Corporate report

UKHSA data strategy

Published 11 September 2023

Foreword

Steven Riley, Director General Data, Analytics and Surveillance, UK Health Security Agency (UKHSA)

I am honoured to introduce the UKHSA’s first data strategy, a vital step in our ongoing efforts to improve health security. In today’s rapidly evolving world, governments need to utilise the best data and ensure that key insights are being generated to inform policy decisions and interventions. The fast rise in the use of artificial intelligence highlights the need for organisations to have clear strategies for the generation of insight from the collection, curation, and processing of data. The potential value of data is increasing as each new method is developed. But so are the risks and potential biases as the volume of easily obtainable products grows.

We acknowledge the crucial role our talented workforce plays in UKHSA’s success and are committed to supporting our talent pool, fostering a culture of innovation and excellence, and providing opportunities for professional growth and development. Beyond our own people, our data strategy outlines how UKHSA will collaborate with diverse stakeholders within the UK and internationally to improve health outcomes through better data quality, interoperability, and the overall utility of insights from health data.

Our data strategy sets 5 guiding principles; these are responsibility, trustworthiness, efficiency, accessibility and innovation.

These principles will underpin all aspects of our work as we collect, analyse, and share critical health data to advance public health outcomes. Rather than provide specific analytical plans or technical tasks at this stage, the data strategy focuses on the strategic approach that will guide us in developing these solutions. We can expect the speed of development of new analytical approaches to continue to accelerate and we will continue to use the best data and approaches available to us.

As we implement the data strategy in UKHSA, we will retain our central focus on improved health security. Harnessing the power of data will enable us to continue protecting the health and wellbeing of the people we serve, both in the UK and around the world. Working alongside our partners, UKHSA will cultivate a data-driven approach to health security, fostering collaboration and innovation to create a healthier, safer future for all.

Megan Lee, Chief Executive, Central Digital and Data Office (CDDO)

Since its inception, UKHSA has pioneered the importance of harnessing the power of data to protect public health. The COVID-19 pandemic demonstrated that through innovation and collaboration, government can rise to the health challenges of the day. It also showed us that effective use of data is essential to ensuring that our health services are ready to respond to new and emerging threats.

With this data strategy, UKHSA has set out its path to a future where data is valued and used as a vital strategic asset. This will embed a forward-thinking data culture that builds public trust, and that ensures our health care remains world-leading and prepared for the future. By adopting the Data Maturity Assessment (DMA) for Government, UKHSA positions itself as a pioneer in the future of government’s data landscape, working with the CDDO as we lead government’s transformation for a digital future.

This strategy marks the beginning of a journey to prepare for current and future health hazards, build the UK’s health security capacity, and save lives through the power of data and I congratulate the team at UKHSA for their brilliant work on this to date.

Mission

At UKHSA, our mission is to prepare for, prevent and respond to health threats, save lives and protect livelihoods. As a centre of scientific and operational excellence in health protection, we rely on data to inform all our work: our guidance, our interventions, and our science.

All of UKHSA’s work contributes to realising one or more of our 3 overarching goals – Prepare, Respond and Build, outlined within our 3-year strategic plan. By ensuring our preparedness for, and ability to respond to, current and future health security threats, we will save lives and reduce harm, support the NHS, protect the nation’s public services and support economic growth. The data strategy will allow us to fully deliver on the goals within our strategic plan and the 6 strategic priorities beneath those.

While the data strategy is a primary driver of achieving many of the ambitions outlined in strategic priority 5: ‘Improve action on public health through data and insight’, delivery on all of our strategic priorities, and the UKHSA science strategy: 2023 to 2033 will be supported by growing our data capabilities. The responsible and timely sharing of data is also an important component of our strategic ambitions on system leadership, partnership and collaboration across all of our work.

Through our data strategy, we set our data ambition. We will work with our partners to extract the greatest value from the data we hold to achieve our health security objectives. These are to reduce harm from infectious disease and environmental hazards, and to better prepare for future health security hazards, respond to health security incidents, and build our capabilities for the future. Our data strategy sets out our long-term approach to achieve this goal.

Working with partners

We seek to drive a change in our data culture, so we can strengthen our capacity and introduce new ways of working. This will require long-term focus and changes to internal operations, as well as better collaborations and partnerships, at the local, national, and international levels. A large part of this change in data culture will include our commitment to release more data and statistics for public access, at the right time, to ensure transparency and encourage innovation both inside and outside of the public sector.

