Corporate report

UKHSA Advisory Board: Major Incident Learnings

Updated 12 May 2025

1. 1. Purpose of the paper

The purpose of the paper is to provide the annual summary of incident learning from UKHSA’s major incidents and simulation exercises.  It includes a progress update on the lessons identified during 2023, new lessons captured during 2024 and describes the ongoing work (including Exercise Pegasus) to develop and validate our Emergency Preparedness, Resilience and Response (EPRR) learning processes.

2. 2. Recommendations

The Advisory Board is requested to:

• note the progress achieved on the lessons identified in 2023 and the lessons capture process during 2024; and
• note the improvements made in ensuring that lessons are learned in the Agency’s approach to preparedness, response, and recovery, including the ambition to implement an Agency-wide EPRR lessons learning management system.

3. 3. Lessons Identified in 2023

UKHSA’s first annual learning report (which was discussed by the Board in November 2023 and a progress update on the issues raised is at Appendix A), summarised the status of the 266 lessons identified as being:

• 34% completed (89/266)
• 39% had agreed actions in progress (103/266)
• 27% were either pending clarification, were for an external agency (such as NHS England) or had been categorised as no appropriate action (74/266).

The new EPRR Quality Standards & Improvement (QSI) team conducted a thorough review and analysis of the lessons identified, and has consolidated and removed duplicate learning points, and have subsequently rejected 37 of the initial learning recommendations, (approximately 15%) as they were not SMART (Specific, Measurable, Achievable, Realistic and Timebound). To reduce the number of rejections in future, the EPRR QSI team is leading a review of how the Agency conducts post-incident and post-exercise debriefs and will report its recommendations to the EPRR Delivery Group in June 2025.

Of the remaining 210 learning points*:

• 66% of the lesson learning actions are completed (139/210)
• 34% of the lesson learning actions are in progress (71/210)

*NB the numbers will not directly correlate with those identified in the 2023 Advisory Board paper due to the continuous improvement processes that have been implemented.

Now we have established an effective cross Agency EPRR learning process, and we are routinely and regularly engaging with the action owners, the actions and timescales are far more representative of the challenges presented. There has also been a move from Strategic, Tactical and Operational categories to Short Term, Medium and Long Term to reflect the urgency and expected delivery timescales, rather than the ‘level of command’ (strategic etc) level of the action.

The table below shows the status and number of lessons within each time category.

3.1 Incident and Exercise Learning Recommendations status as of 31st December 2024.

Status of Incident and Exercise Learning Recommendations	Complete No.	Complete %	In Progress No.	In Progress %	Rejected No.	Total
Short Term (<3 months)	38	18.1%	23	11.0%	4	65
Medium Term (3-6 months)	9	4.3%	4	1.9%	0	13
Long term (>6 months)	92	43.8%	44	21.0%	33	169
Total	139	66.2%	71	33.8%	37	247
Total excluding rejected						210

4. 4. New Lessons Captured in 2024

To ensure a consistent and coherent timeframe for the analysis of UKHSA’s EPRR lessons, the annual learning report will cover the period 1 January to 31 December.

During this period in 2024, UKHSA responded to 4 Enhanced incidents (of which 2 are ongoing),19 Standard incidents (of which 2 are ongoing), 2 routine incidents and had 5 Contingency Planning Teams (1 ongoing).

Post incident debriefs have been conducted for the 12 closed incidents, which identified 103 initial points of learning which have been reviewed thematically to identify lesson themes for quality improvement.

5. 5. Lesson Themes from 2024

5.1 Health Equity

The debrief of the 2023 Ukraine Asylum Seeker Incident recommended that health equity should be a consideration within the Asylum Seeker Public Health Risk approach. UKHSA has subsequently developed a Health Equity Toolkit for Incident risk assessment and response for use in all incident types. This supports those working in national incident response to:

• identify populations and groups most at risk from health protection inequalities, whether directly from the hazard or in the public health response.
• apply mitigations to minimise avoidable harm and identify and implement opportunities to improve equitable outcomes.
• meet the legal duties on the Public Sector Equality Duty and health inequalities.

Recent case studies evidence its use in the response to Avian Influenza – H5N1, in the Viral Haemorrhagic Fever Outbreak, and in the Mpox incidents. Health equity is now being embedded into routine EPRR Continuous Improvement process such as incident and exercise debriefs and will be embedded into the preparedness cycle process and its outputs. This was also a key learning from the Covid Inquiry and incorporating Health Equity into our risk assessment and incident response processes will result in more equitable outcomes.  Addressing health inequalities is the second Government level objective of Exercise Pegasus (see section 6).  

5.2 Business Continuity

Business continuity incidents (5) during 2024 continued to highlight the need for a cross UKHSA approach to business continuity management.  As a Category 1 responder UKHSA is obligated to have robust business continuity arrangements in place to ensure continuation of our services. A new Business Continuity Framework was produced and signed off by the Executive Committee for roll out in 2025 the outcome of which will be to address systemic issues in UKHSA’s business continuity performance. Business continuity is included in UKHSA’s eight Exercise Pegasus objectives (see section 6).

