National Assembly for Wales

Prynhawn da. Welcome to the Equality and Social Justice Committee. We are a bilingual institution, so simultaneous translation from Welsh is available. You can also watch our proceedings on Senedd.tv, and if you're not able to join us at 3.15 p.m., when we're going to be taking further evidence on tackling data justice and data inequality, you can obviously catch it later on Senedd.tv. I have no apologies; all Members are present.

I just want to ask Members if they will note the 10 items of correspondence, which are mainly about our inquiry into gender-based violence. There's also one on our inquiry into child poverty as well as upcoming budget discussions. Are you content to note all these papers? I see no discord. Thank you very much. 

Under Standing Order 17.42, can I ask Members to exclude the public for items 4, 5 and 7 of today's meeting? Okay, thank you very much. Can we go private?

Welcome back to the Equality and Social Justice Committee, and we're now resuming our public session on data justice. I'm very pleased to welcome Alyson Thomas from Llais and Professor Hamish Laing from Swansea University. Thank you very much for your time.

My first question is to Llais, because your submission is very good at summing up the benefits of having much better data shared through the new technologies we now have had in the last 10 years or so. But I just wondered if you could tell us a little bit about the risks. I was in a session recently with big pharma who are very keen to get their hands on our data, and equally, we've anecdotally heard about people who work in the health services inappropriately looking up information about somebody they used to be in a relationship with. And these sorts of things are obviously very worrying and require some very clear ways in which these sorts of things are not happening to people who give their data, otherwise freely, if they think it's for their own benefit and for the future of society's better understanding of disease. So, Alyson, I wondered if you could just set the scene in terms of what you're able to tell us about this important subject. 

Thanks very much. I think what we hear from people in relation to their data, and particularly their very sensitive data that they routinely share with healthcare professionals in order to get the service that they need, is that they need assurance that that data is held securely, and only shared with the people who need it to provide their direct care, as well as the opportunities to share anonymised data to improve healthcare services more broadly. So, I think it's really important that the NHS is clear with people about the ways in which they protect that data in terms of ensuring access to that data only for those who need it, and checks on that to make sure that the system can identify when individuals may be looking at data that they don't need to look at, and then what's done about that. So, it's really important that people are made aware of the system safeguards that are built in so that when they share their data, it's properly held and secure and not shared beyond that which they expect, without their permission. 

Okay. So, Professor Laing, how would you do that in practice? If you let the pharmacists in, how do you stop them harvesting the data for their profitability?

So, just perhaps to start by saying I am, indeed, at Swansea University, but I'm here as the senior responsible owner for the digital medicines transformation portfolio. I'm also the chair of the Digital Inclusion Alliance for Wales. So, two interests.

So, the answer is that, we are not—. Pharmacists, community pharmacists, are already in receipt of patients' data because they receive a paper prescription that has the details and sometimes also the indication for that medicine. And currently, 40 million of those pieces of paper are boxed up every year and sent to Shared Services Partnership, who are the payment authority who deal with the reimbursement to pharmacists. So, there is nothing that we are doing by making that process digital and doing away with 40 million pieces of paper every year that alters the information that is being shared with individuals. What it does, however, allow, by making it digital, is it makes it much easier to process those bits of information, and it will allow for the first time that information to be held in relation to a patient in a single place. So, one of our objectives is what is called a 'consolidated medicines record'. At the moment, if you go to your dentist and your dentist prescribes some antibiotics or painkillers for you, your general practitioner won't know that, the rest of the NHS system won't know that—the pharmacist will know because they received the prescription, but nobody else will.

And back to the question you put to my colleague Alyson, I think patients expect that, actually, their clinical information is already being shared around the system to allow the delivery of care, and yet, that is not the case. So, what we are hoping to do in our programme—what we are going to do in our programme—is to make it so that information does flow for primary clinical purposes in a much more effective way than happens now, but there won't be—. In terms of primary care, there won't be any new data; it's the same data, it's just being done in a different way.

Thank you. There's lots we can pick up on later on, but I'll pass on to my colleague Ken Skates to ask some questions.

Thanks, Chair. Do you think that there's enough awareness out there amongst the public about what healthcare data is collected and how secure it is and how it's used, or do you think that more awareness is needed?