A people-centric approach

As the health security landscape rapidly evolves, we understand that our success in achieving our objectives hinges on our ability to attract and retain the best people, cultivating an environment where they can thrive. Our people are the cornerstone to our success, and as such, we have developed the data strategy through undertaking extensive engagement with colleagues across a wide range of areas in the organisation.

Our organisation thrives on a hub and spoke model, ensuring the right balance between subject matter experts, technical individuals, and local expertise is achieved. The hub functions as the centre of knowledge, providing strategic direction and guidance, while the spokes represent groups of technical individuals and local experts, working on various projects and providing valuable insights.

The data strategy recognises the importance of continuous training, mentorship, and the development of career trajectories to enable our workforce to excel in their respective domains. This approach will strengthen our ability to adapt and innovate, enabling us to stay ahead in the rapidly changing landscape of health security.

The data strategy has been developed with broad engagement and consultation both internally and externally to align work and spheres of influence. To ensure that the data strategy effectively enables the agency, extensive internal consultation has incorporated the needs and goals of our experts across the organisation. More information on the engagement and consultation carried out can be found in Appendix A.

Case study: UKHSA COVID-19 dashboard and the power of data sharing

UKHSA played a pivotal role in the creation of the COVID-19 dashboard, which brought together data and statistics about the pandemic in one place, keeping the public and leaders across government and the healthcare sector informed about the progress of the coronavirus pandemic.

The dashboard was a breakthrough in the democratisation of public data, making information and metrics available to everyone, not just a select few in Whitehall. This transformed the debate about the virus and the need for lockdown, allowing for new perspectives and new projects.

The creation of the COVID-19 dashboard was a critical part of controlling the spread of the virus. It was established by Public Health England (PHE) in April 2020 and overseen by a multi-agency steering group including the Department for Health and Social Care (DHSC), NHS England, NHS Digital and the devolved authorities.

Its purpose was, to bring all the most actionable data and statistics about COVID-19 in the UK together into one place, through timely and transparent updates in a single, trusted version of the truth, accessible to the public and expert or professional users alike. Initially, the site was updated every day with numbers of cases and deaths, but over time, the breadth of data covered grew, and the dashboard became an essential tool for many, handling data from more than a dozen sources across all 4 nations of the UK, translating to around 200 metrics.

At its peak, the COVID-19 public dashboard had one million unique users and around 70 million hits per day. The dashboard gives a detailed picture of what is happening at both national and local level. For instance, users can see how many people are being admitted to hospital and how many are on ventilators across the country, as well as data for cases, tests, and deaths. Users can even use the Middle Layer Super Output Area (MSOA) map, which allows them to type in a postcode in England to see how many cases there are in incredibly small areas of around 7,000 people.

The creation of the COVID-19 dashboard was a significant achievement that demonstrated the UK’s ability to create world-class open data products quickly and affordably. UKHSA’s success in creating the dashboard was due to several factors. The team ingested data from disparate sources, making the APIs easy for users to access and analyse the granular data, and curating a user-centred dashboard that can be used by everyone. Additionally, the team started small and simple, releasing regular improvements based on ongoing feedback, through multiple rounds of user research and user testing, satisfaction surveys, an actively monitored feedback mailbox and open conversations on social media including Twitter.

Understanding user needs and ensuring the dashboard continues to be fit for purpose is an enduring priority for the team that now manages the dashboard within UKHSA, particularly in the changing context of living with COVID-19.

UKHSA is already working on future plans for the public dashboard, building on the success of the COVID-19 dashboard, but broadening the remit to cover wider health hazards, at a lower cost. By reusing components from the existing dashboard and with lessons learned from the pandemic, UKHSA is taking steps to ensure the public remains informed and empowered in the face of future health incidents.

Our data landscape

Data in UKHSA commonly flows through a complex pipeline. It is ingested, stored, curated, processed, linked, analysed, narrated, shared, published, consumed, and deleted, as appropriate.

Each step of this data lifecycle relies on a set of common capabilities that span across the entire organisation – our data capabilities. These include:

• engineering
• asset management
• skills and leadership
• architecture
• data products and services
• governance

These capabilities are the bedrock of our data culture and our ability to generate the greatest possible insight. They enable us to carry out world-leading science, reduce health inequalities, ensure system preparation and readiness, develop the best policy and implement effective interventions. They enable us to prepare for, prevent, and respond to hazards that threaten the health of the nation.

