Health and Social Care Committee

Good morning, everyone. My name is Rhidian Hurle, I'm sitting here as the executive medical director for Digital Health and Care Wales. I was appointed in 2015 as the first [Correction: 'first national'] chief clinical information officer in the UK, for Wales. I'm a practising urologist and I practise in surgical oncology; my specialist interest is bladder cancer, and I have NHS sessions one day a week.

Thank you.

Good morning. Bore da. I'm Helen Thomas, I'm the chief executive of Digital Health and Care Wales. I'm a health informatician by background, with over 30 years of experience in the Welsh NHS, mostly at trust and health board level. My background is in data information, systems and business analysis, and programme delivery, and I've been the substantive chief executive of Digital Health and Care Wales since May 2021.

Good morning. Bore da. My name is Claire Osmundsen-Little. I'm the executive finance director for DHCW and also the deputy chief exec. I previously worked as a finance director for Morriston Hospital, and, previously, I spent 20 years in the global steel industry, focusing on strategic turnaround and operational efficiencies.

Bore da. Good morning. I'm Simon Jones, I'm the chair of DHCW and was appointed by the Minister. I started on 1 October last year.

Lovely. Thank you for introducing yourselves and for being with us this morning. So, the first set of questions is from the public accounts committee Chair, Mark Isherwood.

Thank you very much. Bore da, good morning. Previous reports on the NHS Wales informatics service by the Public Accounts Committee, which preceded the current Public Accounts and Public Administration Committee, highlighted major issues in terms of delivery and culture. For example, the Centre for Digital Public Services had told the committee that it noted a 'legacy of low expectations', and the committee itself noted a culture in NWIS of overpositivity about programme delivery. So, to what extent do you think that you as a new or successor body have addressed that legacy? Do you acknowledge it and what have you done to try and change the culture and reporting processes?

If I can answer that question, I think a lot has changed. The first thing to note is we're now a statutory organisation with a board, a chair who is here with us today—a board of independent members and executive officers around the board table. We have the open and transparent governance that you'd expect to come with a statutory organisation, in that we run our board meetings live-streamed in public, as well as now our committee meetings, and they're all available on our website. We publish all of our board papers. So, in terms of the transparency agenda, I would hope—and hopefully that's been endorsed by other evidence that the committee will have received—that we are operating in the open.

I think the other things to note are we've got a new leadership team in place. One of my first priorities was to set about the leadership structure, the executive structure for the organisation, and to appoint a team. By next month, I'll have a full complement of executive and director posts around the board table.

I focus very much, in terms of the executive leadership, on trying to, perhaps, address the gaps that were identified from those previous reviews of the predecessor organisation. So, I've appointed an executive director of strategy to really focus in on where we're heading and to ensure that we are setting a strategic direction for the organisation and influencing that for the wider NHS in terms of the digital agenda, and a director of operations, because we needed to make sure that we had executive leadership around the board table that was going to have that technical capability, competence and ownership of the technical agenda and the important delivery that we have to support front-line health and care services.

Clearly, my colleagues are here with me today, and our roles were the three that were explicit in the statute that set up Digital Health and Care Wales, as you would expect, and we also appointed a very experienced board secretary to support the governance and the set-up of the organisation. I also identified the need for two additional director roles over and above those five executive roles that I've identified. I recognise that our people are our greatest asset and the organisation is all about the people, the delivery is all about people, and what we're delivering for the people in the NHS and actually for the people of Wales, so we've appointed a very experienced director of people and organisation development to focus in on that key agenda. And also, joining us next month, the post of director of primary community care and mental health digital services, recognising the need for digital to support the integration agenda and to ensure that we develop some clarity and joined-up clarity around the digital offer in that space.

I think, in terms of the other criticisms, actually, from the report and the learning and improvements that were expected, service availability and performance were a key feature, I think. And, as a new organisation, we've really focused a lot of our attention in that area. We've taken a very risk-based approach to the way that we understand our business and our delivery and where we need to target our improvements and our investments. So, we've done a lot with our technical legacy.

We've replatformed a number of our core systems and worked with our suppliers, where they're fully managed services. We've also transitioned to a brand new data centre facility. We did that—a huge undertaking for not just our teams, right across Wales—without any service interruption to services out there in NHS Wales. In doing that, we've also agreed our cloud strategy, and we've moved 25 per cent of our estate into the cloud. The remaining estate will migrate as part of our cloud plan, influenced by the product strategies that we are developing for all of our product base. So, it will be the arrangements and the environments, if you like, the technical environments that best suit the need of that particular product family.

In terms of the availability, I guess the evidence of whether that has been successful is in the availability of our core systems and services, and that ran at 99.9 per cent last year and for this year, going forward, which compares with industry standards and industry best practice.

I think the other point to pick up on, finally, from me and I'll hand over, perhaps, to Claire then, is that we've also got an incident review and learning group, because, regarding the culture of the organisation, we've been working really hard on the culture and the values of the organisation and making sure that we are a learning organisation. We know that incidents will happen and what we want to ensure is that we learn and we improve when we do experience some challenges and issues. So, that group is part of our governance and we would endeavour to improve our ways of working where we have found that we would need to do that. So, that's a constant cycle of improvement. But, Claire, you might want to comment on the funding.

Yes. So, as a specialist health authority, we've grown; we've got a statutory board, so we have a board structure and a board presence. The Welsh Government invested in that additional funding to enable that to happen. But, in addition to our operational core, what we have seen is the growth in the allocation in relation to digital development. So, we have a digital priorities investment fund and, since our formation, we've seen that funding increase to £31 million this year. So, that inevitably means that the rate and pace at which we have to grow in that space is a high priority. And the reality is that digital technology is moving from a capital intensive to a revenue-based funding model, particularly as you move from a data centre into the cloud. And that will mean, from an operational perspective, that our funding requirements will change and migrate as we move from those developments into business as usual, but equally as we move from a capital-intensive to a revenue-based model. So, working alongside my colleagues in Welsh Government, and alongside our health board colleagues, we're looking at how to optimise our funding model to ensure that it's fit for purpose as we change and develop as an organisation.

Can I pick up on two specific things you asked, Mark, on culture and performance in the context of having a full, independent, accountable authority? It has made, I think, a huge difference in the sense that, as Helen mentioned, all of our work is done in public; all of our papers are now published in public, so anyone can see the performance reports as they're all set out, and all of our meetings are live-streamed. So, there's a huge amount of transparency in the context of our performance and how we are performing against targets. And then one very important new aspect is a group of independent members who are there on a regular basis to provide that regular challenge of the executive and performance, which was obviously not the case in the way in which NWIS was set up.

Culture: one of the really important roles of myself and independent members is role modelling as part of the board. I think that's been a notable aspect of the development of DHCW and the culture of the organisation since it was established, in things like establishing the values of the organisation, but not us as a board sitting down and establishing the values of the organisation, but involving all staff in that process, so that there's much greater engagement in what we're about, how we behave, what we say, what we promise and what we then achieve, and how we're scrutinised—how the organisation is scrutinised against those objectives, aims and ambitions. It's all set out there for anyone to see and I'm sure many of you have dipped into the material that is there to see, so that you can see much better how we are doing against what we are supposed to be doing.

Can I just bring Mike Hedges in for a quick question?

I've worked in places where they've had really good IT systems, but they were just sat in the corner, not being used very much. How do you ensure buy-in from primary and secondary care practitioners?

It's a process and complex change management is a journey. Part of my role is to engage and develop networks within Wales across a number of professional healthcare groups, including nursing and allied health professionals, which we'll see in some of the submissions, and clinical leadership. Clinical leadership is key in this. I've been in NHS Wales since 1995 and I've worked in environments from east to west, where there were no computers and there were some quite good computers. The experience, the software, the functionality, the ability to see things to enable you to work in a different way is the message that you bring to other healthcare professionals. So, when, for example, you can request something electronically and you can have a notification on your mobile phone that that result is available, it shortens the turnaround time of getting that information. So, getting that information across to people to change. So, an element is directive, an element is learning and an element is engaging.

Natasha, did you want to come in?

Yes, please. Thank you so much for joining us this morning. I just have one question: I've read through the briefings and the submissions and all of the information that you've provided, but just to clarify for my knowledge, who are you here to serve—the public, the healthcare professionals, the health boards? I'd just like to know from you: who and what is the purpose and who are you serving directly from this project, from all of this that you're doing?

If I answer that, so, historically, the role of an organisation like ours within a health and care system was aimed at the professionals, was aimed at clinicians, was aimed at the tools and the technology needed to support front-line delivery, therefore serving patients. Our role now is actually reaching out into the role of being patient facing as well. And one of the major strategic programmes of work for us is digital services for patients and the public, which will, for the first time, give patients access and the ability to interact digitally with the health and care service in the way, frankly, that you quite expect to do during every other day of your life and the things that you do. So, I think that we are here to serve the people of Wales, and we do that by serving the provision of health and care services and supporting that.

Jack Sargeant.

Diolch, Chair, and bore da. I was going to wait until my turn, but I think it builds on well from Mike's question and your answer, Rhidian. I sound like a broken record here, but it's fax machines. You've worked since 1995, east to west, with no computers. In January of this year, we had Dr Karl Davis give evidence to the health committee saying the hospital he was in had just bought a new fax machine. Surely that's not the pace of change that we want to see, or is that still in the journey? I'm essentially looking for a comment on that.

I'm going to tell you: I don't want to see fax machines. I don't use fax machines. There are no fax machines in my department. Where I work, we've got secure messaging systems. We've heavily invested in Teams, which allows personal identifiable information, including pictures relating to care, to be used and transferred between healthcare professionals. We've got NHS Wales e-mail, we worked with NHS England to build our standards and to comply with their requirements, so that we can exchange information across the border. I don't see a place for faxes within the NHS. We're not responsible for faxes within the NHS.

And we don't encourage it; we would discourage it.