5.3 Access to Plans, Policies and Procedures

To improve transparency of the suite of core EPRR documents, UKHSA’s EPRR Concept of Operations, Preparedness Plan, and Incident Response Plan are now available on www.gov.uk. In addition, the Emerging Infectious Disease Plan was produced, identifying relevant cells and incident arrangements for an emerging infectious disease and this will also be tested in Exercise Pegasus (see section 6).

5.4 Improving incident dynamic risk assessments and incident response

An updated Incident Response Plan which went live in July 2024, has been shared on Pulse, presented at All Hands and training resources provided to all teams. This included an updated approach to routinely establishing incident cells which were recognised as important in the incident debriefs (for example Health Equity and Research), and improvements to our Dynamic Risk Assessment process to encompass an all-hazard approach.

5.5 Incident Arrangements and Leadership

The need for arrangements to focus on the preparedness phase of a potential incident became more pronounced during 2024 and the Contingency Planning Team concept was further developed and tested.  In addition to this, the need for a larger pool of individuals ready and able to support as Incident Directors and Cell Leads was recognised and ID training, reflecting the current Incident Response Plan, was developed in which is being rolled out in 2025.

5.6 Research and Scientific Evaluation

The 2022/23 Mpox debrief identified a need to clarify research processes, roles, responsibilities, and governance during a live incident. As a result, UKHSA have implemented new Research and Scientific Evaluation Cells to support national incident response. Research and Scientific Evaluation Cells have since been stood up incidents including Clostridium difficile, Measles and Mpox (2024) to address, oversee and identify research requirements. UKHSA is also a member of the UK Health and Care Research and Innovation Framework for Pandemic Preparedness groups and through this route has shared UKHSA’s research needs for Avian Influenza and the current Mpox enhanced incident.

5.7 Data Sharing

The Mpox debrief also identified an issue regarding timely sharing of data during an incident response between NHS England and UKHSA. To address this issue, an effective process has now been established for regular and routine data sharing between UKHSA Clinical Laboratory Management Teams, NHS England, and NHS Pathology Leadership.

6. Exercise Pegasus 2025

Validation through exercising is a core part of UKHSA’s approach to embedding learning. UKHSA is responsible for co-developing, delivering and evaluating Exercise Pegasus with DHSC and other Government departments.  As a major Tier 1 Exercise, Pegasus presents an important opportunity to validate and assure learning from previous incidents and the Covid pandemic. UKHSA will be a major participant, and the exercise provides an opportunity to validate our plans which have incorporated lessons learned from previous incidents and exercises.

7. Improving how UKHSA learns

UKHSA prepares for, responds to, and recovers from health security threats by appropriately applying learning identified from incident response, simulation exercises, evidence, and research.

The introduction of the annual preparedness cycle has enabled the Agency to thoroughly examine specific threats and stress-test our efforts against them. The recommendations to enhance our preparedness are designed to be as threat agnostic as possible, allowing us to respond to a wide range of threats and ensuring we are not limiting our ability to respond to specific incidents. These recommendations range from tasks that can be completed within the year, for example updates to plans and training materials, to more systemic changes, such as improvements to our laboratory facilities, which require long-term funding.

An internal EPRR Continuous Improvement Plan, approved by EPRR Oversight Group in June 2024, describes UKHSA’s systematic approach to learning from experience, providing a consistent approach to categorising, assigning and actioning learning and recommendations arising from incident debriefs, simulation exercises, audit, research, and isomorphic learning. This includes a new Continuous Improvement Group (CIG) that routinely reviews and checks progress against the agreed actions for all EPRR lessons across the Agency.

The new QSI team, which supports and implements the CIG arrangements, is working with the Cabinet Office on the lessons process being developed by the new UK Resilience Academy and with colleagues from the Chief Data Officer’s Technical team to best exploit technology (including the appropriate use of Artificial Intelligence) to implement an Agency-wide lessons learning management system that will improve the processes to capture, assess and track progress of potentially hundreds of new preparedness and response lessons each year from across the Agency.

8. Appendix A - Update on the issues raised by the Advisory Board in November 2023

2023 Annual Summary of Major Incident Learnings Minutes excerpt

Paragraph 23/190. The Director General, Health Protection Operations and Interim Deputy Director Emergency Preparedness presented the first annual summary of learning for incident responses (enclosure AB/23/065). The summary covered lessons from incident debriefs and learning from UKHSAs health security simulation exercises. Many aspects of incident response worked well, and one third of 266 lessons identified had already been implemented.

The Advisory Board noted the volume and breadth of captured lessons and the agency-wide changes arising.

Feedback from the discussion suggested the next iteration of annual summary should consider:

a) expanding the incidents considered to encompass five routes of transmission for infectious disease.