Data is used throughout the agency today in various forms and for many purposes. The public health community in the UK, in government and beyond, has a proud history of creating world-leading insights from data. The descriptive and analytical outputs we generate from data can help save lives both in the UK and around the world.

Before COVID-19, data initiatives and projects played a significant role in:

• addressing numerous health challenges, including measles and influenza
• addressing the impact of air pollution on health
• evaluating the effectiveness of public health campaigns promoting smoking cessation and healthy eating

During the COVID-19 pandemic, teams across UKHSA built new data systems to provide the Secretary of State for Health and Social Care with vital analysis, 7 days a week. Legacy IT systems were replaced with leading data platforms, a transformation effort that has improved data sharing, accessibility, visualisation, and governance. We have continued to learn and innovate in our response to mpox (monkeypox) and the unprecedented extreme heatwave earlier this year, further improving our data capabilities.

UKHSA has repeatedly demonstrated the great value that we provide to the public and the nation’s health services through timely, high-quality analysis and insight to underpin data-driven decision making. The agency continuously acquires and ingests substantial quantities of both raw and curated data and transforms this into valuable data products, insights, and actions. The processing and analysis of data enables us to prepare for future health security hazards, to respond to incidents to save lives, and to build the UK’s health security capacity. Multiple examples of the agency having impact through data can be seen in the case studies throughout this strategy.

While there have been many successes in how we use data, there are significant challenges remaining that we need to address. Today, like many large organisations and government departments, we do not have a comprehensive understanding of the maturity of our data capabilities across the agency. This data strategy will inform decision makers and teams across the agency to further build on the improvements achieved throughout the pandemic, by setting out a unified approach to improving the maturity of our capabilities over time.

As we implement the strategy, we will need to continue to use existing approaches and systems, while also introducing new ways of working allowing us to gradually transition and improve our capabilities over time and establish ourselves as a data-driven agency that is agile and adaptable to the changing data environment. By investing in a unified approach to data, where we mature our data capabilities across the board, UKHSA can improve its ability to protect the nation’s health through integrated management and improved preparedness, resilience, and response capabilities.

Scope of the strategy

UKHSA uses data to achieve our strategic objectives not only through generating analysis and insight for research and health security decisions, but also to monitor and operate the running of the agency. The unifying approach to data and building our data culture set out in this strategy will reach to all areas of UKHSA. The strategy seeks to align all our teams behind a clear, consistent vision and understanding of the importance of data to achieving our objectives and protecting the public from hazards to health.

Nonetheless, the data strategy in its current form will focus primarily on developing the data capabilities that are used in driving operational health security decisions, scientific health security insights and secondary uses, including ethically approved research. This data is the primary driver of ensuring UKHSA can prevent or respond to current, emerging, and future health security threats infectious diseases, antimicrobial resistance, and the environment.

The management of information, records, and knowledge within the organisation are recognised as separate disciplines to data management and therefore are not within scope for this data strategy. See Appendix B for further details on the data strategy’s scope.

This strategy does not provide specific analytical plans or technical tasks at this stage. Instead, it focuses on the strategic approach that will guide us in developing these solutions. Furthermore, the strategy refrains from referencing particular platforms or technologies, allowing for flexibility and adaptability in a rapidly evolving landscape.

Objectives

Our objective is to achieve our data ambition through aligning all UKHSA teams around a unified approach to data. We want to extract the most value out of our data to enable the 3 overarching goals outlined in the UKHSA strategic plan 2023 to 2026: Prepare, Respond and Build.

Prepare: Be ready for future health security hazards

Through systematically improving the maturity of our data capabilities across the organisation, we will ensure system readiness to detect and monitor emerging health hazards. Through implementation of this strategy, we will ensure data can be accessed and used by those who need it, mitigate unnecessary data flows between systems, reduce data latency, ensure appropriate governance and adequate tooling exist so that our detection, monitoring and response to potential, emerging, and current health hazards is fast, efficient, and robust.

