17
Examination of witness
Professor Cathie Sudlow.
Q86 The Chair: Welcome to the second part of this morning’s session. We are very pleased to have Professor Cathie Sudlow as our witness, director of the Usher Institute at the University of Edinburgh, who is coming in online. Professor Sudlow, you are very welcome.
I am going to start with the first question. Your review uniting the UK’s health data was published in November 2024. Could you give the committee a brief summary of what you have found? I think you concluded that the UK is, and I am quoting, “simply not maximising the benefits to society” from its health data and “even slipping backwards” from what had been achieved in Covid in some respects. So, what in your view are the barriers to using health data for research? What is going wrong and why has it been so difficult to fix? Perhaps you could start with those questions.
Professor Cathie Sudlow: Yes. Thank you, and thanks for the opportunity. Just to give you a little bit of context, I am a medic by original trade, a neurologist, and I have worked for 30 years in the NHS, but I also have training and expertise in epidemiology, population health and data. I wrote this review while I was working as chief scientist for Health Data Research UK.
Prior to that, I had been chief scientist for UK Biobank for about eight years, which this committee also has a great interest in. My current post is at the University of Edinburgh, but I am also running a new initiative called the Adolescent Health Study, which is funded by UKRI and is a major new national initiative. It is a bit like UK Biobank, but in a different age group, so in young rather than middle-aged and older people. That maybe gives you a little bit of a context.
The findings of my review were based on my own experiences, of course, and those of many of my peers and colleagues over many years, but also on consultation with hundreds of individual and organisational stakeholders over a period of quite a number of months. First, you will be aware, of course, that health data are generated in every contact each of us as patients has with the health service, whether it is the GP or hospital, or even at a high-street optician performing duties for the NHS, for example. These are both generated and used safely and well every day, to improve people’s health and lives.
People in general are very supportive of the use of these data, not only to deliver their own healthcare but to benefit other people as well. We will maybe come on later to some of the caveats they have around that. However, it is important to understand that from surveys, qualitative discussion, focus groups and so on, going on over the last 10 or even 15 years, that position has not shifted. Some 75%, 80%, or sometimes in excess of 90% of people, depending on what questions you ask them, are generally very supportive of the uses of their data for broader benefits.
A third point is that the UK has very abundant and rich sources of health data, arising not only from the healthcare system—mainly the NHS, of course—but from beyond it. To outline briefly those sources of data, we have data that are brought together at national level which are nationally collated data assets. These are things like hospital episodes, national medicines, prescribing and dispensing data, our death registers, cancer registers, and others beyond that, that are brought together at the level of each country in the UK. Those are very important. They are not particularly granular, but they have huge potential because of their comprehensive coverage of the whole nation, or the whole of our four nations.
Then, we have more granular, detailed, less well-structured data that is held largely in regional or local organisations, primarily the NHS again. For example, these could be radiology images or the free text in all of our electronic health records, which is not structured into spreadsheet-coded format. Then, of course, we have data from our own personal monitoring devices, increasingly wearables and apps and so on. They generate health data that is relevant to our health every day. We have data from environmental monitoring, for example from weather and air pollution monitoring systems. We also have health-relevant administrative data from sources well beyond the NHS, from other sectors—for example, social care, education, disability, justice and others. Then, importantly, there are data generated by the participation of individuals across the population in research studies, generally with their consent. For example, there are large cohorts like UK Biobank, Our Future Health, the Genomics England studies and a wide range of clinical trials beyond that.
An important point is that the transformational insights from the uses of these data come less from their individual uses—although as individual datasets, they are pretty helpful and useful—than from the linkage of those at individual level to each other. So, for example, you can follow 500,000 participants in the UK Biobank study by linking to their health records at individual level and pulling those health records in alongside the other data that are generated directly from those participants, just to give you one particular example of many potential ones.
There are many obstacles and delays to accessing individual data assets, but more importantly, to linking those datasets together and enabling analyses of them. You have heard from Professor Morris and many others about people sometimes waiting months or years—or simply giving up or not even bothering to start—because of the perceptions and realities around those delays. There are notable exceptions, and those are very important as well, but long waits and delays have been the broad experience.