I suspect we'll be at the same party as you are celebrating the end of the fax machine in the NHS.

I think our surprise was that not only are the NHS still using fax machines, they were still purchasing them. I should just confirm, then: you haven't got any fax machines in your organisation.

No. I've never found one, anyway.

None that you've come across. Thank you. Mark Isherwood, have you got any further questions?

Yes, indeed. I've not been in my last job for nearly 20 years, but I remember by then, cobwebs were growing on our fax machines.

What, if any, outstanding operational issues do you have, and what barriers have you had to address in establishing the organisation?

As I mentioned earlier, we take a very active position on our risk, actually, as an organisation, so our operational issues would manifest themselves as part of our risk register. One of the first things that we did as an organisation was to set about understanding what our risk appetite is across all of our delivery domains, and we approved that last year through the board. Clearly, we report on our risks as part of our risk register, as you'd expect every board to, but actually, just last week in our management board, we had a report on how we've been managing the risks over this last year, actually, to see that we've got a risk register that's got risks that are coming in and moving out, and being actively managed. So, we've got quite a good process, I think, for understanding that.

We've targeted our capital investment, because we do get some discretionary capital investment as an organisation, at those areas of greatest technical risk and technical debt. So, I would feel encouraged that we have a handle on exactly what our technical risks are, and we have dealt with our highest risks. I think one of the areas of greatest risk on our risk register is one that actually came up, I think, in the previous reviews of the predecessor organisation. That would be the CaNISC system. That is still one of the highest risks on our risk register, but I'm pleased to say that there's been a lot of work undertaken to develop the core functionality that's needed to replace that. Probably if I hand over to Rhidian, who's been leading on that work for us as an organisation, he can tell you exactly where we are on the cancer informatics programme.

Thank you. It's important to get some understanding of the background of the system. It originated in the last century. By the time the iPhone was invented, it was a troublesome teenager. It was written in a language that very few people in the world understood. Microsoft support was essentially removed, and the software could not be configured to user requirements, because the technical understanding wasn't there. We replatformed the software onto, essentially, hardware that meant that it was more robust, and then we left it alone. And then we worked to extract the cancer record to enable a summary of every cancer patient to go into the Welsh clinical portal, the document repository element. That, actually, revolutionised what I could see as a clinician.

Just to highlight, if you don't mind, I diagnose bladder cancer patients. They then go to Velindre, so they cross a border, for neoadjuvant chemotherapy—that's chemotherapy before they have their major surgery. They then come down the M4 past me to Morriston Hospital, where they have their bladder out, and then they come back to me for follow-up care. So, that individual is going to have gone across a number of health board boundaries, all using different systems. Because we were able to extract that record, for the first time in my career, I was actually able to see what was happening to those patients. That gives patients massive confidence. It also gives clinicians massive confidence, because you're up to date with what's happening to the patient.

Subsequent to that, we worked with the users of CaNISC, and to put it in context, there are about 2,000 users across Wales. It's primarily for non-surgical oncology pathways. It's used to process data, it contributes to our national audits, to allow us to understand where we are, how we benchmark across other disease-specific areas. The Welsh clinical portal has 35,000 users, it's visible in an ambulance hub, it's visible in your accident and emergency departments, it's visible across primary care, it's visible across all our hospitals. So, when those cancer patients now present into those acute environments, their record is visible.

Since then, we've worked closely with the leadership of Velindre to understand what the functionality requirements are, going forward, for the staff, and I'm very pleased to say this weekend just gone, we've done our first dry run for data migration of the pathways. The worry for patients who move across boundaries is that they can get lost, and it's a big concern for clinicians, as you can imagine. Some people say it's like trying to change the engine of a plane in the air; you've got work to do, you've got to try and replatform it and you've got to make sure everyone moves safely across. We anticipate that, in November, we will be able to decommission a large element of the cancer work that is done in CaNISC as part of what we call phase 1, and we'll then move on to look at how we manage the palliative care journey and the screening services.

It's been a long, hard journey, and there's governance, finance and other elements to it. Clinical leadership has been key here, and time to lead. We've got strong oncology leadership across the cancer network in Wales, and that's made a real difference.

Have you finished your questions, Mark? Helen wants to come in, but have you got any more questions?

I have, yes. First, just briefly on that, you mentioned cross-border; what about the border with England? Because I've visited several GP practices that service a cross-border patient list, and we also know that health boards, particularly those close to the English border, will frequently refer patients to providers in England, and yet, in addition to the digital issues you're referring to within Wales, there's disparity or disconnect with some equivalent systems in England. So, what consideration are you giving to those?

I can tell you quite a lot about that, actually, because I've had the experience of working in Hereford, so I've been on both sides of the border. Essentially, there are four health boards—let's call them that—on the other side of the English border. They actually have trouble communicating between each one as those patients move. Those patients rebound for acute care and some elective care pathways, particularly from Powys. And you have a strong corridor in BCU going to the Liverpool area.

We've engaged with some services, including, for example, genetics, plastic surgery, orthopaedics, in a way that we can collect that output of care information on one side of the border and put it into our repositories. We're also exploring ways to expose the data of the Welsh citizens in a way that is safe and secure within the English infrastructure. As part of our work on the international patient passport, there's a summary, essentially, that is standardised across the UK and, indeed, hopefully, will be taken on further than that. The summary record of the individual is available, and that can be patient controlled. Part of the work that we're doing for digital services and patients is trying to expose the record in a way that the patient can carry it to where they need to go.

Could I just follow up on that, as well? There's been some specific work as well being taken forward by Powys Teaching Health Board, particularly targeted at the high-volume transfer of patients they get, so referrals can be sent electronically to those areas over the border.

Thank you, Mark. Rhianon Passmore, you wanted to come in.

Thank you very much. Mike Hedges has mentioned buy-in and you've mentioned clinical leadership and the importance of the CaNISC system and the risks around technical and systems. What about the broader risks in terms of the organisation? Very briefly, if I may ask you to give a view.

I had a bit of list, actually, to come back on that. One of the areas of risk for us is our people. As I said earlier, they're our greatest asset. They are the organisation, they're the heart of the organisation. So, the risk for us is ensuring that we are resourced with the right capacity and capability to deliver the ambitions not just of the organisation but for the wider NHS and also for the Welsh Government. So, it's our people. I could go into great detail about what we're doing. I don't know whether you've got future questions on workforce and people and whether you'd want to park that, but that was one of the areas.

We'll pick up that later on.

Okay. And then perhaps if I ask Claire to come in on cyber and finance.

It's obviously a growing and changing environment. Cyber and cyber security is a key area of focus for us at DHCW. We're seeing significant growth in that risk. If you look at the WannaCry and ransomware attacks, recent reports show that the increase in risk is in the hundreds of percentage increase. So, we really are focusing in that space, and there are a couple of things in that space that we're doing.

One is understanding our cyber posture, our current position, the strengths and weaknesses around that. To do that we've set up a cyber resilience unit, which, on behalf of Welsh Government, gives assurance around the compliance with the NIS directives, or the network and systems directives, to ensure cyber security. There's also activity around prevention. Knowing our strengths and weaknesses enables us to understand how we can improve our legacy estate and work alongside our future strategy to ensure that it's cyber secure.

Also, in terms of response, as you're all probably aware, in August, we did have a cyber attack that impacted one of our suppliers, Advanced. That did have implications for us in NHS Wales. Obviously, as a team, we helped lead that response and co-ordinated that with our colleagues across the health boards and trusts, and also with the national cyber security system. So, understanding the need for a response and being able to respond and lead that response is really important.

Raising awareness of cyber threat throughout the NHS in Wales is also a key area of focus. Actually, through our board colleagues throughout the organisation and through our key stakeholders, we have proactively highlighted the issue, and we've learnt from the issues that southern Ireland has experienced as a result of their cyber incidents to really understand and be ready in the event that we have another attack.

In terms of being ready, as an organisation we need to be ready in the event of a cyber security attack. The risk around that is really having the right cyber team and the right cyber resource. We presented to our board on 29 September our three-year cyber plan that will underpin our readiness and response in the event of an attack. So, cyber and cyber security is really important.

The other one—and I would say this because I'm in finance—is that, in the first year, DHCW has achieved a balanced set of accounts, achieved all its statutory obligations and had no qualification in its audit report. They've done that because they've had headroom as a result of the building of the organisation in their revenue stream. As we move to a greater level of development, the challenge for us is moving that development into sustainable operational requirements. We will see that in the next couple of years, as that development is complete and we transfer ownership of that operationally to DHCW. To do that and to do that well and to learn from the mistakes that we had before, we need to have the right funding strategy that aligns that.

I'm going to come on to that, if that's all right. We really appreciate the detailed answers, but I'm just conscious we've got quite a bit to get through as well. So, please excuse me for saying that. But, just on cyber security and what you've outlined there, do you think that there is shared clarity with all your partners in terms of the issues around cyber security?

I think we've learnt a lot from the recent incidents, but, actually, the cyber resilience unit work really gives us an insight into our current posture and our internal strengths and weaknesses; we're living with that cyber threat, so, we certainly have a real insight into where we are and what we need to do.

I'm particularly thinking about your partners that you work with.

One of the advantages of being a health authority sitting around the tables is that, for example, at the chair's network, we are able to raise the issues around cyber security, so that we're actually talking to our partner organisations around Wales on key issues. This not being the only one—

You talk to them, but do you think that there's shared clarity with them?

I think that, amongst the chairs, one would hope so. I think the challenge for all of us in the NHS, the chairs sitting around the table, in our plans, is to make sure that we are putting in sufficient resource to address the issue.

Sure. Helen, you wanted to come in.