Respond: Save lives and reduce harm through effective health security response

The data strategy will have a direct impact on improving the health of our population through ensuring we have the data to evidence our interventions, monitor their delivery and evaluate their impact. In addition, it will work towards better collaborations and partnerships, at the local, national, and international levels, through improving our data and intelligence sharing practices. This will not only reduce harm to people’s health, but also reduce the negative economic implications of weakened health security on the services we all rely on – in particular, the NHS. Data saves lives.

Build: Build the UK’s health security capacity

Through making the right investments in our people’s data skills and leadership as well as our data capabilities and infrastructure, we can continue to protect the UK’s health, now and in the future. This goal is not confined to UKHSA alone.

To build the nations’ capacity, we will work with our partners – the devolved governments, the NHS, local authorities, academia, and industry – to better understand their needs and consider better use of our combined data capabilities to develop the best policy and ensure effective, more joined-up, responses on the ground. We will maximise the value of our existing partnerships and seek out new, cutting-edge partners to join us in achieving our health security objectives.

Enabling government

In addition to enabling our UKHSA strategic plan and our organisational objectives, data enables wider government. Health security is an important component of UK national security.

Our data strategy will ensure we can continue to protect the health of the nation, support the NHS, and protect the UK economy and public services. It will achieve this by ensuring we have the level of maturity of data capabilities needed to provide expert advice and evidence, ensure preparedness to threats, and lead on incident response.

By utilising new capabilities in surveillance and data gathering techniques, we will be able to better understand, prepare for and rapidly respond to health hazards. This saves lives, increases productivity, enables new product development, and reduces disruption for households and businesses during health security incidents.

Our relationships with partners in the Cabinet Office and National Situation Centre (SitCen), as well as having data systems ready to go, are crucial to achieving our national security objectives.

Case study: Responding to mpox

When the mpox outbreak began in May 2022, UKHSA knew it needed to act fast to bring together all the necessary data to adequately respond to the situation. While there were some early successes, including strong collaboration across different teams and early conversations with the Caldicott Guardian and information management and privacy colleagues, the team quickly realised there were still some areas that needed improvement.

One of the biggest challenges was getting all of the necessary data in one place, from a range of sources including our case and incident management system, laboratory data systems across UKHSA and NHS, official notifiable disease reporting, case and contact questionnaires, and more. But the team was able to work together to create databases on an on-premise server to bring in relevant data.

Another challenge was ensuring the quality of the data. Within a few weeks of the incident, mpox became a notifiable disease and therefore certain data fields needed to be reported by law, including identifiable information. However, this clashed with a well-established principle of being able to get testing and treatment at sexual health clinics anonymously. Some test results and vaccination records were therefore received anonymously, and some responses were missing or incomplete. The team worked tirelessly to capture as much data as possible whilst being mindful of the impact on people’s privacy and the administrative burden of clinical and operational colleagues.

Despite these challenges, the team was able to quickly pull together a range of data products and capabilities, using tools like Jira, Confluence, Github, and PowerBI. This included secure daily reports for local health protection teams, platform orchestration so that insights refreshed automatically, and the provision of data for clinical trials. In addition, they iterated the early press releases holding case numbers into a regular data publication, providing transparent and accurate information to the public and following UK Statistics Authority best practice.

Looking forward, UKHSA is continuing to iterate our approach to data in response to incidents like mpox. The data strategy will enable planned activities such as the development of a run-book for key data products, iterating products to be reusable and aligning with strategic capabilities, and improving our offering around survey tooling, demographic data matching, and data linkage systems.

Overall, the response to mpox was a testament to UKHSA’s data capabilities and the power of collaboration. While there is always room for improvement, the team was able to bring together a wealth of data in a short amount of time, providing the necessary insights to respond to the outbreak and protect public health.

Challenges

Despite numerous advancements in our data capabilities and practices, there are still numerous challenges that we face today in how we access, store, manage and derive insight from data. These challenges range in nature from technical and process-related, to cultural. The primary challenges we face today are summarised below.

Unclear ownership and responsibilities

Without proper data governance in place, it is not always the case that the rightful owner of data assets is clearly assigned, recorded, visible and accountable. As a result, we cannot be confident that data is being managed consistently across the organisation.

Having unclear ownership and responsibilities results in unnecessary confusion and delays when trying to access data assets owned by another team. Moreover, it increases several risks, such as not using all available data, not understanding the provenance of data, and potential inconsistencies in data handling, all of which could lead to uninformed decision making and inefficient use of resources.