These barriers arise from the complex and inefficient systems that we have for managing and accessing data in the UK. Those are sometimes technological. Many computer systems operate across the NHS; they do not always talk to each other very well. We have a number of different technological solutions for access to data in a research setting that do not necessarily talk to each other or work coherently together very well, which is what I might call computer system complexity. We then have considerable legal, regulatory and decision-making complexity. Since the laws are difficult and complex, and different across the four nations, they are difficult sometimes for people to interpret. If you have multiple decision-makers on data access along a chain of decision-makers, all of whom have to say yes to allow something to happen, it only takes one party in that chain to say no and the whole thing comes crashing down. That kind of complexity is very unhelpful when one is trying to streamline and accelerate access to data for patient and public benefit.
These complexities delay and prevent many broad, crucial analysis and research studies about health conditions that affect all of us, because all of us will get sick from something at some point in our lives. We are letting everyone in the country and their families down as a result of not having a better, more streamlined system to overcome those complexities.
A final point is that, through emergency legislation, there were improvements in access to linked data for crucial Covid-related analyses during the pandemic, with both legislative and regulatory changes that improved access. However, several of those have been withdrawn, despite clear demonstrations of benefit and the potential for similar data access mechanisms to similar datasets to actually provide benefits of equal, and indeed much greater, magnitude, to prevent, diagnose and treat many other conditions that one might also regard as global pandemics or UK-wide epidemics or pandemics—for example, heart disease, stroke, cancer, diabetes, arthritis, dementia, mental health conditions and more. Learning from what worked during the pandemic but maintaining that is a very important lesson that I have drawn attention to in my review.
The Chair: Thank you. That is a very interesting start. Would you like to make a suggestion of what are the most important datasets to try to standardise and link together?
Professor Cathie Sudlow: Although I have outlined a lot of broad sources of data, it is worth focusing first on those datasets that arise from the NHS, because they are core and fundamental. There are four key data assets that are foundational and important across all health conditions and pretty much all areas that it is worth focusing on.
First, GP data or primary care data, as you have probably heard from Andrew and likely from others in providing evidence to this inquiry, have been particularly problematic and difficult to access for a range of reasons that we can go into if you like. That is because most healthcare actually occurs outside of hospital. Most health problems are managed first and mostly in the community, so not being able to access those data removes the potential to investigate and understand where most conditions are first managed, which is particularly important in the context of a shift towards preventive rather than reactive healthcare.
Secondly, we have fairly good data from hospitals at national level across all countries of the UK in the form of hospital episode statistics or similar data assets. There are some weaknesses there in the speed of provision and the granularity, so those are things that could be improved with respect to hospital data. There are mortality data, because we all die from something, and understanding what people die from and whether they die early from particular causes is very important. We have national death registers in each country of the UK, and those need to be very much part of the mix. Finally, there are medicines prescribing and dispensing data because, for many health conditions, medicines are important. There are available resources about medicines prescribing and dispensing across the nations of the UK that are relevant to a vast array of health conditions. Those are the four key sources that should be the primary focus.
They need to be available on a national scale, they need to be linkable to each other and to other assets at an individual level, and they need to be available for linkage to research studies and research initiatives such as UK Biobank, Our Future Health and clinical trials, as well as being linkable to each other in national secure data environments.
Q87 Baroness Willis of Summertown: I will ask about the five high-level recommendations from your report, and maybe this is one of them. We heard before about the problem of the slowness and the complexity of trying to get data for research from these fantastic databases. It is about joining them together, and all the complexities you have just beautifully—or alarmingly—outlined. Who in your view should be responsible for removing those complexities to make this a streamlined process?
Professor Cathie Sudlow: Ultimately, this is the business of government, because the delivery of good healthcare is the business of government, as is the delivery of health, wealth and prosperity to the country. But of course there are many organisations that have responsibility for this. There is more than one government department, of course, and there are four nations—just to add complexity to that, if we take a UK-wide perspective. So the primary departments are probably the Department of Health and Social Care and the Department for Science, Innovation and Technology.
Then there is the NHS and what has been NHS England, now being reincorporated into the Department of Health and Social Care, as I understand it, as well as a range of other national-level organisations. A key is that those organisations need to work together. Actually, one of the recommendations I made in my review, which might have been somewhat naive, was those organisations signing up to some sort of concordat—I do not know whether it would be legally binding—to actually work together rather than work orthogonally or at odds with each other, which I think sometimes happens, not necessarily through people being deliberately awkward about it but just because of the complexity of many organisations that have skin in the game. But it is at least important to understand what those organisations are, what they currently do, where there is duplication of effort and the need for them to align.
Ultimately, it is a government responsibility. I am pleased that the Health Data Research Service is now coming into being, because organisationally that could play a major and key role in that co-ordination function of the different bodies that need to come together and align to take this forward.