Just to add to that, every organisation undertook the assessment through the cyber resilience unit to understand what the cyber posture is. Those reports were—. We don't have them as Digital Health and Care Wales, they're reported to Welsh Government, but, internally, into health boards and other organisations, they would have reported that through their governance structures. I've raised it with chief executive colleagues, and only last week, actually, our head of cyber presented to the NHS Wales leadership board. I think this summer's events, demonstrating the challenges that a targeted ransomware attack can have on aspects of the health service, has really shone a light on that. And I think probably what we need to stress is that there are things that we can do and that we are raising awareness of that mean that we can deal with cyber, and partners are aware of that, but, actually, to really have the stronger cyber posture is going to need investment.

Thank you. Do you mind—all of you—if Members interrupt you if we want to get to a point?

No, that's fine. Absolutely. Apologies.

Thank you. I appreciate that. We don't want to appear to be rude—

We've got so much that we want to say.

—but we've got so many questions to get through, so, thank you for allowing us to do that. You mentioned earlier the model changing from a capital to a revenue model. Just to pick up on that and expand a little bit, all organisations—or, most organisations—will be facing some real financial challenges. There's going to be a limited amount of capital funding support for investment, as well, into digital and rising costs through digital inflation. In the context of what you said earlier about that changing requirement from a capital to a revenue model, what are your views on the funding model needed to deliver your objectives? And, by all means, just give us a brief overview of that.

I think there are two things. One thing is that we will no longer need such a high capital allocation, so, there are some choices that we can make in terms of translating that into a revenue model. If you look at the level of funding required, it depends on our ambition in relation to how transformational digital is going to be in health and care. And it's really difficult. because we always try to benchmark where we are in relation to others, and digital spend is very complex and is subject to definition changes. But if you look at our underlying investment—certainly, DHCW is part of the NHS in Wales and, obviously, I can't comment on the overall, but you're looking at around about 3 per cent at best—2.5 to 3 per cent. If you look at industry standard, it would suggest that investment in healthcare should be around 4.4 per cent—that was a recent Gartner report. So, in order to really be transformational in this space, we will need to invest more. But I would say that the returns from a digital investment are significant, and we demonstrated that certainly through the COVID response where we really translated the requirements into a digital solution that was really cost effective. And that's what we need to do across the segment is really demonstrate the value of digital, not only from a transformational perspective, but also from a green, decarbonisation perspective.

We'll be scrutinising the Welsh Government's budget in the new year. Is there anything you think that we need to be raising with the Welsh Government in terms of how funding is allocated, from your perspective?

I think digital should be a common thread throughout that budget, through the decarbonisation programme, through the health and care programmes and recovery plans. Digital should be a key thread and ingredient as part of that solution, and you don't often see that detail.

And then, in terms of how you're funded.

I would say that, to go with the health boards' interests, we need a greater recurrent revenue allocation within that budget.

Right. And, do you feel that, from your discussions—and you've obviously had those discussions behind the scenes—Welsh Government understand that?

Yes. They scrutinise our accounts, as you would expect, as a health organisation, well. And also, through the directors of digital peer group, I take the lead in highlighting the complexities and also the differentiation factors around digital spend, and I've really flagged up the importance of digital inflation, and understanding how that impacts our ability to operate under a normal operationals perspective, but also a future one. I think there is a general appreciation of how difficult that is. And we are working together to find out how we fund digital in a sustainable way, going forward, and we're working together on that, both from a health board perspective but also together with Welsh Government.

So, just briefly, if there's a question that we should put to Welsh Government, from your perspective, what would that be?

It would be: what is the role of digital and the investment in digital, on a recurrent basis, to help transform the NHS in Wales?

That's a clear answer—thank you. Rhys ab Owen.

Thank you very much, Chair. I want to just ask some follow-up questions from what has already been asked, and they're factual questions, so, hopefully, factual questions will lead to short answers, Chair. The first is in regard to the question about the increased use of cloud; I think you, Helen, mentioned that—of 25 per cent. Has that led to fewer servers being used in the past five years? If so, how much, percentage wise? If you need to write to us later on with these details, please do.

Yes, I don't have the actual number; we do have it.

But it has, has it?

Yes. Well, we will have seen increases and then decreases, if you like, in terms of the estate. So, a lot of our test and development environment has now moved to the cloud, and that was quite significant, and some of our major applications are very server heavy. They would be priorities for us to push forward next.

Brilliant. Okay. And then moving on, following up Mike's question on take-up by primary healthcare providers, what is the percentage of GPs, doctors, who are using these systems? Have you got those details for us?

The whole of primary care is dependent on computers—everyone in primary care uses computers. There's a little bit of a mix and match within secondary care, because of the paper volumes and the reorganisation of organisations where paper volumes have to be collated. To give you some stats, just to perhaps put the size of the problem in, when I was associate medical director in what was Abertawe Bro Morgannwg University Health Board, we had 2.1 million case notes—2.1 million case notes. Each one of those has to be stored; each one of those folders is 80p. All right? When you see a patient in clinic, you have to collate all of those together, which means that they have to come from wherever they're stored. Now we're in a situation that, because I've got access to a digital record, I can see all of those things and it's not dependent on the paper arriving. In fact, when I do clinic, it's virtually a paperless clinic. The things that I have to use paper for are either patient information, and we might be able to solve that through signposting patients to digital services, but also, there are some tests that require paper, and we're on that journey to—

Sorry, I don't want to interrupt you, but the question was: what's the percentage uptake?

You can't work in secondary care without using a computer. There are 95,000 staff in the NHS, and about 7,000 of them are doctors; every single one of those has got a NADEX single password to enable them to get on to a computer.

Fine. And I think that follows up to a supplementary I wanted to ask to Jack Sargeant's question, about the fax machine. Now, I appreciate that you don't buy the fax machines, but what influencing role have you got on NHS in Wales?

Claire mentioned the directors of digital, and I think that was one thing I didn't mention earlier, actually. What's changed in the wider environment since the previous organisation was reviewed is that, now, most organisations in Wales have got a director of digital, who is sat around the board table. So, we've got a peer group, where my team meet with the directors of digital, to really work through, actually, where we're heading—clearly, working through some challenges and issues operationally, but actually, to really be able to support the wider health and care sector and Welsh Government and influencing some of that. The director of digital will have a view and actively discourage any use of fax machines in their organisations and try to educate and share and raise awareness that there are alternative methods.

So, you proactively see that as your role.

Yes, yes, definitely.

I wanted to ask, then, about the cancer system that is going live in a few days' time, isn't it—November.

Next month, yes.

Now, that's phase 1, yes? When will the old system be discontinued?

Once we've achieved phases 2 and 3.

And when will that be achieved?

So, we're working through the detailed planning of that. The services that are left are palliative care, colposcopy and screening. There are some challenges around the palliative care that we need to work through, because that's about sharing information across—

So, what is the—? Fine, there is difficulty, but what do you think the timeline will be? Are we talking years, months?

I think some of those will be complex and it could take us up to two years to get to that.

Two years. Okay. Brilliant. What else have I got? Oh, yes—cyber security. Now, we hear about cyber security all the time and the threats posed by cyber security. How many people are employed specifically with regard to cyber security within your staff?

Claire.

So, we've got a cyber team of four in DHCW.

So, it's quite small compared to thousands of staff.

Yes. That's the DHCW team.

Yes. So, how does that compare with the cyber resilience unit for NHS in general?

I haven't got that comparison with the NHS, but we've also got a cyber resilience unit, which is the Welsh Government-funded unit that looks at our posture, which is independent. We hold it, but it's independent to the DHCW team, and that's made up of a team of four.

Okay. And are you concerned that that's too small compared to how large the organisation is?

It's not about size, it's about capability and, really, what's important there is that cyber skills, as you can imagine, are very valuable at the moment. So, the challenge for us is to develop that competency and specialism, and that's what we've done. We need to balance that, actually, with external support where we need it, but, really, it's about developing the capability to understand the cyber threat and respond appropriately.

Are you struggling to appoint people with those skills and capacity?

It's clear, particularly in the field of cyber, we're unable to compete on salary compared to private sector, as you’ll be aware. What we are doing is ensuring that we can develop the pipeline and move in. So, actually, our first cohort of apprentices who've gone through the digital degree apprenticeship that we support through the Wales Institute of Digital Information—they're going to be graduating next month, and a number of cyber apprentices have come through that route.

Okay, great. Now, how confident are you that you have the capacity within the system to avoid a system outage across NHS in Wales?

So, we are doing all that we can in terms of the cyber posture and in terms of our service availability to understand what our risks are and to ensure that we have that in place. Claire, did you want to come in?

Yes. I think that was put to the test in August. We had to shut some systems down to respond to a cyber incident. I think the difference there is that we took the lead in understanding what needed to be done. The key issue was around the 111 service for the ambulance—working with clinicians to understand what they would require without that system, understanding the workflow, then using the centre of excellence for Office 365, understanding the toolkit we've got and exploiting it, and then using our business change team to quickly write the training materials and equip the staff to reorganise their current operations to deal with that happened reasonably seamlessly.

Because of how you dealt with issues back in August, you're satisfied that you have the resource and the capacity to deal with any future issues.

What I'm saying is that, with the digital intelligence that we've got, we can exploit that to minimise the effect. If you looked at the impact on other nations, particularly Ireland, they took weeks, months, actually, out of their system. So, it depends on the type of attack and the extent of the attack, but what we can do as an organisation is help lead that, evaluate it, and respond as quickly as we can in the event that we do have one.

One essential principle with cyber security is you're never done. You constantly have to be moving on it to attempt to keep up with it, or ideally keep ahead of it, but it's very difficult to say, 'We're done' because you need to be carrying and carrying on. And all of us need to be doing it, because, also, an important point to be made is we've got a team—I get the e-mails testing me whether I open them or not; I'm sure you all do in the Senedd—

Well, I did it yesterday, unfortunately, when I thought I was supporting the IT staff in some competition in Japan, but—

Oh dear. [Laughter.]

I'm as guilty as any of us.

We have a speed awareness course for that in our organisation.