When a response relies on multiple data systems and assets, end-to-end roles and responsibilities are unclear, particularly when the response spans across multiple teams or government departments.

Numerous systems using different standards

Today, we rely on multiple data systems that do not join up well. The numerous data systems in the agency were built with different use cases in mind and with varying standards and principles, with PHE, NHS Test and Trace and the Joint Biosecurity Centre (JBC) all developing systems over the years.

As a result, UKHSA has a mixture of legacy systems and newer data systems, many of which hold data, models and tools that are vital for the delivery of our health security objectives. These systems do not have high levels of interoperability today, making sharing data or carrying out data linkage for analysis difficult and increasing risks to data quality when data is transformed through multiple systems in order to share it. Additionally, the processes used for onboarding and governance of each system varies. This duplicates implementation costs, data handling costs, data governance costs, and risks.

It requires the system to build complex governance systems that can only manage the security risks inherent in data dissemination by acting in a slow and risk averse manner.

Difficulty in sharing data both internally and externally

To maximise the value out of our data assets, teams across the agency must be able to share data assets and insights with our external partners, health protection practitioners and the public when required, both within government and beyond. Today, it can be difficult to share data assets with external partners in a secure and legal way, with teams often relying on using spreadsheets or requiring the partners to use UKHSA laptops and technology, often not fit for purpose for the work being carried out (for example, not able to run analytical tooling or scripts).

Clear data governance standards are necessary to ensure teams across the organisation and beyond can easily share data and tools with each other and ensure adherence with the law.

Lack of standards in documentation

Documentation of our data assets and systems is vital to ensure users understand the data being stored, the processes used, and governance required. Today, there are no common standards used for documentation across the different systems and assets.

Our current view of data assets is fragmented, inconsistent, incomplete, and difficult to retrieve. Lack of specialised tooling for data governance and data discovery makes it difficult to join up different data views. This can result in slow response times, inaccurate outputs, and increased compliance risk. This also slows down the onboarding process and is frustrating for new team members and partners who need to use the data system.

Custom tools are often built as workarounds

In many cases, teams spend additional resources and time on building custom tooling as a result of not having adequate tooling and standardised processes across the different systems. This tooling is often needed for novel analytics that current systems do not support. This further amplifies the challenge of more systems being created that need to be managed and maintained, while also adding significant operational risk and duplication. As a practice, this leads to siloed approaches to analytics.

Innovation can be discouraged

In some cases, teams have reported not being able to try new ideas or approaches in using data. This can be due to a cultural challenge – the “we’ve always done it this way” mindset – or other impediments such as not having access to adequate tooling, lack of clarity on governance, or lack of awareness of the newer approaches or systems available.

We must enable responsible innovation, where we ensure compliance with required standards and legal restrictions, while also encouraging innovative, cost-effective approaches to be used by teams and our partners.

Lack of external alignment and collaboration

There is a need for better strategic alignment across departments and with our external partners. Knowledge and expertise can be better shared between partners but there are strategic, cultural and process challenges that need to be addressed to improve this.

It can be difficult to disaggregate data when needed

It is difficult to routinely disaggregate our data, that is, the separation of data into smaller units, which makes understanding impacts on specific behaviours or population groups more difficult. This reduces our ability to understand different population groups, including under-represented groups, and slows progress towards equitable health outcomes regardless of geographic and demographic differences.

Critical data skills gaps

We will ensure that we invest in upskilling our people so that we can build a strong data culture and sustainably address any data skills gaps that exist today. Through investing in skills, we can drive innovation and better achieve our health security objectives.

These challenges can be characterised at a high-level as having low maturity in our data capabilities at an organisational level. The agency is undertaking many activities to address these challenges and this data strategy will work to align these activities to ensure they have the most impact and enable the agency to better keep the nation’s health secure.

Opportunities

Implementing a unified approach to data presents tremendous opportunities for UKHSA. With advanced data analysis tools and techniques, the agency will be able to better monitor and track the emergence and spread of infectious diseases, identify potential outbreaks, and implement targeted intervention measures. Additionally, the agency will be able to better identify, source and use data to improve the efficiency and effectiveness of its operations, allowing it to better allocate resources and better respond to public health threats.