Baroness Willis of Summertown: I know very little about this subject, apart from this morning, but it sounds to me like we need someone or some organisation to take responsibility for joining this up, or we will be in exactly the same place or worse in five years’ time. So that was one of your recommendations, but could you take us through your review’s other high-level recommendations?
Professor Cathie Sudlow: It is worth saying that the recommendations of my review all toggle around that notion of setting up a high-level service to take responsibility for this and perform that co-ordination function. The first recommendation I made was that our health-related data should be regarded as part of our critical national infrastructure. Actually, when I wrote that recommendation down initially in my review, I did not even know what the formal definition of “critical national infrastructure” was. It was pointed out to me that there was a formal definition. I subsequently found out what it was, and I agreed with myself even more firmly that that was a reasonable recommendation to make. Of course, the health service is part of our critical national infrastructure. But specifically focusing on the data that arises from that service, as well as the other health-relevant data assets beyond the health service, and regarding that as part of that infrastructure is important.
Clearly, this notion of what I called a “national health data service” in my review has slightly changed into this concept of a Health Data Research Service—there may be some important nuances there. But, anyway, I am delighted that that is coming about.
Baroness Willis of Summertown: The UK Biobank and many of these other databases, which are excellent, effectively do not come under the umbrella of the National Health Service, do they? Am I misunderstanding that?
Professor Cathie Sudlow: No, they do not. I would define UK Biobank as a health research initiative that is run outside the NHS but is critically dependent on the ability, with the consent of its participants, to link to NHS records to enhance the information that it holds about the participants and to follow their health longitudinally over time. As a long-term study, that is a critical and important component of its design.
Baroness Willis of Summertown: In terms of your recommendation, then, where would something like the UK Biobank fit? Would that fit under this National Health Data Service?
Professor Cathie Sudlow: UK Biobank would be one of the assets that this national health data service or Health Data Research Service would have a concern with. Some of the functions of that service[1] that I recommended were that we need the notion of a single front door—a single national health data access system—so that researchers, whether they come from academia, from within the NHS, from charities or from companies, all of which might have an interest in this, have a one-stop shop to go to.
For some mature assets like UK Biobank—or some that are maturing very rapidly, such as Our Future Health—that have their own efficient front-door mechanisms, HDRS might act as a signpost to them, where they are appropriate resources to go to. But it should also then help to co-ordinate the access to the health data assets held within the NHS and potentially beyond—access to researchers but also access for key research resources. UK Biobank is one of the organisations that has struggled to access some of the datasets from the NHS to link data for its participants in order to make those available for its huge multi-thousand-person research community, for example. So that would be one of the functions of this service, as well as setting up a streamlined and standardised system for data governance and access, rather than multiple decision-makers along a chain with highly complex processes of decision-making.
I have highlighted several key datasets, with particular emphasis on general practice data. We need to lay out a road map of the data assets that to focus on first. There is some good guidance in my review and elsewhere about how that road map might be developed. Then we need to streamline and speed up the access by putting in place these nationally co-ordinated systems, focusing on the initial foundational assets and then gradually spreading out to involve more and more granular and comprehensive sets of data—from imaging, genomic resources and so on—to complement those that are already incorporated.
That organisation (HDRS) could help with, or even take on, the co-ordination of engagement with patients, the public, health professionals, policymakers and others, which is a very important component of this sort of endeavour that you have heard about from Andrew Morris. It might not do this all itself—it might commission it from others—but it could play a very important co-ordination role to make sure that that is done in a co-ordinated and comprehensive way, rather than somewhat piecemeal, as is currently the case.
Then it could preside over a UK-wide approach for data access processes and for standards and accreditation for the secure data environments that are usually now the major way in which researchers access data. Rather than taking it away, they access it where it is within these secure data environments that act like reading libraries rather than lending libraries.
Baroness Willis of Summertown: That is really helpful.
The Chair: Lord Patel, I think that Professor Sudlow has already answered some of the questions you were going to ask.
Q88 Lord Patel: That is right—in answering this question you have already answered some of the questions I was going to ask, which were about your vision for the Health Data Research Service that the Government have set up. But what I can ask is: what do you think the metrics of success would look like for the service in the short term?
Professor Cathie Sudlow: To some extent, it will be up to the service to develop its own metrics—but not in the sense of marking its own homework. An early component of what will be required is establishing a road map for key data assets and key services, moving towards that single front-door point of access for those.