I think from our point of view, definitely more awareness is needed. Hamish just picked up on a really important point about the public's expectations that data is shared more widely than it actually is in the NHS in order to provide them with direct care, and we frequently hear their frustrations when that isn't the case. So, for example, we will hear from people their frustrations that they have to repeat themselves fairly often in different parts of their care pathway on information that they expect the healthcare professional sitting in front of them to know—things like their medications, for example. So, we will often hear, and sometimes in quite distressing circumstances, if somebody has been admitted to an emergency department, for example, and a family member has been asked details about medication. That can be really worrying for a family member to have to remember that information at that time, when there's a very real expectation that the NHS should already hold that information and shouldn't be asking individuals to repeat it.

So, there is a real issue in terms of the public's understanding of what data is held—not helped by the fact that, currently, it's not easy for them to access that data, to know what it is and have the opportunity to check that it's correct. So, there definitely needs to be more awareness around that in terms of its use in the NHS for their own personal care, but also its broader use and the impact that that data can have if it's anonymised to improve healthcare services more generally, for example in relation to research.

I would absolutely agree with that. And one of the things that we'll be doing is to put a list of a patient's current and past medications and, indeed, allergies, as recorded by the NHS, into the NHS Wales app. So, they will, for the first time, have access to what the clinicians have, the same list of medicines. It would also, for example, allow them to know that, yes, actually, they have had penicillin in the past without problem—something that they may have forgotten because it was many years ago. So, we'll be making those data available back to them, and as we build this consolidated medicines record, more and more of the prescribed information about them will be able to be offered back to them, so they can see, for example, exactly the list of medicines they left hospital with when they were last in hospital—things that it is really hard to remember, not least because the names are often quite difficult. So, we're trying to make it easier for patients to know what is held about them from a medicines point of view.

I think from our point of view as well, it's sometimes more than just the clinical data and information, it's really important that information is captured that enables healthcare professionals to provide people with care in the way in which they need it. So, for example, their communication preferences and needs, what they're called, their preferred language—all of those things make a big difference to somebody's experience of accessing care and their confidence and trust in that care. So, it's really important that that wider information is also captured and properly shared and used to plan and provide tailored healthcare to meet people's individual needs. 

And just to add to that—I absolutely agree with that—I'm not here to speak about the NHS Wales app, but I do sit on the board of it, and, actually, within that is a function that is called 'About Me' and it's exactly to capture that information—what people's preferences are, their language preferences and all sorts of other opportunities for people to describe what matters to them. And although, initially, that will sit in the app, the intention is to make those data available in the clinical systems and that people use, for example—. The Welsh nursing care record would be an obvious place to try and get those data too. And the great thing about that is that's information that's managed by the person, so they can change their preferences and it should then populate other parts of the system.

Sarah Murphy.

Thanks very much, Chair. Thank you, both, for being here today. Professor Laing, as you touched on the NHS app, I was wondering if you were aware of whether or not there was going to be a function on there that would allow patients to see who had accessed their records and looked at their medical records and also, if they wanted to, if there was going to be an option for them to say that there are certain people that they would prefer not to be able to access their records.

On the last point, I think the answer is 'no'. I don't think there is any intention to make it possible for people to exclude clinicians from seeing information about them. In the design of the app, there's been a lot of discussion about building in, if you like, a kind of audit function that would allow people to see who was looking at their data, and conceptually, it's possible. There is not yet an intention to develop that, but it has been designed with that in mind, should Welsh Government decide that they would like us to build it in. It's quite complicated. What I would say, though, is that there is already a tool, which is called NIIAS, the national intelligent integrated audit solution—I'm sure you'll be familiar with it—which is the national audit tool, and we will be applying NIIAS to a lot of these new medicines functions that we're developing, including at the level of the application programming interface, the interoperable messaging interfaces that are being built. So, we'll be able to see who is looking at what data and what data is moving about, but that's not the same as the patient being able to see it. The patient—. As I say, this could be built into the app, it's been designed with that in mind, but it's not yet been commissioned as a piece of work to build.

And you said that Welsh Government would need to insist on that being commissioned.

The bottom line is that they'd have to fund it, basically—commission it.

Okay. Also, are you aware, in your role now or in your previous role, of any instances where people have accessed people's medical records when they weren't actually their clinician or physician? And what happened as a result of that, please?

Yes. I was medical director of a health board, as you know, and as a result of the NIIAS audit tool, we would receive a monthly report of activity that needed investigation. Sometimes, nearly always in fact, it turned out to be appropriate access. But NIIAS has a number of triggers—it's not very sophisticated, but it has some level of sophistication, so it will, for example, spot where a clinician maybe lives at the same address as a patient and is looking at the record. There are a number of other criteria. And so I would have a report every month with specific examples that we would then investigate, and in the event that it was inappropriate access, then disciplinary action would follow.