By harnessing the power of data, UKHSA can better protect the health of the population. Through unification of our data portfolio, we will be better prepared to effectively prevent or respond to emergency health incidents. The data strategy will also ensure the agency remains a trusted partner to wider government and beyond, known for secure and modern data handling.

There is also an opportunity to better improve our data products and services, including the development of plans for public facing dashboards and use of technological advancements such as adaptive machine learning and artificial intelligence in the generation of insights. We can build on the success of the processes around the COVID-19 dashboard, initially bringing control of the existing dashboard in-house (both in terms of data pipelines and front-end development) and ensuring the content continues to be relevant and fit-for-purpose. This should eventually transition to a comprehensive dashboarding capability with a wider remit, which will include broader health threats. Our data products will help raise awareness, inform the public and aid decision-making around the multiple health threats UKHSA is monitoring and focusing on.

We have an opportunity to be more transparent with our data and how to get access to data. Transparency sends a strong message to the public about our credibility. By engaging in proactive disclosure, UKHSA will have the opportunity to place accurate information in the public domain, avoiding false linkages and reputational damage. The secondary impact of proactive transparency is to our research community and strategic partners. They too will be able to take advantage of these improved information flows, to make better decisions and reduce research duplication.

Public trust in how UKHSA operates should not be assumed but earned through our actions and behaviours. The determinants of trust (responsiveness, reliability, integrity, openness, and fairness) should not just be considered in the context of good adherence to legal regulations but about high standards of ethical practice.

In addition to driving these organisational outcomes, on-the-ground operations will improve as our data capabilities improve. A maturation of our data capabilities will result in faster response times, more efficient resource allocation, more time for insight generation activities, a cheaper overall response, fewer gaps in our data and analysis, increased confidence in our decisions and, ultimately, reduced harms through achieving better health security outcomes.

Artificial intelligence

In light of recent considerable technological advancements, particularly in the field of generative artificial intelligence (GenAI), UKHSA sees an opportunity to explore the potential integration of tools such as large language models (LLMs) into our data operations.

Our data strategy, which outlines important principles applicable to all technologies and tools, serves as a guidepost for this exploration. Any GenAI use case will need to conform with our data principles. For example, by following the Responsible principle, we will need to ensure that any use of GenAI will be ethically aligned and governed by stringent data privacy standards. The principles of Innovative, Accessible, Efficient and Trustworthy would similarly need to be aligned to as GenAI specific use cases are explored and tested.

It’s crucial to underscore that no single technology operates in isolation to fulfil our public health objectives. While GenAI models like LLMs present exciting possibilities, it’s important to acknowledge that UKHSA possesses a set of data and technology tools that collectively serves to protect public health. This health protection ecosystem comprises various complementary technologies, diverse data sets, advanced storage systems, and multiple channels for output and communication. The effective integration of GenAI technologies would necessitate their alignment within this existing framework.

Just as importantly, the human expertise that interprets, acts upon, and manages these GenAI technologies remains an invaluable component of our operational integrity. Therefore, any new technology we consider adopting, including GenAI, will be evaluated not just for its standalone capabilities, but for how it can integrate into our existing multi-faceted system to create a more effective, efficient, and responsive public health infrastructure.

As we continue to adapt and grow, we remain committed to applying our data principles to the evolving landscape of technologies and tools for data that support our mission. Our aim is to understand how these technologies could not only support our people but also enhance our existing activities and support new avenues of public health initiatives.

The agency-wide DMA in this data strategy will enable us to identify needs across the agency and recommend solutions to improve the maturity of our data capabilities. These solutions may include the use of technologies such as LLMs and other GenAI models where necessary.

Data strategy foundations

As we implement the data strategy and move forwards in our data ambition, we will be able to measure quantifiable improvements in the maturity of our data capabilities over time, which in turn will result in improvements in our ability to prepare, build, and respond to health threats.

There are 3 core components to the data strategy:

• establishing our data principles
• maturing our data capabilities
• evaluation

Establishing our data principles

There are many established sets of principles about how to best get value out of data in an organisation, and many of these are in use in UKHSA. Although many teams understand the utility of data principles, there is scope to better align application of principles across the agency and capture greater value from data principles in our work.

The data strategy establishes, for the first time, agency-wide data principles. Through a review of the existing data principles used by teams in UKHSA, including the FAIR principles, NHS Information Standards and Code of Practice for Statistics, the data strategy sets 5 fundamental data principles that set the standards for data handling and insight generation across the agency.