On success metrics, the sort of thing that might be helpful would be, for example, the number of projects and programmes supported, and the time to access required from the point of application through to actually being able to access and work with well-curated, high-quality data. There might be some targets set around that time to access, but at least being able to measure and monitor that sensibly, well and transparently would be very helpful.
Other metrics that might be helpful would be around the range of organisations accessing the data. We know that some services are more accessible for NHS, academic and public sector researchers than they are for those from industry. Being able to offer access to a broad range of organisations with appropriate guardrails and then report back on that would be very important. Support for recruitment and follow-up in clinical trials and other major studies could be an important measure and metric.
Obviously, in due course, what matters are the impacts of these projects. That is harder—it takes longer for those to develop and they are harder to measure—but the service might want to think about how it would capture those to display and describe to patients, the public and of course the Government—who are investing in this—the fruits of their labours.
Lord Patel: Following on from that, how good has the NHS data infrastructure been hitherto to fulfil that and the Government’s ambition, in both the 10-year health plan and the cancer plan, to use genomic data linked with other data to particularly focus on the prevention of diseases? Is that a reality with the current NHS data infrastructure?
Professor Cathie Sudlow: We have to start with what we have that we know works well, or could work well. As I described earlier, we have some fantastically valuable national data assets. There have been issues with access to GP data, although those have started to be fixed through the implementation of legislation, through Secretary of State directions, to help with that and to some extent relieve GPs of their liability as thousands of individual data controllers, which is one of the several blockers to access to GP data.
It is worth the services being set up under HDRS focusing on the things that are already happening that could be maintained, enhanced, scaled up and sped up. We could look at our NHS and say, “Oh, it’s chaos. There are lots and lots of different computer systems. They don’t interoperate very well. There are lots of problems”, and go for a complete redesign. But of course that would be unrealistic: the service has to keep running, and we have some key assets that are really worth investing further in.
It is important for HDRS, as the body that has major potential to play a leadership, co-ordination and delivery role in all this, to recognise that some things that are being done are not of such high quality or are unnecessary duplication of effort and resource, and to be bold about standing down or decommissioning some activities or assets that may be less necessary.
It is worth the Health Data Research Service thinking about its role as a potential data controller, perhaps taking on the data controllership of some of our national data assets, to make it easier for it to sit at the single point of access and have the levers to enable swift and streamlined access.
So there are definitely some things to fix, and the NHS is not optimally positioned. But there are some assets that we already have that should be maximally exploited for public and patient benefit as a starting point.
On your point about genomics, we have fantastic genomic data in this country, and much of it has come through the efforts of major research initiatives, working directly through and in partnership with the NHS—for example, Genomics England and the assets that it has created, as well as Our Future Health and, before that, UK Biobank. These have all generated fantastic, world-leading and internationally highly recognised and valued assets that link genomic data to other types of data about participants who have consented to be part of research studies.
When I looked at this for my review, my understanding of the NHS’s own genomic data—with a particular focus perhaps on England, as the largest of the four nations—was that, where Genomics England has co-ordinated national scale efforts to, for example, provide genomic sequencing data services for the NHS, that has in general worked well. There is more of a challenge with the fragmentation of services provided through regional genomic services, although other experts would give you more up-to-date and granular information on that.
But nationally co-ordinated efforts that use national resources that we have at our disposal are to my mind worth investing in adequately to ensure that they can deliver for and with the NHS in a co-ordinated way. Some of the regional genomics medicine services have not had the digital and data maturity that they need to be able to deliver at the kind of scale that would underpin the ability to link genomics data from the NHS to other datasets at entire-country level.
The Chair: Lord Winston?
Lord Winston: I think my question has largely been answered.
The Chair: So do you not want to ask about data security and public trust?
Q89 Lord Winston: One of the issues that I still feel we have not quite covered properly is public engagement. You suggest that it can be conducted by a big body in the way that you say, but actually public engagement is a highly skilled process; it is not simple. Do you not think we should be thinking about public engagement in very different ways? For example, we have just heard that one thing that really does engage the public is when we have a clear clinical success. A lot of the time, people who look at these data do not see that as a success that they are likely to enjoy, but they are worried about their privacy.
Professor Cathie Sudlow: I entirely agree with you. Actually, I would not suggest that a large national organisation should necessarily deliver all public engagement centrally in some way. I was more suggesting that the co-ordination and national understanding of what public engagement efforts are going on, how they are being delivered and how they are informing how we take the temperature of public opinion, for example, could be better. Quite a lot of organisations are doing this now, and it can be quite difficult to understand the apparently different results that they seem to come up with. So co-ordinating those efforts, but not necessarily having them all delivered centrally, is the point I was trying to make earlier.