Definitely. We've heard about the reluctance with regard to sign-up to the single-system solution. Is that still viable?

Which single system?

With the Welsh Community Care Information System, and the reluctance with health boards and local authorities to sign up to it. That's a concern that the previous committee raised. Are you satisfied that that model is viable?

I think it is a viable model. I think that there is a lot of benefit to be gained from adopting and using that system, particularly at a regional footprint, to share across the health and care boundaries and the different sectors. Where that happens, you see staff on the ground experiencing the support and the sharing of that information.

I think that there have been some challenges of late, where there were—. That's a fully managed service by, actually, the same supplier as the GP out-of-hours service we've just been talking about. They upgraded their hardware and software over the last 12 to 18 months. That caused some performance issues. They've now stabilised and the system is stable. And I think that, perhaps, sometimes it's forgotten that some staff who would benefit from using that system actually don't have a system at the minute to use, so I still think it's viable.

Rhys, are you happy for Rhun to come in on this point?

I've got one final question and I'll pass it on to Rhun. Audit Wales has raised an issue that strong leadership is crucial for all of this to succeed, and you mentioned right at the beginning the new leadership team in place. How much of an overlap is there between this new leadership team and NWIS's old leadership team?

So, Rhidian is the long-standing member—

I don't want to single you out, Rhidian.

I joined the previous organisation as director of information in 2017, and Claire joined the year after as director of finance in 2018, and that's the cross-over.

So, out of four of you today, three of you were in NWIS, were you?

Yes.

Okay. Is that—

The rest of my team are all new to the organisation.

Okay. Thank you. I'll hand over to Rhun.

Thanks, Rhys.

Thank you very much. If I can continue on the points about the WCCIS, is it fair to say that this is one of the biggest projects that you have?

Yes, it is. Can I take these off?

Yes, sure.

Yes, it would be one of the top strategic programmes that we are supporting, yes.

Around £30 million has been put into it, and another £12 million has been allocated or earmarked for it. Do the steps that have been taken on it so far represent value for money, do you think?

I think that's quite a tricky question to answer in terms of the quantification of the benefits. I think the whole investment has been around the integration agenda, to support that big service change that needs to happen.

I think, in terms of WCCIS, clearly we host the programme and support the joint senior responsible officers in terms of the delivery. I think it's really worth recognising that it's an ambitious thing that Wales is trying to do here; it's trying to integrate across the health and social care sectors to join up that information. It hasn't been done in the way that we've been trying to do that at a national level before. It's the right thing to do and, where it's been successful—and it is implemented in 17 organisations—it is really driving that benefit.

It was reported four years ago that good progress was being made. Are we that much further forward?

There have been some challenges. COVID was a bit of a challenge, although WCCIS was beneficial to some of those teams in their response to COVID. And there have been some challenges. The supplier changed hands, and the replatforming, I think, caused a bit of a stall in the programme, but, actually now they've had a strategic review. A programme reset is happening. There is quite a lot of energy in that space. And I think the other thing that they've really focused on is driving up the engagement. Actually, sometimes when you have some challenges with system delivery, that creates a bit more of a community and stronger engagement, to actually get over those issues, and that seems to be the case now. So, there is a stronger engagement focus from the programme.

Are you still thinking of it as a national programme where everybody should be coming in one at a time? I'm hearing, perhaps, that at least one local authority might be thinking of pulling out of it because they're not happy with the way it's going. Could you confirm if that's the case?

I think people are bruised by some of the issues that happened over the last year. It is a stable system now. I think that there are tremendous benefits in using it. But, also, we do acknowledge that the crux of this is about sharing and joining information across the sectors, isn't it? And we've got to make sure we can do that with all organisations.

And I don't think anybody is doubting what you're trying to achieve. What I'm trying to pin down is how effective you are in delivering what was set out years ago, now, as a proposal. Is it just the one health board that's used it?

No. It's being piloted at the moment in BCU as well, Hywel Dda and Cwm Taf. Swansea have a business case—they are almost ready to sign a deployment order to move that forward.

But only one—is it Aneurin Bevan?—that's actually using it.

Aneurin Bevan has gone live now. No, Hywel Dda are using it, and BCU are piloting in Ynys Môn.

I find it a little bit surprising that there's not more reference to the system in the written evidence that you've given to us as a committee. It's barely mentioned—a couple of links. And given, from what you're saying, that there are some serious hiccups, to be kind, in the delivery of what you have said is one of your most important projects, I would have thought that perhaps that would have had more prominence, given that, in 2008, NWIS was criticised for selectively reporting information on performance and progress, and that your first words today were on the importance of operating in the open. Perhaps I should turn to the chair, here, really. When you were set up as an organisation, there was this promise of new and independent challenge, differing from the way things had operated at NWIS. Do you think that there's that challenge? Did you know, for example, that this paper had gone out with barely a mention of WCCIS?

I think that there are a couple of points around that. One is the enormous scope of the work that we do and squeezing into what was given to us in terms of a finite number of pages that you want in terms of a briefing. So, there's that issue.

The board has focused a lot of attention on WCCIS, both in public session and in private session in being fully briefed around where we are in terms of the roll-out of WCCIS and the use of WCCIS. There are some areas where it is certainly very unlikely in the short or medium terms, or maybe even the long term, that they would adopt it, because Cardiff and Vale, for example, have their own system—I think it's called PARIS. But I am confident that, as a board, we are focused on those areas of risk and those areas of potential concern, and that we receive the information that we need to apply proper assurance and scrutiny that what should be happening is happening, and then what needs to happen to address issues that are of concern is also happening. If we didn't put sufficient attention on it in the paper, I apologise, but we can address that here or we can even follow it up in writing for you, Rhun, if you wish.

Thanks for that, and thanks for giving me a short cut to the acronym as well, in 'WCCIS', which I shall use from now on in.

What are those areas of risk on WCCIS that you have decided to focus on? And what have you gleaned from your challenge to—?

As a board, I think the key areas of risk are the ones that Helen mentioned that we were focused on, which were around the—. What's the word? It was around the capability of the system and the outages we had, and that issue that Helen has described—I think you referred to one local authority, and clearly they were looking and considering and were worried about it at the time at which there were outages, and those outages affect people doing their everyday job. So, the board was very focused on what is being done about that, what is the pathway to getting to sustainable usage, and satisfying ourselves that actions were being taken to do that, and then receiving reports in terms of the new health boards that are coming onstream in terms of what's happening in BCU and what is happening in Aneurin Bevan.

I very rarely get involved in those sorts of operational matters, but I had direct conversations with the chair around Aneurin Bevan so that she was satisfied that things were going in the right direction and we were talking directly to, involving and briefing—and, again, it's very rare I get involved in these, but such was the nature of the issue—Nicola, who is now of course the chief executive of Aneurin Bevan, who was the lead at the time. So, I'm confident that where we have major—. And there were other programmes where there are risks that the board is—. This is one of the advantages of being an independent board with independent board members who worry at things like dogs at bones, which wasn't the case in the past, and I think that keeps the executive team on their mettle in terms of giving us assurance that actions have been taken to address key risks in key programmes.

Okay. Just one last question from me, and this is the health committee side of the table in this joint meeting: we all want to see the integration of systems, because we all think that would be better for the patient at the end of the day. Perhaps a question to you on the clinical side: given that we have the description of health boards still using different systems rather than really buying into WCCIS, is there a risk that, with the continued delay to the widespread, fully national implementation of this, lives are being put at risk, still?

That's very hard to quantify. Healthcare is not black and white. Risk management is the name of the game. If you can provide a content-rich record wherever the patient goes, healthcare professionals can make better-informed decisions with patients for better outcomes. I believe the question we should be asking is not what we're using, but, 'What can we not see? Why are we not working to make the record as rich as it can be?' We need to exclude digital information blackspots—let's call them that. If you compare the one Wales approach, the all-Wales approach, the regional approach, the network approach, the local approach, the single hospital approach, because of the demand of the workforce, because of those complex journeys that we have designed, we cannot have local systems just delivering local things. So, the ambition, and it's a collective ambition through the architecture review, is to make the repositories data rich so that we can provide information for the primary purpose of care delivery, but also to understand the processes behind that to allow informed service demand. And colleagues around the table have my sympathy, because you will meet constituents who say, 'Well, I can't have this in my hospital.' The debate has to change to, 'Where will you get the best outcome for the problem that you have?'

Thank you, Chair.

We've got some very quick-fire questions, and if you could just be succinct because we've got a lot to get through. Rhianon Passmore, then Gareth, then Natasha.

Just very briefly, I'm just thinking of MOD and some of the commissioned vehicles and the health of some of those as we move forward. I know that this has been around for a very long time and, with WCCIS in its new iteration, there's nervousness around buy-in. Are you absolutely positive that this is the optimal system for Wales? You can give me a 'yes' or 'no' answer.

It's difficult to give a 'yes' or 'no' answer to that. It's the system that we have now and we will set a strategic direction for where we're going, going forward. It works and it provides benefit and allows that integration in the way that we have it now. It was bought some time ago, so—

So, it is the optimal system?

Actually, the strategic review is undertaking a market analysis to really understand that. It is one of them, to be honest. So, there's work to do to really understand what the future direction looks like for Wales. But, yes, it is able to service the functions and the role that it was purchased to do.

Thank you.

Gareth Davies.

Thank you, Chair. I just wanted to go back to the fax machines briefly, if I may. [Laughter.] I worked in the NHS for 11 years and I think I know why we still use them—it's because it's deemed to be a secure method of communication, and in the profession, that's very important. It's probably working on the theory that nobody else uses it, so it's secure in that sense. But what modern equivalent should they be using as a replacement for fax machines so that staff can get the reassurance that there are modern systems available to get them away from these fax machines and we can just put it to bed?

Rhidian's ready with a list.

It's a good question. It's about reassurance, isn't it? If they are being used, why are they being used? It's to give that reassurance, absolutely. So, what's the answer?