• A future pandemic could be caused by pathogens spread by one or more routes of infectious disease transmission (the five main routes being respiratory, oral, blood/sexual, contact and vector).
• As pathogen spread via respiratory transmission is considered the most likely cause of a future pandemic affecting the UK, the draft DHSC Respiratory Pandemic Response plan will be available during 2025.

b) learning from incidents that occurred outside UKHSA, including those in other countries which could have resulted in greater public health impact in the UK.

• UKHSA routinely shares information with the key international public health partners, such as World Health Organization and the European Centre for Disease Prevention and Control.
• Through its work with the Internal Health Regulations (IHR) strengthening programme, the Agency has established an effective network of professional communication with international public health agencies, such as the Africa Centres for Disease Control and Prevention.

c) strengthening learning from incidents that did not expand into larger response. 

• UKHSA’s Incident Response Plan requires a debrief to be included as a routine and integral part of any post incident process – it is not ‘scale’ dependent.
• The described review of the Agency’s post incident and post simulation exercise debrief process is considering a range of debrief options from a simple hot debrief (what did we do well, where could we improve) to a more complex structured debrief to develop recommendations.

d) reviewing efficiency within incident response.

• UKHSA’s National Response Centre (NRC) routinely captures and tracks ‘efficiency’ metrics of the resources allocated to an incident (such as the number of people working on the incident, staff working hours, number of incident management meeting etc) and the performance of the current arrangements assessed through a range of KPIs (such as the target time to establish a Dynamic Risk Assessment, distribution of an incident notification etc)
• The Agency’s current incident management structures are based on the ‘out of the box’ Microsoft Office products such as Word, Excel, Teams etc.  To improve incident situational awareness, information management, and governance a specialist Emergency Response Incident Management System (ERMS) will be trialled by the NRC during 2025.

e) and assessing feedback from external parties on UKHSA’s effectiveness.

• Whilst the Agency has a series of regular and frequent meetings with its key stakeholders (Cabinet Office, DHSC, NHS England etc) and partners (local government, devolved government’s public health agencies etc.) there is currently no formal ‘incident effectiveness’ review process separate to the specific incident debrief.

The Advisory Board welcomed embedding the cycle of learning across the Agency. Further consideration should be given to what assurance this provided for preparedness to respond within UKHSA and with wider partners.

• The introduction of the new pan Agency annual Preparedness Cycle and its associated review of lessons arising from incidents and exercise scenarios, and assessment of readiness to identified threats, enables us to conduct an in-depth analysis of specific threats, assessing the required capabilities and capacities needed to respond to a reasonable worst-case scenario. This gap analysis drives our readiness activities over the next 12 months, enhancing our overall preparedness and resilience.
• We have over 40 recommendations, ranging from ensuring we have a robust infrastructure to building the resilience of our staff. This approach requires the collective interest and focus of the entire organisation, with everyone from frontline staff to enabling functions engaged in building and maintaining readiness.
• This work runs in step with the Incident Response Plan, which now includes a new ‘severe’ category for large-scale public health emergencies, necessitating the re-prioritisation of work by UKHSA staff. To support these plans, we have rolled out e-learning coemsurses on EPRR, a new Incident Director training and development programme, the People Surge Delivery Plan and the trial of a new ERMS.
• All these initiatives help to ensure that all parts of the organisation are properly equipped to manage incidents efficiently and effectively, and that we continual refine and improve our EPRR arrangements through learning.

From the COVID-19 response this included scalable capability, ramping up of testing and ability to respond to concurrent incidents. Progress on implementing COVID-19 lessons and addressing system capability would be discussed at the Advisory Board in January 2024.

• As noted in Centre for Pandemic Preparedness’ (CPP) paper to the Advisory Board in May 2024, CPP has conducted a literature review of nearly 200 sources to identify key lessons from Covid-19 across each of the Pandemic Preparedness Portfolio programmes and identified actions the Agency is currently undertaking to address these lessons. In addition to this, CPP have also identified potential high-level recommendations from the Inquiry hearings and the CMO’s technical report to identify the key lessons for UKHSA. These key lessons have been discussed and agreed by ExCo.
• CPP are utilising these lessons as “guiding lights” for ensuring our pandemic planning addresses key learning from the pandemic and continuing to work with programme leads to ensure these lessons are embedded into work programmes.
• CPP are also leading response to Module 1 of the Public Inquiry. Since its publication, CPP have aligned the recommendations of the Public Inquiry with the outcomes of the lessons work.

Further discussion suggested utilising opportunity to share lessons across the health ecosystem and learn from similar exercises in the NHS or DHSC.

• UKHSA routinely shares relevant post incident and exercise recommendations with NHS and DHSC.
• DHSC is developing a proposal to strengthen the governance of shared learning and the requirement for appropriate public transparency.

Additionally, UKHSA should consider how to take advantage of AI and emerging technology to support the continued cycle of learning.

• As outlined in the paper, we are working with Cabinet Office and our own in-house Technology team to explore how we can best exploit technology to improve our lessons learning management processes, including the appropriate use of Artificial Intelligence technology.