On segmenting and understanding different sectors of the population, some people want to know more than others and some people need information delivered in different ways: through the internet, through apps, through direct personal engagement, et cetera. Understanding different age groups, different ethnic groups and different socio-demographic groups across society is incredibly important here. There are organisations that have made fantastic efforts in that regard and that the Health Data Research Service might want to commission or engage with in delivering this ongoing tempo of engagement that you heard Andrew Morris refer to earlier.
On engaging with patients and members of the public more broadly, I agree entirely that giving them repeated examples that show how their, their family’s and other people’s data is being used to benefit them and others through telling and demonstrating repeated stories, rather than just telling them that it works and is great—giving them real-life examples—is important.
Engaging with health professionals is also incredibly important—not least GPs—ensuring that they are aware of the uses of the data that originates in their surgeries, clinic rooms or whatever, and that they are engaged with, supportive of and part of the process as well. We have probably done a better job, over the last 10 or 15 years, of understanding and taking the temperature of patient and public opinion, and a slightly less good job—sometimes a much less good job—on that when it comes to health professionals.
Lord Winston: Is not one of the issues education? Forgive me for saying this—it may sound a bit bold—but even at the political level we are not very well educated about genomics. For example, when we hear ex cathedra suggestions that we might screen all babies for genetic diseases, there is very little understanding of why that is a highly improbable and really rather dangerous concept.
Professor Cathie Sudlow: I agree with you entirely that part of what is needed is not just informing, engaging with, understanding and improving the views of members of society more broadly but also doing so for policymakers, politicians and others who are involved in making and taking decisions for all of us. I think that is what you are referring to. If so, I agree with you entirely.
Of course, we all need to understand the use of genomics data, genomic screening and genetics being incorporated into prediction models, into understanding risk and into diagnosis. It is quite nuanced, of course. I think you heard earlier from Anneke Lucassen, who was very helpful, informative and reflective on this, and very transparent and honest about it as well: there is a difference between a genetic diagnosis and a genetic prediction. But, in general, that is true of the use of other data to predict. It might give you a probability, but it does not tell you that something will 100% happen or not happen in any individual. Having dialogues that help all of us involved in this to understand better those nuances and subtleties is of course incredibly important.
Lord Winston: I agree with you entirely; I just wonder whether you would not suggest that we are labelling ourselves dangerously just by calling it precision medicine.
Professor Cathie Sudlow: Yes, that is not my label, and I am not quite sure how the nomenclature for this committee’s current area of emphasis came about. We talk about personalised medicine and precision medicine, and those issues are often conflated with genomics. But, actually, personalised medicine and precision medicine are in my view about making decisions and targeting treatments as appropriately as the data and knowledge allow us to for individual patients. But, to do that, we need access to data and we need to be able to conduct research studies on data at a very large scale to understand and inform individual patient practice. I am sure I am telling you stuff that you know only too well, Lord Winston, but I suppose those would be my reflections on that. Sometimes the use of these terms is not particularly well understood, or they may be used differently in different hands, so it is probably important that we are always clear what we are talking about when we use those terms.
Lord Winston: That was very helpful.
Q90 Lord Drayson: Professor, could we now turn our focus to the thorny issue of commercial use of this data, particularly in the context of the hugely accelerating adoption of artificial intelligence across all aspects of society, including health? We have heard from the Minister for Health Innovation that there is a government imperative behind making health data more accessible to grow the economy and to provide a return to the taxpayer, so to speak. How practical and effective is the Government’s approach to this? If you could be specific, that would be really helpful. In particular, how does UK Biobank, for example, provide a return to the UK taxpayer, and how will the new £600 million investment in the new Health Data Research Service provide a return to the taxpayer?
Professor Cathie Sudlow: I do not run either of those resources, so I could not comment on exactly how decisions are made about how that is done from a current perspective. I can speak about UK Biobank with some authority, but based on my involvement in it prior to the pandemic. But I will have a go at answering your question.