Thank you very much.

Back to Ken Skates.

Thank you. The pandemic necessitated the rapid adoption of digital technologies in the NHS and in other bodies. Do you think that that's changed public views on data sharing, and also is public trust varying on the basis of the organisations that data is shared with?

I think the pandemic certainly did alter the public's perception in terms of data sharing at a broader level in terms of, for example, just seeing on the news every day graphs of data that was collected by the NHS and shared between the NHS and social care in relation to responding to the COVID pandemic. That certainly did raise a broader awareness of data being collected and used at that wider population level. They also experienced the use of digital data for the first time, often in relation to accessing, for example, their GP, including apps like askmyGP and eConnect. Many people got used very quickly to using new technology to share their data and to access information in that way, and there was lots of positive feedback that the former community health councils heard from people at that time because of the flexibility that that offered.

On the flip side of that, I think there were concerns around how consistent the access was to those kinds of digital systems, depending on which GP practice they were registered at. Of course, for those people who were unable or who didn't want to access their healthcare digitally, then there was a real concern and continues to be a real concern that they'll be left behind because the focus will be on digital healthcare at the expense of meeting their individual needs if they are not able to access healthcare digitally. So, that focus on developing digital data collection and healthcare systems is really, really important, but we mustn't forget it's really vital that, at the same time, consideration is given to how systems need to be developed and bettered when they are not provided digitally as well, so that nobody does feel that they are left behind.

You can imagine, as chair of the digital inclusion alliance, I would really echo that. It's really important. There are two things. I think we need to make sure there are non-digital solutions for people who don't wish to or aren't able to engage digitally, but, equally, we also need to support the people who can't but would like to become digital. I think there's a danger you can embed a dual analogue-digital pathway for ever, unless you try and support people who would like to be online to be so.

We were very pleased to hear at the digital inclusion alliance network meeting last week, in fact, from the chief digital and innovation officer for health and social services in the Welsh Government, who talked about an idea that we'd been proposing and appears to have been picked up, which is that any request for funding for digital investment in health and social care should include as part of it an explanation for how people who are digitally excluded are going to be supported and, indeed, potentially helped to be included. I think that's exactly the right approach.

In answer to your other question, yes, I think people do have a different—. The COVID example is very interesting, because I don't imagine people realise just how unusual it was, the amount of data sharing that went on to allow those reports to happen. Lots of special arrangements were put in place at very short notice. I expect people probably thought those data were already being shared and available. I think people do have a different view of who they will be happy for their data to be shared with, and I'm not sure how much data there is on that.

It's interesting that your Chair started by saying that big pharma are trying to get our data, and suggested that that's somebody you wouldn't want your data shared with, whereas I think people expect it to be shared between health professionals. I think they probably expect it to be shared between health and social care. They're not very keen on it being shared with the police or HM Revenue and Customs, for example. And just to give you an anecdote: in collecting data and outcomes for people with chronic and persistent pain, the experience has been it's quite hard to get those patients to complete questionnaires on how they are today, and it's thought that that's because they're concerned that the health system may share that with the benefits system, or their entitlement to a Motability vehicle, those sorts of things. So, people are very wary about sharing that, even within the public sector—other bits of the public sector, but less so between health and social care or within health, I would suggest.

Excellent. Thank you.

Thank you. Moving on very succinctly to Jane Dodds.

I'm so very sorry; the translation didn't work for me. I couldn't hear the English, I'm afraid.

Right. Shall I ask, just for speed—?

They're both working for me, so that's of concern.

It worked in test, but it's not working now. My apology is that I didn't understand the Welsh, rather than I didn't hear the translation.

I can hear it now.

I'll tell you what's happened, Alyson. Our selection of languages has been lost when we went to the lobby. If you tick back on English, we'll hear it.

I can.

Yes, it's working now.

I think that for us, the main area that we’ve been involved in in terms of providing people with more access to their healthcare data is the development of the NHS app, and I think that Digital Health and Care Wales have been working with a selection of the public to test that app in terms of the extent to which it meets their needs and covers the things that they want it to cover, and to use that feedback to inform the further development of the app.

I think from our point of view, it’s really important that any new system designed to provide the public with access to their own data to better enable them to be more actively involved in their healthcare is vital, so the continued gathering of feedback from people using that NHS app on how it’s working for them, and how it needs to be developed further, is vital.