Part of it is culture, part of it is behaviour. But the systems are there—they're paid for by the taxpayer. So, let's just remove them. Set the challenge.

But what modern systems are there available?

There's Microsoft Teams. So, all of the users across Wales have the ability to send personal, identifiable information safely. NHS e-mail, I've explained—that is available everywhere.

Yes, but I think Gareth's point is on giving that reassurance—there's a reason why someone is using a fax machine. How do you overcome that challenge? Not what's available—how do you change that culture?

I think it's culture and it's about supporting the new ways of working. So, faxes are there and haven't been replaced because they had the term 'safe haven' 20 years ago, didn't they? You had dedicated fax lines to actually transfer identifiable information. Thinking has not moved on. It's not a deliberate decision to not use something. You're right; it's about understanding what else is available. Clearly, there's work that we can support the wider NHS in doing in perhaps shining a stronger light on that and making sure that we share that.

Thanks. We've got a lot to get through. I'm going to come to Natasha, then I'll come to Mike to ask his supplementary. And then if you want to come on to your set of questions. Natasha first.

Thank you so much. I just want to follow up on what Rhun asked you earlier. Thank you for the pronunciation of WCCIS, otherwise I was going to keep calling it W.C.C.I.S for the rest of the morning. Thirty million pounds has already been spent on WCCIS and there is a requirement for another £12 million to be spent over three years. I'm sure everyone probably wants to know—. Like I said, I appreciate the briefing that you sent us, but I'm quite finicky when it comes to detail. So, if someone asks me, 'Forty-two million pounds has been spent on this, what has it achieved or what are you going to achieve year on year?', that's not here. So, can you just enlighten us here in the committee on what exactly—? If someone says to me—and my health board is Aneurin Bevan—'Natasha, what has the £42 million been spent on?'—. Please tell me what has it been spent on.

What it gives you is the patient record for out-of-hospital care that can be shared between clinicians and different services out there. So, it gives that view of the patient record; it manages the process of supporting community care and sharing that information. I mean, £42 million is a big number. It's been a long time, and there's been a lot of work. It's not just been spent on technology or buying kit. Actually, there's a lot that's gone into the business change and supporting regional working and integration out there—so, the readiness agenda, to be honest.

I think part of the challenge for WCCIS is I think there was a perception that having a programme that was going to give you a system to allow integration was going to deliver service integration. And I think actually some of that has been confused in terms of what it's trying to achieve. That was one of the recommendations of the strategic review—being really clear about the scope that the programme is trying to achieve, and, actually, 'Let's go at that and deliver that and support how we can get that information shared'. I acknowledge that there will be organisations that will have no intention, and they've already publicly voiced that no intention. We need to work with those organisations and those regions, which the teams are doing through the national programme team, to understand how we need to progress that conversation moving on.

So, why have they said 'no', if you don't mind me asking? What are the reasons for them saying 'no' to it?

There'll be a variety of reasons. Some will have a home-grown system that they're wedded to or it suits them at the moment. It may not be a priority. I can't speak for them; I've not had those direct conversations—that would happen through the programme team and the SROs. But there'll be a variety of reasons and we need to really understand that and make sure that we have a plan for every region and know what it is that can be achieved. It is an awful lot of taxpayers' money, but digital is not a quick fix and, actually, you've got to invest in the change and the redesign in order to reap the benefit of it.

Thanks.

Mike Hedges, all yours.

I have one question in two parts. What percentage of compatibility have you got with your system with that which is being run by social services, primary care and hospitals across Wales?

And the second part is: we only bring in ICT systems for the reason of increasing efficiency, and there are savings somewhere along the line; either doctors can see more patients, or data becomes more easily available, therefore you need fewer people processing it. I may have missed it in this, and I apologise for that. I was going to read through it again first thing this morning, but the M4 beat me to doing that. So, what do you see as the £36 million of benefits coming out?

Do you want to pick up on that?

Do you mind if I answer on the benefits first? It's about the digital paradox when you invest in something. In the automotive industry, you put a robot in and it removes a wage; it still puts the widgets in the right place. That's not the way it works in health. And let's be clear here: this is about benefits in terms of patient safety. You can't measure safety, although you could say, 'How much are we spending on the Welsh risk pool?' then look at all the radiology problems and say, 'Well, hang on, why haven't we reduced the risk by introducing, for example, electronic test requesting for radiology across the whole of Wales?' So, you can flip the argument to say, 'patient safety'. Cash releasing is very, very rare.

I haven't got time to have this discussion with you at the moment, but the committee I hope will be writing to you on that.

I guess, on the benefits piece, just a bit more: I think you've hit the nail on the head, really, that the investment in digital and digital change and transformation will drive efficiencies and improvements elsewhere. So, I think the challenge for us as a digital organisation, and the broader digital community across health and care, is acknowledging that that's the case, and where those benefits and efficiencies and improvements are actually visible, they won't find their way back to increases in the digital budget often.

I think we've got to take a whole health economy look at this, and I think that part of the challenge, I suppose, is ensuring that we all, particularly across senior leaders across Wales, appreciate that digital is something that actually is a utility that needs investing in, and that you've got to have, and it will drive improvements in safety, and it will drive economies of scale and efficiencies.

In terms of creating capacity to allow your limited workforce to work in a different way, that's a benefit, but the belief that if I put x amount of money here, it will release x amount of money elsewhere doesn't equate in health like other industries. We have to enable our workforce to work in a different way, but that's actually quite expensive, providing people with the connectivity, the things, the hardware to do their job.

One of the things I would like to emphasise to the committee is that we don't provide the laptops in secondary care. We don't provide the computers in hospitals. We don't run any of those services. But for the user, the user isn't interested in who's providing it; they're interested in, 'Does it work, is it quick, does it help me do my job?'

It comes back to my first question on compatibility.

Can I just explore what you mean by 'compatibility'?

If you have an item of data, let's say, in Morriston Hospital, is that data compatible if somebody has an accident in ABMU and that data needs to be accessed? Or if they're on holiday in Aberaeron, they go to a GP in Aberaeron, is that data able to be accessed?

Absolutely. In our negotiations previously with the General Practitioners Committee Wales, when Charlotte Church was there—. Not Charlotte Church; Charlotte Jones. [Laughter.] I'm sure both can sing. We were the first country to negotiate access to 100 per cent of the GP record. So, we have the ability to push the content of the GP record anywhere in Wales, which means when you present in Aberaeron to a GP, they can see your medicines. When you present to accident and emergency in Merthyr, they can see your medicines. They will have your past medical history. They will have your data. Those, then, who access the Welsh clinical portal can see the GP records, 211 million test results. I, as a clinician, for the first time in my career, can see every single x-ray on every single patient from this laptop in my front room. That makes a massive difference when I'm dealing with trauma on-call advice in the acute situation. In the planned care environment, because we've invested in an all-Wales approach to that, we can move those images around in multidisciplinary team meetings to get second, third, fourth opinions. In the radiology situation, where we have limited access to certain skill mixes, we can maximise that skill mix for those things and try and create capacity elsewhere.

Did you have a set of questions you wanted to move on to? Did you want to come in, Natasha?

Let Natasha go.

Can I just ask a sub-question? I appreciate the working togetherness of it all, but I'm going to fly the flag now for pharmacists, because I've met with a lot of them. I know we've focused a lot on fax machines, but having met a number of pharmacists, the biggest issue that they're having with members of the public—as you mentioned, patients are your priority, my constituents are mine, and I'm sure everyone here will say theirs are too—is that when a patient comes out of hospital, whether it be a cancer patient or a drug addict or my 76-year-old mother after having a stroke, their medication changes. When she comes out, she's given a colourful little slip, and it's my job as her carer to take it to the pharmacy and say, 'This is the slip', and I have to give one to her GP and say, 'This is her change of medication'. If I don't do that, no one has any clue that her medication's changed. If by any chance we lose that slip, then consider it a new form of hell for me, because no one's going to have a clue. Because that connectivity between the hospital to the GP to the pharmacist is just not there and it's causing a huge, huge stress not just for pharmacists but for patients and clients. So, what's going to be happening and what are you going to bringing to the table to ensure that this cross-contamination of no information being passed around actually doesn't happen? Because pharmacists' lives are being made very very difficult. As your stakeholders, they need to be represented as well in this.

I agree—

Before you answer that, can I just check that you're happy to move on to section 3, Mike, after that's been addressed?

Yes.

Lovely, thank you.

There are a number of elements in that. First of all, the discharge advice letter, which is an electronic communication, requires people to fill it in. Healthcare Inspectorate Wales did some audits across Wales and the results are not great in terms of people actually filling them in in a timely manner. So, that's a cultural change; it's not a failure of a digital system, it's a failure of clinical behaviours. There is a responsibility for safe transfer of care. The new programme regarding digital medicines, which is long awaited and is keenly anticipated in all sectors of health and comes with a shared medicines record, a single source of the truth, is going to be architected in a way that it will plug into all of these systems.

In regard to our pharmacy colleagues, we are increasingly signposting work to them, such as in the common ailments system. The Choose Pharmacy system has become vital in the delivery of vaccines, for example. Medicines reconciliation is the thing I think you're referring to. It goes back to this connectivity, this hardware, how do you get the thing to work faster? That isn't all within our control, but we're working with partners to provide those software platforms. There's something called Citrix farms that we're trying to use. But, ultimately, the kit in a pharmacy is the kit that the pharmacist buys. It isn't Digital Health and Care Wales. So, again, we have to work in partnership, because it's that end-to-end user experience. So, if we can define the standards of what the kit should be, then we can perhaps move it forward.

The other thing about it, of course, and we've touched on cyber security and the log-in element, is I'm aware that pharmacy colleagues and the private sector find that a little onerous. Two-factor authentication is an important part of keeping our services safe, and I'm afraid that's just one of the things we're going to have to use to keep the system safe.