The first thing to say is that, in my view, we have to embrace the opportunities of AI because it is there and, if we do not, others will and they may not do it so well. So we should do that, and we should do it as well as we can. The principles and safeguards around access to data for the application of AI are broadly the same as the principles and safeguards that need to be in place for access to data for other forms of data analysis. There are some added challenges for more advanced analyses and for AI in particular, which we can come on to if there is time and interest—
Lord Drayson: I am sorry to interrupt you, Professor, but my question was about the commercial return, and your review did address that issue. I am interested that, as we are all aware, the ability to use data for health research requires access to datasets, and it therefore requires data storage and software. The UK—the NHS—has predominantly purchased software from American technology companies such as Oracle in electronic patient records and Palantir in the federated data system. You have emphasised the importance of the secure data environments, in which obviously Palantir is heavily involved.
Your review took place before the current very negative developments in geopolitics and the relationship between the UK and the United States. So I would like you to give your view on whether it is appropriate for the UK Government and the NHS to continue to procure these systems. For example, we heard how all the genomics data is stored at Amazon. What is your view on this?
Professor Cathie Sudlow: To some extent, we need to ensure that we use the best and most secure systems, and those will not always be provided by companies that operate from a primary UK base. But my understanding is that, where data are held or managed on behalf of the NHS, that is done on servers that operate within UK national territory.
Lord Drayson: Professor, are you suggesting that the UK does not have the know-how, talent and ability to do this—that we are forced to use these American systems?
Professor Cathie Sudlow: This is not my area of expertise, but I do not think that is wholly the case. In general, we should use the systems that are best equipped to provide the services available, that provide the privacy and security needs, and that are affordable and are the most cost-effective systems available.
I guess your point is that there may be benefits from ensuring that companies that invest in and base themselves in the UK are very much more a part of this environment. I have heard some of your comments when interviewing people previously on this, and I completely understand the point here. There are potentially ways in which we could do this better.
Lord Drayson: My question is really about how the UK taxpayer is going to benefit when the NHS keeps buying software from American companies headquartered in America, where the tax revenues go back to America. We heard from Professor Morris earlier an excellent description of the principles that should be used. One he mentioned was avoiding vendor lock-in. Inherent in the structure of both the Oracle and the Palantir systems is vendor lock-in. My question to you is: given your review and so forth, do you believe that it is wise for the UK, particularly in this geopolitical environment, to continue to purchase systems that effectively lock in the NHS to these suppliers?
Professor Cathie Sudlow: The first thing I should say is that my review was more about the provision of data for research. The function of Palantir is to provide services within the context of the NHS, which is a slightly different function, although I did comment briefly on Palantir in my review. I should defer to your good selves on how this might be effected through legislation, other means and procurement opportunities—contracting and so on—but I think it would be possible to have some guardrails around the types, locations and nature of companies engaged in these endeavours.
Some of the issues with Palantir have not been with the quality of the service, the privacy and security benefits, or the other benefits that could come from the use of what it has on offer but more with the positioning of of that company, where its profits are made and some of its other activities, including the statements from those who run the company, and so on. I do not have enough expertise in legislation or how these companies are commissioned and procured to understand how best that could be done, but I am sure there could and should be opportunities for better procurement that fits within the public appetite and ensures that the value comes firmly back into the UK.
There are some methods for doing that. I take UK Biobank as an example because I am reasonably familiar with it. It is an example of how things might work at an NHS-wide, whole-country scale. If we create a data asset that companies want to use and improve because it is in their interest to do so—here I am talking perhaps more about large pharmaceutical companies—they might be attracted to invest in it through pre-competitive investment models. That has worked well with UK Biobank. A lot of investment has gone into it to improve and enhance the resource that has come from, for example, big pharmaceutical companies. Mechanisms such as that, with pre-competitive investment models that do not involve exclusive deals with particular companies, might be one way in which to bring investment into some of our NHS and health-related data assets.
Lord Drayson: That is really helpful. I have just one question: you and several witnesses have mentioned how, during Covid, the Government had an amazing ability to create an environment whereby the barriers to doing this work were removed, effectively overnight. Unfortunately, those barriers have been reintroduced. You said this is a responsibility of government and I accept that, but, from your review, where did you pinpoint that the decision was taken during Covid to remove those barriers? Where was the decision taken to put them back?
Professor Cathie Sudlow: I believe it was at Secretary of State level.
Lord Drayson: Was it the Secretary of State for Health?
Professor Cathie Sudlow: Yes, I believe so. Most of the improvements came on the back of Secretary of State-issued directions about the uses of health data linked to various other Acts, such as the NHS Act and others. These apply mainly in England. Their withdrawal was because they were written for Covid-specific uses and purposes, as emergency powers. But there have been a couple of instances since then, which I pushed for in my review and I am pleased to say have been implemented, of steps towards improving access to GP data through the use of those directions. It is not all sorted and is not a done deal, but there is the potential to use legislation as a tool. It is one tool but not the only one. It is one area where there is the potential for more development, though.