I’m sorry, I missed the last part of the question; is it in terms of the safeguards?

Thank you. The answer is that, specifically on the NHS Wales app, it has been built in a way to be, if you like, plug and play, so that a whole series of other things can be connected to it, and it provides a single portal for the patient or the citizen to access their information through a secure log-in. The log-in that's been used is the NHS log-in, which is the one that many people in Wales—1 million people in Wales—used to get their COVID pass, albeit that it's controlled by NHS England.

The first things that are in there are things that were already available to patients through the My Health Online service, but that My Health Online service is going to be retired. Half of it's going to be retired before Christmas, and the other half, I think, next year. So, the app is, if you like, stepping in for My Health Online. It includes the summary GP record and the ability to order repeat prescriptions and one or two other things. That is dependent on the general practitioner. Those are general practitioner functions, and they're dependent on the general practitioner having made those functions available. The same will apply in the app, because the data controller for those data is the general practitioner.

We know that, in My Health Online, and this is likely to translate into the app, the thing that nearly—. I think there are two practices that haven't, but every other practice in Wales has turned on the ability to order repeat prescriptions. So, those are data and that allows the patient therefore to see their list of medicines and to select the ones that need to be repeated. That is all being built into the app. Being able to see a summary of your GP record, I think, is really important, but not every GP, for a variety of reasons, has enabled that function yet. And there are concerns about third-party data that may be sitting in a GP record, for example—you know, a consultation where the GP has recorded, 'Mrs So-and-so reported that her husband...' and therefore that's third-party information, and so there are some understandable concerns, I think, about opening up the historic GP record without having a chance to review what's in it.

The intention for the app is that it will have much more than that. When I was chief information officer in a health board, we gave patients access, through an app, to all their letters from the hospital, their blood test results, and their appointment dates—those sort of things. I think that's really important. That's pretty common now in health systems in England. I think 3 million or 4 million are using the app we used in Abertawe Bro Morgannwg university health board. And I think we need to see more of that. You can do it in a way that is very safe, is very secure, and actually that app has an audit trail where you can see who's accessed it, and you can choose who you want to see which parts of your record if you share it with a family member, a next of kin, maybe, or a carer, if you wanted to, or turn it off if you want to.

I think those things are important, and I would hope that in the future we'll see more of that in Wales, because giving people their information not only provides safeguards, actually—. If you've had a blood test result and nobody appears to have acted on it and it's very abnormal, it's good the patient can see it and can question why nothing's happening about it, for example. So, I hope it will do that. It empowers patients. It allows them to be involved in shared decision making better, but it has to be done safely.

I think the really important thing in what Hamish just said in terms of making that information available and empowering people is that it's not enough just to make that information available; it has to be understandable to them, and it has to be part of that whole system of communication between themselves and their healthcare professionals. We know that healthcare professionals, for obvious reasons, will often write or say things in technical, clinical language, which if a patient were to look at that in isolation could be concerning and worrying. So, it's really important that, when the health service is planning to make more information available to people, it also thinks about how it does that, so that it's genuinely empowering and it is understandable to people. That does mean a bit of a cultural shift in terms of healthcare professionals and how they talk and share information with each other and with patients and service users.

Yes, I think it's a general principle that the public should have as much control as possible over their data. But if they are to exercise any decisions around opting in or opting out, it's really important that they're able to do that in an informed way. There are considerable benefits of sharing data, not only in terms of improving an individual's direct care, but also in terms of improving the development of healthcare systems overall. So, it's really important that if we're having a conversation about opting in or opting out, we're also having that conversation of describing the benefits of sharing data, and the implications if that data isn't shared in terms of the development of healthcare systems and services overall.

I think I'd make a distinction between patient identifiable data and pseudonymised or anonymised data. I think it's really important we have complete data for research and understanding how the system works that's pseudonymised, so it's safely secured. For patient identifiable data, I think it is difficult. I think there are real risks, if people do start with selectively withdrawing access to parts of their health record, in order to provide good care. But as you say, it's about information and understanding, as Alyson says.

So, as you will know, in England, you have an opt-out; we don't have an opt-out here for health data in Wales for primary uses, and, broadly, I would favour having a complete set of data as a clinician. It's very hard to operate with only half the data. That's a slightly different question about whether people have the right to; I'm not quite sure I know the answer, if I'm being honest.