Data principle 1. Responsible

We will have robust governance standards that ensure accountability and discipline, upholding our legal obligations and meeting our ethical responsibilities in securing and protecting our data.

Data principle 2. Accessible

Finding and accessing data across UKHSA will be easy, safe, and secure, promoting the sharing of data assets with internal and external teams.

Data principle 3. Trustworthy

We will be clear and open about how we are using our Data Assets and producing Data Products to provide confidence and ensure appropriate data quality.

Data principle 4. Efficient

We will reduce duplicated effort, ensure data systems are interoperable across UKHSA to ensure data assets are reusable and only keep data for as long as needed to achieve our goal.

Data principle 5. Innovative

We will seek input from and collaborate with partners to continuously improve our use of data, keep an eye on the horizon and maximise the value from our data assets to generate insight in a proportionate way.

Case study: Revolutionising genomics: data transformation and innovation

UKHSA publishes technical briefings regularly, initially on SARS-CoV-2 variants and subsequently on SARS-CoV-2 therapeutics, acute hepatitis in children of unknown origin, mpox and human risk assessment of avian influenza. These are published on GOV.UK and show the organisation is open and transparent with data and investigations so healthcare professionals can take early actions and use the data for further analysis relevant to their practice.

As part of this, we continue to contribute to the data principles outlined in the data strategy.

Responsibility

During enhanced incidents, research is conducted at speed, and it is vital to move fast. Early evidence is debated openly, and academic rigour is applied on the findings. Real world data from healthcare professionals in the field and research studies from laboratory settings are also considered. UKHSA technical briefings publish emerging data, exploratory analyses, and conclusions. Data is attributed accurately and cleared with all contributing partners. We admit that findings are open to revision in light of new evidence or reinterpretation of existing evidence. Transparency means that findings are made available even when they are inconclusive. This is an example of how to communicate uncertainty responsibly without scaremongering.

A standard operating procedure including governance arrangements are in place to share this format for the whole organisation and, if requested, externally. A range of teams in UKHSA and external partners contribute data to the technical briefings include analysis and data from genomics, epidemiology, outbreak surveillance, virology, clinical research, data and analytics, immunisations, policy and legal, communications and more. All contributors are made aware of their responsibilities on sharing data once they are part of the technical group.

Accessibility

With the UKHSA technical briefings, we communicate meaningful data to partners within the NHS, devolved administrations, government departments and the public. Our output informs health actions, risk assessments, guidance formulation and contribute to decisions on public health guidance.

The technical briefings confirm case definitions and symptoms for physicians, provide guidance on infection prevention and control, information on real world monitoring of tests, reinfections, evaluation of immune escape and analyse latest evidence from data and surveillance on acute hepatitis and mpox. NHS colleagues used technical briefings to determine who required a booster and to support interpretations of NHS laboratory Variant of Concern (VOC) genotyping analysis.

The COVID-19 therapeutics technical briefing shared information from the genomic, virological, and epidemiologic surveillance systems (national and with academic collaboration) on COVID-19 therapeutics with partner organisations, including NHS England and Improvement. This briefing in particular analysed early signs of resistance to COVID-19 antiviral drugs that would directly impact patient care. The acute hepatitis and mpox technical briefings shared useful data with other public health investigators and academic partners undertaking related work, improving our understanding of the outbreaks and currently we are analysing the human risk assessment of avian influenza.

Trustworthiness

Technical briefings generate significant attention and are frequently referenced in the media. It raises awareness of UKHSA’s work and partnerships and announces our intention to collaborate widely. Technical briefings are acknowledged by health and communication professionals as their definitive report on new and emerging incidents as a reliable source of exploratory evidence for action.

The technical briefings have generated feedback and well-intentioned discussions, including requests for improvements in social media, notably when shared on Twitter. This has generated involvement from members of the public about further information on data sets and requests for signposting.

The technical briefings were regularly used to inform the European Centres for Disease Control and Prevention’s (ECDC) assessment of variants when deciding to de-escalate variants of concern (SARS-CoV-2 variants of concern as of 25 May 2022). ECDC has also given feedback on how much it values the technical briefings on hepatitis.

International stakeholders have acknowledged the technical briefings as very useful and rated highly when asked if the publication impacted their work.