I'm just conscious that we've got a lot to get through. Are the witnesses happy to stay 10 or 15 minutes longer to about 11:15? Thank you for that, because this next section I don't want to particularly skimp on time on, because it's quite an important one. In our what we call section 3, I've got Mike, Natasha and Jack, and after that we've got four other subject areas to cover as well. So, just keep that in mind as well. Mike.

I have just one question. I'll make a statement as well. You seem to worry a lot about hardware. I don't think you need to worry about hardware; it's the compatibility of the data that is important. It doesn't matter what kit they've got; if they've got Apple or PC, as long as the data is compatible, it doesn't really matter. That's just a statement. The question is: we've heard evidence of a disconnect between national and local IT priorities, so what is the process of agreeing the balance of work between supporting national and local priorities?

We've done quite a lot of work on that, actually, recognising that it's quite hard to agree joined-up plans. We do submit our integrated medium-term plan, our three-year plan, the same as every NHS organisation, but what we do is we socialise our strategic missions and the priorities that are within our plan with our health and care partners and with the local delivery organisations. So, we have regular, now, exec to exec meetings with the local organisations, so that we understand their strategic priorities, their strategic drivers, and they understand ours. The feedback is that we're working in the space that are the strategic priorities that allow more flexibility and options for local organisations. Following that, we also meet—our teams meet regularly—to agree joint plans now with all of the local organisations, so that we have that level of join-up, and the dependencies on our work and, actually, the local work, to achieve a desired outcome. So, quite a lot of work going on in that space to ensure that we've got—.

I mentioned earlier as well the directors of digital peer group, and the fact that you've got directors around board tables in the health boards. We can now target and agree joint priorities as well and actually initiate the work to move those joint priorities forward, and maybe be as one voice into Welsh Government around where priority investment should go. So, it's a challenge, because—. I think we should also acknowledge that we work in an industry where having a stringent, set, three-year plan actually doesn't really work, does it, because we need to be able to be proactive and responsive, and support, be agile and deliver at pace. So, making sure that we have robust and open decision making, and the way that we will prioritise and reprioritise as a leadership community, I think, is really important. We focused really hard on that, actually, in terms of the new organisation. We know there's more that we need to do and we are maturing in that area. We've now got a director of strategy whose focus it is to drive that agenda forward and ensure we've got those joined-up plans.

Chair, if I may, I think it's probably important to put on record an alternative view to the kit statement from Mr Hedges—

I don't want to spend too long on that.

—because kit does matter. If you've got a 10-year-old computer that won't run Office 365, then you can't run our systems. So, the right kit does matter in terms of its modernity and its ability to run the systems and applications that we're rolling out.

Understood. Mike, any further questions?

[Inaudible.]

That could be outside of this meeting, perhaps. Any other further questions on this section, Mike?

I just want to know why they've still got 10-year-old machines, but I'll move on from that.

There we are. No worries. I've got Natasha as well. [Interruption.] Just a quick one, is it?

Very quick. Can we get—if it's not here, or if it's here and I've missed it—a quick overview map of the take-up of WCCIS across Wales, in terms of the status of play with that? And—if the Chair will just indulge me—in regard to the take-up of WCCIS, is it not the case that those that are reluctant are firefighting and struggling in terms of operational and managerial headspace around this, and that this is one of the reasons? Because I'm surprised that there doesn't seem to be a simple explanation as to the reasons for why this has not been taken up.

I was just going to suggest that we follow up this meeting by perhaps providing you with a more detailed brief around WCCIS.

That would be absolutely excellent.

There is a wonderful slide, which I can understand, that shows the take-up of WCCIS.

Thank you. Okay. And my question on the back of that, if the Chair will indulge me, is: whose job is it to incentivise boards and trusts around this? I would have thought it's yours as well. Chair.

That was a question there, wasn't there? Or do you want to put that in the response?

So, I think that's a collective responsibility. I don't think it is a wholly DHCW responsibility. Clearly, there are SROs who lead on that programme. It's an action in 'A Healthier Wales' to adopt WCCIS. So, I think it's a collective responsibility.

Thank you. I've got Natasha and then Jack on this section. Natasha.

Thanks so much. Just a quick one. I'm just going to ask two questions, then I'll pass over to my colleague, Jack. In the briefing that you've sent, you've mentioned that KPIs are a Welsh Government issue. What are your KPIs for the year?

We have a range of KPIs and a 90-page performance report that we generate. Some of the main things for us are around our workforce stats. We've got low levels of sickness, we've got high levels of stat and mandatory training compliance, that sort of thing—so, quite a lot of evidence there. Our service availability stats: we look at our incidents, service satisfaction—98 per cent satisfaction rating on our service desks. So, we have a whole range. I think that they’re not necessarily visible under the national performance framework. I think that there’s some work to do and we are having these conversations with colleagues in Welsh Government around how we look at suitable measures for digital maturity for the system, and that gives us, perhaps, more meaning and more context into all of the discussion we’ve had about the uptake of systems and how they’re being used. We’re doing some work jointly with the directors of digital, in terms of assessing the measure of digital maturity, which we can all undertake, and then we can benchmark against others.

And when you say ‘benchmarking’, are you benchmarking against other areas of the United Kingdom or globally?

United Kingdom and further afield, to be honest.

Great. We all understand and completely respect the fact that COVID had an impact on employment—employability—. I can’t speak today; my apologies. So, with regard to recruiting staff with sufficient capabilities and abilities, what’s your strategy in order to try and address this challenge?

We have a strategy. We actually approved our people and organisational development strategy at the board last month, and it is very much about ensuring that we retain and retrain and develop and invest in the people we already have. That’s got to be a priority for us. We’ll see a shift in some of the work that our staff are doing. Five years ago, there wouldn’t have been roles that we are looking to recruit to today. That’s the nature of the business that we find ourselves in. So, investing in our staff and developing our staff are absolutely critical, and actually acknowledging that we will struggle to compete on salary, often, with the private sector, and we’ll have seen that. COVID had a massive impact, clearly, on all of us, and the response to COVID had an impact on the awareness and understanding of the importance of data and digital to everyone, didn’t it? So what that’s done is drive up the demand for digital and data skills. So, actually, we’ve got to make sure that we grow our own, so where we can’t recruit, we grow our own.

We’re a founding partner of the Wales Institute for Digital Information. It’s a triumvirate partnership between University of Wales Trinity St David and the University of South Wales and ourselves. We’ve got 37 apprentices moving through schemes there, so that we can offer exciting, dynamic, local careers for the talent that we have in Wales. We really want to drive up the Welsh language, actually, and how we are operating as a bilingual organisation. Actually, we think there's perhaps an untapped market in our first-language Welsh students actually seeing our organisation and the wider digital environment in NHS Wales as a really exciting place to work.

So, quite a lot that we’re doing in those areas. We’re also really conscious—. One that’s close to my heart is making sure that we have a diverse and inclusive workforce. We struggle with the male-female gender mix. Globally, that’s the case. We are doing some work to support that. We know and the evidence will tell you that if you want more girls to get into tech and actually understand that it’s not just tech, that digital has a lot of people and process opportunities, that we’ve got to catch them young, really, in terms of engaging with them. So, working with Technocamps and people like that to ensure that we can do that. And similarly, in terms of our equality and diversity, reaching out into community groups so that we can start to increase the diversity in the workforce, because we know—the evidence tells us—to have a more diverse workforce means that we will be higher performing and we will be better at that.

We’ve grown the workforce by some 43 per cent since the Senedd looked at the predecessor organisation, so that’s significant growth. There’s more that we need to do, but we also recognise that we can’t recruit to all of these things, and we can’t recruit at the pace that we need to, so we’ve also got a strategic resourcing group in the organisation, which is looking at how we balance the training and development and opportunities that we need, growing our own and attracting in that way, but also how we partner with commercial partners to actually supplement the organisation. That’s quite healthy. About 12 per cent of our workforce costs last year were externally resourced in, and a chunk of that would have been from Welsh firms as well. So, our role as an anchor institution as part of a foundational economy, actually we take that really seriously, and we think that’s a really good opportunity to ensure that it helps to upskill our own staff as well.

I’ve got Jack, if you've got any supplementaries on this, and then come on to your subject area, and I'll bring you back in, Natasha. Jack.

Thanks, Chair. I can't talk more about fax machines, I'll have nightmares. [Laughter.] I think we all will. But just to pick up, actually, on the challenges with vacancies, I can apply for 19 jobs at the moment on your website. I think what you were saying is that you do struggle, but you've got a plan in place. I don't think we can go into it today, but could we see that plan?

Of course you can.

Thank you. We'll drop a note.

And I will move on to relationships within your role. You clearly all have relationships with NHS Wales, whether that be through the chief executive level or chairs. Do you see room for a more collaborative approach, rather than just top down, and is there space for agile working and local work within the NHS?

'Yes' is the answer. Collaboration is a core element of our values, actually. Part of our ambition, and actually in the conversation about changing the culture of the organisation, one of our strategic missions is about becoming that trusted strategic partner. So, we've worked really hard to really evidence that, if you like, and that's what we're trying to do is work in the open. So, yes, there's a lot of collaboration that goes on and there's a lot of opportunity to work with local organisations on what they're doing, and we've got some really great examples of where local innovation has then been scaled up into a national programme that's been rolled out. Rhidian will be able to talk to us about the nursing record—it's award winning. That came from a really good idea in a local organisation.

Do you—because I don't want to spend too much time on this—look outside of healthcare at other industries for examples of good practice? You do.

Yes.

I spend a lot of my time travelling, listening to how other things are done in England, Scotland, Ireland and Spain and, occasionally, Malta, around the world, where we take the message of what we're doing, how we can work in partnership with others, the learning that we have. Let's remember that we in Wales, we take things from other places. So, we dragonise stuff from Scotland. We've taken Choose Pharmacy across for the Northern Ireland team to look at; they were very keen on taking that. We're using the code from the NHS England app, and we're going to use that in a way that helps Welsh citizens. So, we're open to listening and we're open to engaging across all of these things.