Before I just pass on to Sioned Williams, I just want to ask you if the one or two additional things that are in there are also the type of things that enable the patient to see whether or not they'd been referred on to a secondary consultant or something like that, because it's one of the things we get as Members, that people complain that they tried to get the GP to refer them on and it hasn't happened, and when they've been back, it still hasn't happened. So, does it enable them to track whether or not what has been promised has actually been done?

Certainly, the app—the so-called 'patient portal'—that we deployed in Swansea would allow a patient to see where a secondary care clinician has seen a patient, because they would know because they were there, but also whether they've perhaps referred them on to a colleague or ordered a test. A lot of people, as you rightly say, they go to the GPs, saying, 'Do you know if the cardiologist referred me to the dermatologist?' or 'Has anyone booked my CT scan?' And, actually, all of that disappears because the patient can see that the cardiologist has written to the dermatologist and, indeed, what they've said and what the dermatologist says back. So, I'm really in favour of making that information available to patients. It reduces a lot of anxiety, and also workload for GPs particularly, in fact.

Sarah Murphy, quickly.

Thank you, Chair. Just a really quick question, then, because that all sounds tremendous. I'd say that quite a lot of my casework is people getting in touch with me, wanting me to get in touch with the health board to ask all of these things. So, why does it need to have our medical records on there, then? Why can't we just have a system and an app for patients that is just about their appointments, correspondence, blood tests results? Why does it need to have the entirety of our health data uploaded? Even just the current prescriptions that we're on, I'd still say it would be best if people had access to say who they didn't want to see that, but why does it need to be, then, our entire medical record?

So, I don't think anyone's got their entire medical record, or any intention to make an entire medical record available, partly because it would be vast and partly—. Of course, everybody is entitled to ask for a copy of their entire medical record and, I think, in Swansea bay, about 500 people a month used to, for a variety of reasons, normally medical, legal, to do with accidents and that sort of thing. You can put in a subject access request and be sent a 1,000 pages of your medical record, but in the app—both the NHS Wales app and the Swansea portal app—you're not seeing your entire medical record, because it's not digital, it's paper. So, the only bits we can share digitally are the bits that are digital, and there is a summary GP record that has your list of diagnoses and it has your list of medicines and allergies, and a few other things; it's not the whole of your GP record.

Okay. It's just that you mentioned NHS England, but in England the GPs had it imposed on them that they had to provide the medical records, and they had to spend many, many hours going through and redacting anything that mentioned third parties or that wasn't relevant. So, isn't that what we're going to be doing in Wales, because we've used the NHS app from England that they've given us to use in Wales now?

So, two things in that. I think my colleagues in general practice in England said that it was a negotiation, rather than an imposition, and it was in their contract, so there were financial implications, and I still don't think that they've shared the whole of the GP record; I still think they've only shared parts of it. Sorry, I forgot what your second point was.

Just that, you know, you mentioned the NHS England app. I assumed it was the same process.

Oh, yes, that's right. No. So, the source code—the technical code—for the NHS Wales app started life as the NHS England source code and they've generously given it to us in Wales, but it's not being used in quite the same way, and indeed it's been developed quite a lot to be different. So, merely because it has the same source code, it's not the same app, and even if it was the same app, we'd still have control over what we chose to put in it.

I guess my—. Sorry, Chair. My question is, I suppose, though: do you think that people would feel more comfortable with sharing all of this information if they were able to see who was accessing it, and if they were given the opportunity to say that there were certain people that they didn't want to have access?

Certainly to the first bit, I agree. I think it would be a very useful bit of functionality to make it possible for people to see who's looked at their record. You do have to just bear in mind, though, that if, for example, you're admitted to hospital, there might be 10 people a day looking at your record, for good reasons, and so the amount of information that a patient may get when they're in hospital might look a bit overwhelming and hard for them to make sense of. But, as a general principle, yes, I think that would be a good thing.

Thank you.

Thank you. Sioned Williams.

I think, from our point of view, we saw during the COVID pandemic, really startlingly, that there were gaps in the information that was available to health and social care in relation to particularly marginalised groups, such as minority ethnic groups, those who might be socially or economically disadvantaged, so some key data is missing. Now, that's a significant thing in terms of the impact of not having complete data in terms of designing and delivering healthcare systems that respond to people's individual needs. If we don't have that data, it's very difficult for healthcare services to make sure that they both understand those needs and the impact of the way in which they're delivering healthcare on people with individual needs. So, I think it's really important that action is driven forward to both understand and tackle the reasons why people might not share data and information.