Lord Drayson: That is really helpful, because you have identified that it was and still is the responsibility of the Secretary of State for Health. The Secretary of State has a tool to implement this in the same way in which the Secretary of State could implement standards requiring the use of open, rather than closed, systems in the NHS to prevent these problems of lock-in. That is really helpful.
Professor Cathie Sudlow: That is agreed.
Q91 Lord Ranger of Northwood: Thank you for your expansion on the work that you have been doing in this space and the evidence you have given. I come back to the challenges around AI and how we could train models. We discussed the complexity of multiple systems. There are the various data pockets and lakes across all kinds of different organisations in the UK. Is this landscape in a fit state to train our AI models on for clinical use? What can we do to have some secure AI training in the UK on that type of data? How would the controls be in place to ensure that that was done in a secure data environment, for example? We focus on systems and data, but where would we do this? Where would we train our AI models, or how should we do it securely?
Professor Cathie Sudlow: That is a good point. We now have a network of secure data environments across the UK—arguably rather too many—and quite a lot of environments that slap the label of “secure data environment” on the door or tin, for example, without necessarily being too specific about what is behind the door or under the tin lid. That is where the need for standards and accreditation comes in.
Specifically on your point about running AI models, I refer back to some points made by Ewan Birney on this. There are some fundamental needs in order to do this. The first and foremost is that there must be decent data that is accurate, inclusive and extensive in the right sense for the problem and the question—that is required to train and validate AI models. Secondly, you need people who have an understanding of how to develop these models. I am not an expert in AI, and it is easy to see it as a thing that you just do and apply, but clearly it is nuanced and requires expertise. I defer to others such Ewan Birney on the types of expertise that are clearly required.
Then you need environments that have the right functionality within them. One of the key issues with secure data environments, even before we get to AI, is their ability to implement software and other tools in a seamless and user-friendly way to allow researchers to apply their analytic methods. Various systems are required to approve the implementation of these software requirements, and running AI models, and importing and exporting them, is one of the challenges that secure data environments, or those working at the forefront of their development, are aiming to resolve. Some of these problems are starting to be resolved and experiments are being run to look at how well they work.
Finally, access to compute is important. AI models and many advanced analyses are compute-hungry—to use the lingo used by the technology community. One side point on that is important: they are compute-hungry, but it is important that we encourage users to write their code and run their models in the most cost-effective and compute consumption-effective way possible. There are simple ways in which to do that. If data users have to pay for every unit of compute they use, they think about it. If their models are written inefficiently and take weeks or months to run, they think about it as well. So ensuring that those kinds of behavioural nudges are built into the systems is important. Just providing access to extensive compute without tying that to use and efficiency is not particularly helpful, and certainly not helpful for the environment, of course. Those are the fundamental requirements of secure data environments.
I have one example to give you. I did not hear all of Andrew’s evidence, so I do not know whether he mentioned the running of a model called Foresight within the NHS England secure data environment. I was involved in helping to get it started, although I am less involved now. Foresight is a health-specific large language model that was trained and developed on large London-based healthcare data assets. A research team led by Richard Dobson, Chris Tomlinson and others from UCL and King’s in London have worked closely with NHS England and the secure data environment to set that model up by retraining it and running it within the NHS England secure data environment on 57 million people’s data. That has been done safely and well, not by importing an external model but by training it within the environment itself.
There are issues, although they are beyond my technical competence to comment on in detail, around the export of models out of secure data environments. I understand that there are risks when one takes a model or model parameters out of an environment, if you take out too much individually identifying data within the parameters of the model. I am not sure that that problem and challenge has been entirely solved by the community. But others would be better placed to comment on those highly technical aspects.
Lord Ranger of Northwood: Thank you for that comprehensive answer. I have spoken to a number of UK life science organisations that are developing algorithms. It does not necessarily have to be the whole model; they just have algorithms that they can develop and are looking to use in different sets. The challenge they come across is not about the data generally, because they know where the data is and can get to it. They have the algorithms and the research. The challenge is the consistency of the landscape to get into the various organisations and link those places up. I agree with all the analysis you have just provided, but what comes to the top tends to be the structures and organisations they have to work with, as much as everything else.
