Health and Social Care Information Centre (Transfer of Functions, Abolition and Transitional Provisions) Regulations 2023

Baroness Merron Excerpts

Wednesday 25th January 2023 Lords Chamber

[Lord Allan of Hallam (LD)]

My Lords, I am grateful to the noble Lord, Lord Hunt, for ensuring that we have an opportunity to debate this statutory instrument. I am also grateful to the Minister for both his initial response to the amendment and the time that he and his officials have spent responding to queries from me and my noble friends Lady Brinton and Lord Clement-Jones.

I revealed in yesterday’s debate how I started my tech career in the Avon Family Health Services Authority. From there, I moved to the FHS Computer Unit and worked on national NHS IT, so this reorganisation has a special interest for me. The subsequent path of the system that I worked with, which was called the Exeter system because the developer hub was in Exeter, is illustrative of the constant reorganisation of NHS IT, of which the latest example is in front of us today; I note in passing that early versions of the Exeter system were written in a language called MUMPS, like the disease but in capital letters, proving that geeks do have a sense of humour. The FHSCU was incorporated into something called the NHS Information Authority, which was then split between the National Programme for IT—NPfIT—and the Health and Social Care Information Centre. NPfIT was later rebadged as Connecting for Health, while the Health and Social Care Information Centre found its way, via a couple more name changes, into NHS Digital; this was referred to by the noble Baroness, Lady Finlay of Llandaff.

It can feel like the architects of these reorganisations have drawn inspiration from peristalsis, the process that moves food through the body by contracting and expanding the gut. The belief seems to be that we can make progress with NHS IT by pulling everything to the centre then pushing it out again to the edges in a cycle of rinse and repeat. I fully expect us to be back here in a few years’ time being told that we have lost focus by pulling everything into NHS England and that we need to create some kind of new stand-alone agency. We might call that new body the Unified Trust Operational Process Information Agency, or UTOPIA for short—there is some free branding advice for the Government.

The serious point here is that, in spite of—or perhaps because of—these reorganisations, the NHS still has information systems that fall well short of what is possible and desirable. There are many excellent people who work in NHS IT, and there are examples of great systems being developed, but we cannot say that there is consistent excellence, which is what the service needs and deserves, as noble Lords have said. I sincerely hope that we might get it right in the public interest this time, but experience suggests that we should remain cautious and test thoroughly what we are being offered.

An early test for this new structure will be the mega contract that has just been opened up for bids to provide a federated data platform, to which my noble friend Lady Brinton referred and which looks like it will cost the taxpayer at least £500 million; that is the number on the face of the contract, and God knows what else will need be spent by trusts on ancillary services. We will be asking searching questions of the Minister at all stages of the development of this project, as some elements are already triggering the spidey-sense of those of us who have seen too many big NHS IT projects go south—by which I do not mean going to Exeter but further than that.

As well as the structural questions about whether this reorganisation will achieve its core purpose of improving IT support for health and social care, there are concerns about what it will mean for the treatment of personal data. The noble Lord, Lord Hunt, and my noble friend Lady Brinton have done a thorough job in describing those concerns so I will not repeat their arguments in detail. However, I want to reinforce their emphasis on the importance of independent oversight. I have worked in technology organisations and have huge admiration for the way in which software engineers, researchers and data scientists tackle problems using data, but their deep focus on addressing problems is not always accompanied by the same level of interest in documenting and getting approvals for all of their uses of data. This is not usually because they are doing anything wrong but because they are in a hurry to explore a task that we have given them. Given this tendency, it is essential that we put in place good governance systems that do not get in the way of necessary uses of data but ensure both that these are properly considered and that any risks are surfaced and mitigated.

As other noble Lords have argued, the IGARD system, which worked for NHS Digital, has broad support. We need something equivalent in this new structure. I ask for the Minister also to consider additional forms of transparency that will help people have confidence that data is being used appropriately. The overriding principle here is that you do not want people to feel surprised that particular kinds of data are being collected or used for particular purposes. A healthy discipline that will help avoid surprises is to ensure that the data schema and software code are made public, as this allows third parties to see for themselves what is going on inside the black box. This is not about publishing all the data held in the databases, which needs to be managed separately; it is about showing the kinds of data that sit in different systems and informing us what the systems are doing with them.

There is a common trope that Governments like to trot out to reassure the public and show that something is safe: putting in place a triple lock. This is part of the Government’s rhetoric around the Online Safety Bill, for example. I invite the Minister tonight to commit to a quadruple lock in this case, given the importance and sensitivity of health and social care data. Lock 1 is the commitment to meeting fully all the data protection standards that are already in place for NHS Digital and in the general data protection regulation. Lock 2 is to ensure there is a truly independent body assessing and authorising requests to use data. Lock 3 is the publication of data schema so that we can see the full extent of what is being held, and where. Lock 4 is the publication of code that will allow people to check that what was authorised is what has actually happened.

I hope that this reorganisation will both lead to positive technology outcomes and avoid negative data outcomes. The NHS needs success in these areas more than ever. I also hope that the Minister will agree that our scepticism on these Benches is healthy and makes it more, not less, likely that we will see those outcomes. Onward to UTOPIA.

[Baroness Merron (Lab)]

My Lords, I thank the Minister for introducing these regulations and for the assurances he has given your Lordships’ House. I also express my appreciation to my noble friend Lord Hunt for what, as other noble Lords have said, was an extremely detailed and helpful examination of the challenges that these regulations present. I hope that the Minister will take his amendment and this debate in the spirit which I know is intended.

I share the view of all noble Lords who have spoken this evening that digital transformation of the NHS is a good thing; on that we are agreed. We all support the use of information to make things better for patients. However, this is about getting it right, and I hope that the debate this evening has contributed greatly to that. It is about confidence. As the noble Lord, Lord Allan, just said, people should not be surprised. They should also not find themselves compromised, uncertain or in any way undermined by the use or misuse of data. That is the challenge before us.