We know that for some groups of people it isn't always easy for them to trust that when they share information it will be used in the right way, depending on what that information is being collected for and who's going to have access to it and use it. So, there absolutely needs to be that strong focus on working with marginalised groups to understand both the reasons why they might not offer data and information in the first place, and then to work with them to build that trust and understanding so that information is collected. 

But, fundamentally, we know that people share information and are willing to share information when they know it makes a difference. So, it isn't enough for healthcare systems to focus on encouraging people to provide that information and to collect that information; it's really important that that information, having been collected, is then used and then people can understand the difference that it's made in terms of the design and development of healthcare systems for the future—not necessarily individually, but in a broad way.

I think, Altaf Hussain, you wanted to come in at this point.

Thank you very much. Now, coming to the pandemic, and we saw during the pandemic a reluctance amongst ethnic minority communities to receive their COVID vaccine. This was drawn by misinformation and mistrust. Now, what strategies have, or are being prepared, to remove the barriers and reach out to our ethnic minority communities to address this mistrust?

Do you want to start, Alyson?

I'm not sure I'm in a position to answer that. I think that's a question for those who run the immunisation campaign. But I do know that they worked really hard to try and both improve access, for example, offering vaccinations in and around mosques and that sort of thing. They've tried to make it easier to reach hard-to-reach communities and make it easier. But what their intentions are for the next pandemic, I can't tell you.

Alyson.

I think, more broadly, from our point of view, we are aware that the Welsh Government is focusing on this in relation to the introduction of the equality, race and disability evidence units, and that those units are looking at a prioritised programme of work that will help understand, and work with people to understand, the reasons why they might not share information, and to encourage, inform and empower them to do so. But it's relatively early days in relation to the impact of those units, but we certainly are aware of their plans and priorities in that area. And certainly, in terms of their proposed ways of working, we are encouraged by that strong focus on working with marginalised groups, to understand those issues and to develop ways of working with people to co-design collection systems, et cetera.

Great. Thank you very much. And do you agree that community leaders and healthcare practitioners may prove to be the most important agents in creating an environment of trust within ethnic minority groups?

In short, yes.

Yes. I think working with colleagues in the community, I think—. Currently, healthcare professionals are still seen as being trustworthy, and I think they can help both to explain and build trust. Sadly, there are some healthcare practitioners who have been responsible for some of the distrust and some of the misinformation relating to vaccinations. So, it's not universal, but as a general principle, yes.

Thank you very much. Thank you.

Okay. Back to you, Sioned.

I think, from our point of view, we know that they've been focusing on establishing themselves and developing their priorities. They've also been focused in the short term on working to better understand data in relation to workforce, which is outside our remit. What we are keen to do is to make sure that, when they are extending that roll-out into looking at services more broadly, that we have a relationship with them and have the opportunity to talk with them, to share the information that we are hearing and to work through our networks as well. But, as I said, it's early days, from our point of view.

And I would just add—coming back, actually, to your first question—that, certainly, in the way that we are—. The whole of the digital medicines programme is focused on being equitable across Wales for all communities. Of course, everybody who receives a prescription will have the chance, therefore, now, to do away with the piece of paper, when it's all done. And we work very closely with many groups, including those who represent the groups you've described, to try and make sure we're doing this in a way that works for them. But in fact, e-prescribing in the community, for a patient, it will be really the same process—they just won't have a piece of paper, which can be lost, and is in itself insecure. It will be a lot easier for them: they'll have their prescription, they'll agree either through the app or in person where they would like it to be dispensed, and they'll get a notification if they're an app user to tell them it's ready to collect. They won't have to worry about getting the prescription, getting it to the pharmacist, wondering where it's gone. So, it should, in that respect, be equitable.

So, fortunately, for the primary care, the GP prescription part of our work, actually you don't have to do anything digital as a patient—in fact, you just don't have to collect a piece of paper. You can, if you wish to use the NHS Wales app, choose the app to nominate your community pharmacy of choice, and you can use it to order your repeat prescriptions. But if you don't want to use the app you can do it in exactly the same way as you did before—you can tell the GP practice where you'd like your medicines to be dispensed, or you can tell the community pharmacy, and they'll do it for you. So, in this respect, it's a very digital thing, but, actually, it's all behind-the-scenes digital, and, for the user, it doesn't need to be digital at all—it just will be easier and more efficient for them.