Professor Cathie Sudlow: Yes, I am sure that is the case. It goes back to the organisational and governance complexity, as well as the data and the environmental complexity that we need to streamline as much as possible to make this easy to navigate while being secure and privacy preserving. There is one good point to make, and I defer to my colleague Rory Collins on this because he has made it to me. A simple and streamlined system that is easier to understand, police and monitor is likely to be much safer than a highly complex system whereby there are multiple points where errors can be made along the way. This is another reason to move beyond our complex systems to something more streamlined. If we can understand it, we can control it, ensure that it works well and police it properly.
The Chair: We are coming to the end of the session. We have a few more questions and will try to be as brief as we can.
Q92 Lord Berkeley: This has been very interesting evidence, but my conclusion from what you have said so far is that—after the many reports, including your excellent one, on UK health and access to it for researchers—I have to ask: what has changed? How much improvement has there been, and are the Government putting sufficient resources into the improvements? You have told us some of them, but is there anything else that needs an early initiative, or something like that, to enable what you and other people are recommending be delivered more quickly?
Professor Cathie Sudlow: What has changed is the recognition that investing in a major co-ordinating organisation, which has decent investment and high-level government buy-in—the Health Data Research Service—is a change.
It is a UK-wide organisation and will be set up as a gov co. It has already come into existence through the appointment of a chair and CEO. I am sure that we would all want it to be doing lots of things as quickly as possible but it certainly has high-level buy-in. Andrew commented on the level of investment. These things can always take more investment—all areas of society can—but there is a much higher level of investment in this style of initiative than we have seen previously. These are all shifts in order of magnitude compared with what we have seen before. They hold great promise. There is a lot for that organisation to lay out in terms of its priorities and road maps towards delivery. But it is a much better starting point for getting this really moving properly than we have had previously.
One important feature of this is that it needs to be a long-term investment and endeavour. I know that that kind of thing does not often sit comfortably or well with political cycles. For sure, it will be necessary for that organisation (HDRS) to identify early wins and demonstrate delivery but expecting it to boil the ocean from day one is going to be unrealistic. Getting the balance right between some early wins, ensuring long-term investment and anything that your recommendations can do to shore up long term the need for an endeavour like this are important.
Q93 Baroness Nicholson of Winterbourne: You declared that Britain needs a national, secure data environment. I am sure that is true. Yet, in your report, you tell us about health systems that are resting on paper records, for example. Are you able to offer some simpler solutions that might move us forward? Reaching the goals that you have set will take a considerable amount of time, I should have thought.
Professor Cathie Sudlow: There are already secure data environments up and running at national and regional level across all nations of the UK. They are not all perfect but they are now functional. Indeed, I was lucky enough to be involved in the set-up of the relatively new one in England during the pandemic. It was one of the major advances of that time. So, that exists. There is huge complexity and lack of what you might call digital maturity in the NHS but there is still the capability within it to provide national data assets—even if they are pulled off paper, legacy and not-perfect digital systems—and convert them into national data assets. That has been happening for many years and for some decades in the case of Scotland, for example. We have these national data assets and the secure environments. A lot already exists that can be the fodder for early delivery while other improvements occur at the same time and in parallel.
Q94 The Chair: Professor Sudlow, you have been excellent in answering so many of our questions. I want to ask you the last question. As you know, our inquiry is going to be making recommendations to the Government on how to accelerate innovations in AI and personalised medicine in the NHS. What are the top priorities and recommendations for the Government, the DHSC, the Health Data Research Service and the NHS? What would you highlight as perhaps the top three most important recommendations?
Professor Cathie Sudlow: First, we need to shift the narrative in this whole area around the use of health-related data for public and patient benefit, and we need to think more about the risks of not doing that and what the downsides are, as compared with always thinking about the risks of doing so. There is a balance of course but it is easy to avoid the risks. You simply lock the data away and do not use it for anything, but that does not benefit anybody. We need to shift the narrative around to thinking about the risks of not doing this, not embracing these opportunities.
Secondly, the HDRS has now been set up. We should be backing it with all our might. We should be helping it to identify and use what already works, to maintain and enhance that, scale and speed up opportunities for access to data—not just for AI, although that is an important use case. We should lay out that road map for priority assets and functions of the service and then deliver it.
Thirdly, I come back to my previous point, that investment and commitment to this needs to be long-term. This is not a quick fix but a long-term endeavour. To reap the benefits will require that long-term view.
The Chair: Professor Sudlow, thank you very much. You have been excellent in answering our many questions. We appreciate it. This public session is now concluded. Thank you.