I suppose my final question on the point about collaboration is: how do you actively encourage in all of the organisations or partners that you work with? How do you encourage that, and can you give us some examples of that?

Absolutely, yes. So, through the layers, really, in all of our teams in terms of the—. We've talked a lot about connecting through the peer groups, but it's also actually through our teams connecting to ensure that we're working together. One of our major programmes of work is the national data resource. That's a federated arrangement; that is an all-Wales approach. There are, I think from memory, 22 staff who are funded from that programme who sit out in local organisations, who are really driving the value out there.

Can I just come in to add to that? That clinical voice, time to lead, because when clinicians are away from the coal face and they're engaged in things like this, the work doesn't go away, and there is a reluctance at the moment to sustain that expertise in those environments that are outside of the workplace, because everyone is under pressure.

I think the committee recognises the pressure our wonderful healthcare staff are under. If I may, just one final question, Chair, looking outside NHS Wales and the other partners. Care and Repair Wales told the committee that they weren't really aware of you, essentially. They are now. There may be others who aren't. How are we addressing this? What are we doing to address this problem? I see Simon wants to—

My background—. If you take the voluntary sector and the third sector, I've got a background working in that, and I was very keen coming in to do two things, really: to listen to what's going on in the voluntary and wider third sector, because there's a lot of very, very interesting digital developments and digital innovation there, often very cheap, but often they find it very difficult to sustain it beyond the first year because it's an innovative programme. So, we had a digital summit that we co-hosted about a month or so ago now that I was very keen that we did all the heavy lifting on, but we co-hosted with Cwmpas and the Wales Council for Voluntary Action, because there is a whole range of areas, not least of which is around inclusion and ensuring that digital applications have the intended consequences of greater inclusion, rather than the unintended consequences, but also the huge amount of innovation. We heard from—I'll just give you one brief example from Newydd Housing Association, of a small, innovative action that has brought their elderly residents into much wider social engagement through a very simple—. And those sorts of things, we need to be listening to, because it's not just the big tech companies that we work with that can bring in their huge expertise, there's an awful lot of stuff going on around Wales, around digital inclusion and digital involvement of people through the third sector. And I'm really keen that we work with that sector as partners, which sometimes doesn't always happen when the public sector works with the voluntary sector.

Are you getting enough support from Welsh Government to aid with working with—[Inaudible.]

We're not getting any barriers. I think it's something that we need to get on with and do ourselves—there's no reason why not; we can do this. And I know that there is support that's going in from Welsh Government into digital communities, it's funded that, and we're very much involved in that work. So, I think the Welsh Government is engaging with the third sector to a considerable degree around digital inclusion and digital engagement.

Okay, thanks.

Natasha Asghar.

Thanks, Chair. You've obviously done quite a lot, and from what you've presented to all of us, all the words are there: 'inclusion', 'diversity', all of it—I love it, it's great, it's fantastic. And I know everyone's nodding their heads and really excited about it. However, I want to ask you a question, each of you, if I can—and I know that we're short for time, and the Chair's probably going to be thinking, 'Please hurry this up, Natasha'. Can you tell me three achievements that you've made that you're really proud of whilst being in this organisation—and physical examples? I know you mentioned Newydd Housing Association, and you mentioned about how it's helped people get integrated, but what exactly has it done to integrate people? I want to know, from all of you, please, three things that you've achieved that we can go back, and say, 'They've achieved something'.

So, I have a list.

Anything you want.

The COVID response, I think, because that has not gone away. I think there are some huge examples of how we managed to support the Wales response to that. At the height of the COVID pandemic, the testing and the test centres, electronic test requesting, and the data flows that needed to happen so that your COVID result could get back to your clinical record, we did that, we shared the data with England. We commissioned, procured, configured the contact tracing system within six weeks of first looking out over the horizon to see what was there, and have continued to support that, and we were highly successful, with 30 organisations, including us, involved in that right across the public sector—a fantastic thing to be a part of, to be honest with you. Our Wales immunisation system, which is award-winning, that is underpinning the fantastic national vaccine programme. So, I'd pick those three, and there were hundreds in terms of the COVID, but I won't steal the thunder of my colleagues, who will want to pick their top three.

I'll give one, which is, essentially, what I've just been talking about. I want to look back at the end of my term, because it's not a finished job, this, and say that we, as a culture—and this is what the board is there to very much drive—were an open organisation, we listened and we didn't say, 'We have all the answers', so, we engaged with partners, and, critically, we mainstream inclusivity around digital applications so that it doesn't become that the unintended consequence of doing that was that a number of people now can't get the access that the greater number of people can—that we mainstream that from the start, so that, as I say, that inclusivity becomes an intended consequence. And I think that is not a job done, and it never will be a job done. But that, I think, is something that we've been able to do as a result of being constituted as an independent organisation, and I want to look back in a number of years, and go, 'We have made huge progress around being that type of organisation and having that sort of culture'. And it will never be done, because there's always another step beyond, but that's the achievement that I want to look back on as an organisation.

Thank you.

Lovely. Thank you. Any further questions, Natasha?

This is—

Sorry. I'm so sorry that we're short for time. I hate to ask, but as briefly as you can, Claire.

Right. Okay. I would say that, for me, it's been seeing the team grow in strength and confidence. So, if you look at our set of published accounts, I think they sparkle—go and have a look at our website. We've tried to translate what is traditionally something quite difficult to understand into an understanding of where we spend the Welsh planned and how we do it. We've done decarbonisation programmes, and various other things.

Thanks, Claire. I'm sorry to cut you short when you want to outline the question as detailed as you can in terms of what you've achieved, so I apologise for that.

That's okay.

Any further questions from you, Natasha?

Just one last one from me: Social Care Wales acknowledges that the DHCW does not have the capacity to support social care organisations, so what are the plans and capacity to address this issue?

Yes. In our set-up, I mean 'Digital Health and Care Wales', the 'and care' is about us supporting in partnership, so our remit is not to provide services directly into local authorities, because it's their remit to provide those digital services for their areas of responsibility. What we can do is support through partnership and collaboration and joint working. Through Social Care Wales, we've got a memorandum of understanding with them, and we're doing a lot of work—actually picking up on Mike's point earlier around data and data being king; I would say that with my background—but actually, a lot of work, and they're a pivotal part of the national data resource programme, so how we can join up the data and support them in doing that. We also have joint responsibility on service management for things like WCCIS, where there are leads from local authorities and health sat around the table to ensure that we're optimising operations. So, quite a lot going on without us having any direct responsibility.

Joyce, do you have a very quick question on this point?

I do. We've heard a lot about people not using the system, being bedded to other systems. Have you explored the possibility that they're not confident, that they need some training? And it's an easy thing to say, 'Well this is working okay' rather than to admit, 'Actually, I haven't got a clue and I need some help'. Because, if that's a barrier—and I suspect it is—whose job is it to do that, to remove that barrier of fear and lack of understanding?

Just a brief answer, thank you.

So, that's business change, isn't it, and it's the whole new ways of working and being able to support people through that fear curve. That's a joint responsibility. Local organisations are there to implement and do that; we've got a national business change team, and we support and supplement that. But we also recognise that we don't invest enough in business change to support those sorts of concerns, really, to try and optimise adoption. We've implemented a national change network, which is a structured development programme, recognising that we can't have loads of business-change resources; we want to skill up everyone to actually have those change skills to support the local teams. We've got our second cohort going through that now. It's an accredited qualification that we've worked with the Wales Institute of Digital Information on as well, so you can—. It's a qualification on its own, but it can be part of a certification or a broader credit towards a degree qualification as well. So, we're recognising that and trying to support all we can to have those business-change skills out there in local communities.

Thank you. Sorry, we've got a bit of a challenge—

Can I just ask about information essentials, Chair?

Yes. Yes, by all means.

And that basically is, you've mentioned that, or you inferred that there weren't that many women within your organisation, so could we just have some data to be sent to us in terms of diversity?

Yes, of course.

Thank you, Rhianon. I've got a bit of a challenge: we've got seven minutes left, I've got three areas we want to cover. We want to cover workforce, which Gareth is going to lead on and Jack wants to come in on; we've got assessing the impact of your work that Joyce wants to ask a couple of questions on; and then we've got the final section, which Sarah Murphy has been patiently waiting on and Rhianon Passmore wants to ask questions on. And we've got seven minutes, so, can I ask, on those three subject areas, for questions to be brief and answers to be as brief as possible? And I apologise that we are running out of time. There's a lesson learned for us; we maybe need to give more time allocated to such a session in the future. Gareth Davies.

Thank you, Chair. I'll be as rapid as I possibly can be. Capacity amongst clinical staff in using digital systems, when you consider that most clinical staff work shifts, it's pretty full-on work in terms of helping patients, et cetera, so what's the actual capacity in getting front-line clinical staff engaged with digital inclusion, so that we're obviously maximising that? Because where there has been progress made on NADEX and ESR systems, there's still a lot of paper around, isn't there, so what are the main challenges on that?

I'll be brief, then. Clinical staff across NHS Wales are desperate to have digital systems that enable them to deliver better care. That is dependent on connectivity. Connectivity is the ability to get through these digital systems software to the bit that they need. That is dependent on kit. That is dependent on revenue, making sure that the stuff is up to date. My take-home soundbite would be that you don't expect your clinicians to argue about having hot water and soap, but if their laptop's not working, it's a real struggle to get it replaced.

Helen, do you want to comment?

Yes. Really, we need to ensure that clinical leadership is part of that capacity point as well I think, isn't it? We've done quite a lot. We've now got chief clinical information officers and chief nursing information officers, importantly, as well, and I know from some of the submissions, that actually, we've got active conversations around allied health professionals and, of course, with pharmacists as well to ensure that we've got that leadership across the professional groups that support all clinicians out there to be able to adopt and use.