I think, with any change, the people who are most likely to be digitally excluded are also disproportionately represented in use of the health service. So, it's not just older people; people with long-term conditions are more likely not to be online, people who have poor health and adult literacy are likely to not be online. So, the NHS has a particular responsibility I think around digital inclusion, and it can't be passive about it—it needs to be actively doing things, working with partners like Digital Communities Wales and many—. We've got 92 organisations in our Digital Inclusion Alliance Wales network—brilliant people, and they need to work with partners to support patients and staff that are digitally excluded to get online.

But, in terms of e-prescribing, as you're described it—we use a slightly different term—I really don't think it's a challenge because there is no need to do anything different from what you do now. You can—. And it might be that people will say, 'Well, I wish I could just change my preferred pharmacy by tapping a machine', but you can just walk into a pharmacy and tell them, or your GP. So, I'm reasonably comfortable that digitally excluded people shouldn't feel left behind by these changes—they'll just find they don't have to go and get a piece of paper from the GP.

And I think, in terms of the broader concerns around digital exclusion and who we hear from, in terms of being fearful of being left behind more generally, not necessarily in relation to e-prescribing, we hear from people in rural areas quite a lot about their concerns of being able to access services online, simply because of their ability to get broadband, Wi-Fi et cetera. And then the cost-of-living crisis and the ability of people to, even if they have been up until now using smartphones et cetera, then that is a concern in terms of them being able to access services digitally if they are struggling with money to be able to access the latest smartphones et cetera. So, those things need to be taken into account in terms of these developments.

Sorry, if I could just add to that—again, I absolutely agree. Data poverty is a huge challenge in Wales, and we know that I think it's something like 16 per cent of people either gave up or reduced their broadband service last year because of cost. There's some really important work that Welsh Government have commissioned, and we in the university and the alliance are part of, which is to establish what the minimum digital living standard would be, starting with families with children, but the hope is to look at other representative groups. And that's been really interesting work—the first part of the report is published, but the second part is just being finished—to set out what people's needs are in order to function in a digital society if you're in a household with children. And we saw that from COVID, Mr Skates's point: a whole family trying to share one smartphone to do their learning and not being able to afford the data. So, we think that could be really informative to help set future policy and support. 

Thank you. Sarah, did you want to ask any further questions? 

Thank you very much and thank you again, both of you, for being here today. This is really, really helpful. I'm just going to ask a few more questions around e-prescribing. As you said, Professor Laing, and I agree with you, when people find out that there are 40 million pieces of little paper flying around Wales every year—. I don't think most people realise that, and how much more efficient this is going to be; I have e-prescriptions, and I'm very, very grateful for it. But I just wanted—. It is inextricably linked to the digitisation of other information about us, and very personal information. And I was just going to say we've had written evidence from the British Medical Association—two bits of written evidence—and they've also said that following the imposition—that is why I quoted that earlier on, I used that word—the imposition of the GP contract in England, all practices are now contractually obliged to provide prospective record access to coded information, including results, documents and free text for all of their patients by the end of this month, and the only exception is when a patient has expressly requested that access not be given. And the contract also states prospective access must be given to new patients on registration. So, I guess my question, because this is happening in England, is: do you think that patients should be able to see their records and go through and decide what should and should not be redacted before this happens? And I suppose that's to both of you, really. 

Shall I start? First of all, I think patients should be able to see the whole of their record. That's the first thing. There are obviously some challenges with that. Sometimes, people have very extensive records—well, they all go back to their childhood; they're often quite extensive. But, nonetheless, I think, if people would like to, they should be able to see the whole of their record, with very few exceptions. There are one or two exceptions where it's legitimate, I think, to restrict that, but, in general, you should do that. Should we require every patient to go through their record and redact things—? [Inaudible.]—first of all is to familiarise themselves with their health record, and, secondly, to correct things that are incorrect, and we know there are a lot of errors in people's records, which is the concern about sharing it without reviewing it. So, I think people should have the chance to.

Do I think that everybody should have to do it before the record can be shared? No, because I think there are many people who would choose not to do that. You know, 'I'm very happy for my GP to share my record, I don't need to go through it.' So, I wouldn't want it to be mandatory before you could share a record, because that's a very dangerous situation. Just because you haven't got round to it, it would mean it couldn't be shared, for example; that would be dangerous. But people should have the right to do so. 

The relationship between the BMA and NHS England is not good, as you will have spotted from the newspapers. If they choose to call their contract negotiation an imposition, that's up to them.  

