it if we're wrong. Thank you very much indeed for your contribution to this important subject.

Thank you very much. Diolch yn fawr. It's been wonderful. It's my first committee. I have to give evidence at the COVID one, so this is a good beginning.

Oh, well this is just a run-up. Very good.

Before we go into private session, can Members agree that there are four papers to note, including the supplementary pack that was sent, around the LCM on illegal migration? Thank you very much.

So, under Standing Order 17.42, can we agree to exclude the public for the remainder of the meeting? Oh, Sioned, sorry, I didn't see your hand. Please do go ahead.

Sorry, Chair. Just on the paper from the NSPCC, just a suggestion, because the Children, Young People and Education Committee is doing an inquiry at present into care-experienced children and reform, I think it would perhaps be wise to send a copy of the letter to the Chair, Jayne Bryant, because it would be very relevant. The committee is currently working on the report, so it would be very timely, I think.

Very good. We'll certainly do that, I'm sure. Jane Dodds.

Yes, I wanted to say a word about the same letter also. I completely agree with what Sioned has said there, but I also hope there will be an opportunity for us to perhaps discuss this, looking to our agenda also. That's all I wanted to say. Thank you.

Very good. Thank you very much indeed. So, we'll now move into private session.