Just on the AHPs there, the evidence from the allied health professionals asks for greater support in establishing AHP digital leads in each of the health boards. So, what can you do to support AHPs, specifically?

Well, the first thing we can do is raise awareness, because we don't fund those out in the local organisations, but we can definitely raise awareness through our role, but I don't know if there's something else that you want to add.

Well, I think we could point everyone to the Wachter report, the 10 recommendations that came out from the vast investment in NHS England, about clinical leadership [Correction: 'three are about clinical leadership'] across all of those professionals. We pump primed it. In fact, I used my budget in 2015. There were no chief clinical information officers in hospitals across Wales. Limited amount of resistance pump primed that. Andrew Goodall pump primed the nursing leadership forum, so there may be a debate about how we pump prime health boards to get allied health professionals given the time and the skill mix to lead in this area.

Thanks. And just finally, Jack asked you earlier about the number of vacancies within the department, and there are quite a few, so, why is this happening? What are the main barriers to recruitment? And have you got a plan, working forwards, to try and fill some of these vacancies up?

Yes. So, we've grown quite considerably, as I mentioned earlier, a 43 per cent increase since 2019. We had 20 new starters last month, so we've got a trajectory to fill. We're about 1,000 staff now, and we've got a plan in place to fill those or to supplement that with external resources where we need to. They're new roles, in the main—I think we should really be clear about that. A number of those roles will be funded from the digital priorities investment fund to support the programmes of work that we are taking forward. So, they are new roles, and we are moving people around and prioritising in the organisation, and then sourcing external while we need to.

So, are there training and upskilling opportunities, then, just to fill these gaps and make staff's skills relevant to their role?

Yes. Absolutely and, actually, we're a dynamic organisation. You want to ensure—. I'm a mother of two millennials, so they want a career path, don't they? They want to know where their next step is. And actually, making sure that we've got those career pathways in place, and of the movement and the roles that we've appointed, actually, there have been about half of them that were internal promotions and moving people around into new roles. I should just mention our service desk—they've been shortlisted for numerous awards. They've been transformational in what they've done. Actually, that's a good entry point into our organisation, and actually they have a lot of turnover because they train them and they go on to more varied jobs in the organisation.

Thank you. Joyce Watson. Joyce?

Sorry?

Do you want to come in on that?

No.

No, that's fine. That's really helpful. [Laughter.] Sarah Murphy.

Thank you very much, Chair. Thank you, all, for being here today. I'd like to ask some questions, mostly around data transparency and also about consent. So, as we know, we've been talking about data, but, ultimately, this is about patients. We touched earlier on about when the 18,000-plus records of people who had COVID-19 was publicly posted and how distressing that was for people to have that happen. So, just in a similar vein, really, I was just wondering is it possible for people to opt out of this if they wanted to, like, individual patients? What consent is asked for when this data is collected of them and shared? And also, what if there was a particular person, say a relative or an ex-partner, or even somebody you went to school with, that you actually didn't want to be able to see your data? Are you asked any of those questions as a patient, or is it—? Who is this data accessible to, and what kinds of safeguards are put in place for those things, please?

So, there are lots of safeguard elements to securing the data of an individual. In primary care, patients can opt out of sharing that data—so, there's an opt-out process within the primary care environment. There's strict legislation and regulation within the medical professions about who you can share data with. I don't follow how a boyfriend could see a girlfriend's data; we don't expose data in that way. So, you can be reassured that that doesn't happen.

On another point, we have software within our system—it's called the national integrated intelligent audit service [Correction: 'national intelligent integrated audit solution']—and that is plugged into our systems, which means that we can see who's looking at what, when they're looking at it. It geolocates with postcodes, it goes with their roles, people of specialist interest. You'll be aware of the Hawthorne effect: when people know they're being watched, they behave differently. We robustly engage with the senior information risk owner network and the medical directors network about the importance of ensuring that all our staff understand general data protection regulation, that the information governance that is collected on platforms such as the electronic staff record has a high compliance, in addition to the cyber security element, because, actually, the data is a rich source and our people are our weakest point, and therefore we invest in the training and understanding across the workforce.

That's very reassuring, thank you.

A final point on that, really, is that the work—. And colleagues will be aware of the Welsh Government digital strategy and the data promise that is talked about there. So, that's pivotal to getting the policy in place and then the support of that, so that citizens are aware of how their data is being used and safeguarded.

You mentioned there that it's valuable, extremely valuable, data to certain companies, certain people. So, UK Government intends to scrap GDPR, with the intent to trade it, probably across borders as well. So, what assessment have you done about how this could impact data collection, protection and sharing of NHS Wales data, all the data that you have?

So, I think that, on that one, that's one for us to make sure that the policy and legislative base that is developed—and we will support Welsh Government in doing that—actually safeguards the approach and the policy approach in Wales.

Okay. It would be great to just get some follow-up on that. I'm asking the Welsh Government for a statement on this myself in a couple of weeks' time, but GDPR is non-devolved, and so there is a great risk there that Welsh Government doesn't have the power to protect it in that way.

And just another question, then, before I wrap up: is there any machine decision making taking place in relation to this data—algorithms, categorisation, predictive analytics, and, if so, can we have the details of those?

So, the primary work that we're involved in at the moment is through the national data resource programme. So, that has been set up to provide the capacity, capability, the technology base, that's needed to have an open standards data-driven architecture. So, we've commissioned, we've procured, a cloud data platform. We've got a terminology service that's live and in operation now that gives us the data consistency that we need, and training and education and a data strategy in place through the national data resource.

There is a community in terms of artificial intelligence and how we're going to start to use it, because that will give us all of the big data capabilities that you need to start to kind of exploit some of those new ways of working and build those information models. There's a community in place, really, that is looking at the opportunities. So, I think we're coalescing around that as an ecosystem to make sure that we can actually maximise the opportunity that quite a significant investment in the data elements will actually give us that data into knowledge, into insight.

But are those things happening right now? Are algorithms being used, categorisation, predictive analytics, right now?

They are for some things, yes, but they're not across everywhere.

Can we have the details of those, then? That would be wonderful.

Yes.

And also can we have the information about who is in that community as well?

Yes.

And I guess, as soon as you can, really, what the overarching objective of that community ultimately is. And, if I can, Chair, just two questions—if you could follow up on them; I don't need them answered now. But it would be really helpful if we had the information about who is the data controller, the data processors. And you mentioned about it being regularly audited—if we could have the information about those audits that would be great, and also if there are any data sets that are currently open source and any you intend to have in future that are open source, please.

We'll make sure that we send you a note on those questions.

Okay. I was just scribbling.

I appreciate it's a lot to write down. We'll clearly send a note on some of those points. Thank you. Rhianon Passmore.

There are four things so far that you want us to follow up on, which—.

We'll make a note, though, as well, so you've got them as well. I appreciate that. Rhianon Passmore.

Thank you. Very briefly, I just wanted to follow up on Sarah's questioning in terms of the last couple of questions that she's asked about data holding. So, what sort of analysis has there been in regard to the direction of travel from the UK in regard to the selling of data? I think we can combine that in terms of the information that gets sent, but I do think these are really important questions for us in Wales, without that functionality, so if we can make sure that's done.

In regard to the agreed data sets—I know that the allied health professional group has mentioned this—has there been any progress around that? That's my first question.

My final question that I'm going to ask, Chair, is around the digital health and social care strategy for Wales from 2015, where there was a strategic aim to make patients' medical records, as you know, and data available. What plans around that, further to what's already been said, are forthcoming from yourselves?

So, shall I pick up the data set one first?

Very briefly, because we've already dealt with it, yes.

Oh, right—

But, no, if you've got anything to add to that in terms of your analysis, because, obviously, in terms of keeping an eye on this, this is a major risk, in terms of what we were talking about earlier in terms of cyber attacks, but there are other risks around this that will be important to the people of Wales.

Yes. I thought your question was more around what data sets are available, sorry.

In terms of AHPs, yes. That's the agreed data sets. That's the second question I asked.

So—

Yes, I was just going to say, we have met—

Sorry to throw two different things at you.

I have met the leadership, the digital leadership. In fact, there's an allied health professional on the national council of clinical informaticians. We have suggested that they adopt a very similar approach to what the nursing community did in understanding and scoping out what their ask is, collating the pathways and the paper processes that they have, rationalising that, before we enter a digitalisation programme. That's been very successful in the nursing programme, and it was successful because of that leadership that we touched on, how that investment was put in to help them lead. So, they're aware of how we could move that forward. As I say, it was in the last four months that we've started those conversations.

Would that be your mandate? Or do you see that again as a shared collective?

These are always shared collectives, because it's about user requirements. It's about understanding what the users need to do their job, and that's how we engage.

We don't have the capacity to mandate anyone to do anything. Everything is done through partnership and collaboration.

Is that sometimes disabling, in the sense that you've got such a wide brief around this, and that there is no one single body that's dealing with some of these issues?

I think to be successful we've got to collaborate, and we've got to understand the challenges for every organisation and every local environment, really. So, I think collaboration is the key to success in this, and I think that we're seeing quite a huge step up in the level of collaboration that we and the wide NHS and health and care actually are taking forward. So, I'm not sure mandating is helpful, for us to be mandating.

Can I thank you so much for agreeing to stay on for the additional time this morning? It's very much appreciated. I apologise for curtailing some of your answers at some points, because that's on us, really; I think we tried to pack in too much today. So, thank you for that. And we'll make it our responsibility—. All the areas that we asked you about and that you've agreed to provide further information on, we'll make it our responsibility to make sure we capture all that and write to you, and perhaps ask some additional questions as well, if that's all right. We'll fax those over to you.

Thank you, and thank you for the opportunity today.

Lovely, thank you, and that brings our public session to an end this morning.