I think, from our point of view, I would agree with Hamish very much, so in terms of people's rights, in terms of accessing their healthcare data. I suppose our concern would be, if the BMA have concerns, to make sure that the NHS in Wales listens and understands those concerns and supports doctors to be able to make data information to the public available consistently. The last thing that we need is that some members of the public, depending on their GP practice, are able to access information, and somebody who may be living in the next street who has a different GP isn't able to access that information, because one GP has signed up and one GP hasn't. So, I think it's really important that the NHS in Wales works closely with the BMA to understand what those issues are, and to support the roll-out of any new system, like the NHS Wales app, to make sure that people can get it equitably and consistently across Wales. So, 'Work closely together, please' would be our plea.

That's a very good point. Thank you very much, yes.

Can I just add? This is perhaps slightly controversial, but I’ll say it anyway. It is absolutely true that, in data controlling terms, the GP is the data controller. But I would say that the record—my GP record—is my record, not my GP’s record. They are the data controller, they’re responsible for making sure it’s looked after properly and shared appropriately, but it’s not their data, it’s my data, and if want it shared I should allow it to be shared.

Thank you for that important point. 

Absolutely. I was just going to ask as well—. I mean—

We're running out of time, Sarah, so this is the final question.

Okay. My last question, then, really, because we've just touched on under-represented groups, but it's just to make the point, because a number of people have said this to me. There are people who just wouldn't want—. They would want to have it so that—. And I didn't mean for it to be mandatory, but to be able to, and to have that done in a way that's very easy for them to do, to be able to go through and check the medical records and what is going to be digitised and be accessible. Because we have had many hacks. We've had an IT system NHS worker in Birmingham who was held to ransom to get people's data. In 2017, the radiation protection service in Wales was hacked and all the staff records about their radiation doses were exposed. So, this is something that obviously people are very aware of, that you cannot say that it's 100 per cent safe. You never can.

But there are people out there as well who would never want anyone to know their mental health history. There are people out there who would never want them to know their sexual health history. There are people out there who may have had abortions, or fertility issues. And none of these things are illegal, but there’s still huge stigma attached to them. And also, we met with this domestic abuse and violence group of women with lived experience as well, and they told us that if there was a chance that somebody would be able to access their records who was their perpetrator, or linked to their perpetrator, the fear of that potentially happening would prevent them from going to the GP. They would be too scared to go to the GP for fear of that data ending up somewhere, and them just having no understanding and control over it. So, I was just wondering about your thoughts on that, really. What do you think, as this moves ahead, that we can ask, as a committee, the Welsh Government to do to make it so that people feel empowered and informed and that there’s enough transparency and accountability about what’s happening with their data, so that they want to share it and they want to reap these benefits for themselves and others?

Okay. Alyson, do you want to go first?

Yes, I think for me there needs to be that strong awareness campaign to build that understanding up of what data is held for individuals. We talked at the start of the committee about, actually, there's generally a fairly low awareness of what data is held and what is shared, so there needs to be that awareness campaign so that people can have that stronger understanding not only of what is held and shared, but why, and the level of control that an individual has over that, and for what purposes. So, I think the Welsh Government can take some action in terms of that broader awareness campaign, and of course healthcare professionals in every interaction with a patient have the opportunity to explain that in person, and it's really important that we do. So, the more a member of the public or a patient understands the what and the why, the more in control they feel of the things that actually belong to them, and can help them in terms of their healthcare journey.

Professor Laing. 

Just to say I don't think there's a proposal currently to share more data than is already being shared. It may be to share it in a more efficient way. When a general practitioner refers a patient to a hospital they send the summary GP record—it's available to the hospital clinician—that might contain some of those things that you legitimately and quite rightly raise as being very sensitive. So, I think that's already happening. It used to happen on paper and now that does actually happen digitally already, because it comes out of the GP system and is sent digitally. The Welsh Government for a long time has been talking about the data promise, which I think was an endeavour to address exactly the points you've been making this afternoon. It's been quite a long while in the making and I don't know where it has got to, but that is probably the place to influence these conversations. Its intention, if I understand it, is to be really clear and transparent about what information is held, who accesses it and how it moves about, and that would seem a very good thing to me. 

Thank you very much, both of you, for your time. We will send you a transcript of your contributions, which I would ask you to review to make sure that we've captured your contributions accurately. Anyway, thank you very much for your very clear evidence. 

Thank you very much.

Goodbye.

Bye bye.

The committee will now go back into closed session as previously agreed.