Efficiency

The latest data is reviewed by multidisciplinary groups and analysed with care and caution as they contain emerging evidence. Collaborators include, but are not limited to:

• academics from leading institutions nationally and internationally
• bioinformaticians
• clinicians
• epidemiologists
• data analysts
• virologists
• modellers
• structural biologists
• high consequence infections disease network
• charities
• representatives from devolved administrations and other government departments

During these meetings, discussions are held to determine rigour of the evidence presented. A turnaround time of 5 working days (maximum) means drafting the publication at speed – only possible because of open and trusting relationships with external and internal collaborators.

Innovation

The pandemic has shown the public the importance of science. The UKHSA technical briefings show the data analysis behind the headlines. We work closely with our communications team in UKHSA to ensure clarity in language and accessibility considerations and consistency of messaging.

The technical briefings have contributed to raising the standard of scientific discourse not just in this country but across the world. We have taken the challenge to explain research openly to produce reliable content that can be understood and created greater empathy among technical experts. This has led to improved trust in science communication and especially publicly funded scientific analysis and dissemination.

Technical briefings will continue to enhance UKHSA’s reputation in communicating scientific evidence as a result of rapid data sharing and exploratory analysis which has already gained trust among equals and the public as a truly innovative product. The data strategy will no doubt guide future improvements in data sharing within the principles to deliver a robust, responsive and intuitive system to improve health security.

Maturing our data capabilities

Our data capabilities are the bedrock of our ability to protect public health. Our people rely on our data capabilities to do their jobs and ultimately achieve our health security objectives. The data strategy defines 6 foundational data capabilities that span the agency.

Data capability 1. Data governance

Data governance focuses on how we make decisions about what to do with data. It ensures we have the policies, procedures, and standards in place for managing our data assets, as well as having clearly defined roles and responsibilities for data quality assurance, data lifecycle management, access, and use.

Data capability 2. Data architecture

Data architecture is the design and organisation of our data assets, including the systems, processes, platforms, and policies that support the collection, storage, management, and use of data.

Data capability 3. Data asset management

This is ensuring we know which data assets we have, where they are located, why we have them and who is responsible for their use.

Data capability 4. Data skills and leadership

Data skills refer to the knowledge and abilities needed to collect, manage, analyse, and interpret our data. This can include technical skills, such as programming and statistical analysis, as well as soft skills, such as problem-solving and communication. We want to ensure we have adequate levels of data literacy and skills at all levels of seniority across the organisation to achieve our objectives. We want our staff to be confident, curious, open, critical and resilient. We also want to ensure we have excellent data leaders, who are responsible for developing our strategies, management of data teams, and using data to drive innovation and improve performance.

Data capability 5. Data engineering

Data engineering is needed to build and maintain our systems, processes, and infrastructure to support our data objectives. This can include developing data pipelines, implementing data storage and management systems, and building algorithms and models for data analysis and machine learning.

Data capability 6. Data products and services

UKHSA offers critical services, such as internal and external dashboarding, to the public, the emergency services, the NHS, national government and local authorities to help them make better decisions with data. We also maintain products that are used by ministers, government officials, our partners, and the public. It is important that we engage with appropriate communities to follow and influence best practice, and collaborate closely with our partners to set shared standards to support interoperability of important data assets. We must improve processes and communication internally, with strong design principles, clear documentation, and a culture of knowledge exchange.

Measuring maturity

Today, we know these capabilities are of varying maturity, but we do not know the levels of maturity across the board, or the investments, decisions, and actions we need to take to improve them. An assessment of the maturity of these data capabilities at each directorate will be carried out using the Government Data Maturity Model. This model was developed in line with Mission 3 of the National Data Strategy and is endorsed by Cabinet Office for use across government. The result of this will be a specific action plan for each directorate, outlining recommended actions to take to improve their capabilities, as well as provide a support model to enable these actions to happen.

The data capability maturity assessment will involve working with the numerous people across the agency who have knowledge on a wide range of data topics, including having the right data systems and knowing the data we have, making decisions with data, managing, and protecting our data, and taking responsibility for data. The approach used to assess will be a mix of expert contributions answering on behalf of teams, workshops with representatives across the agency, and digital surveys to get the view of wider staff. It is important that we also include staff who do not consider data to be a core part of their role, to ensure the results are reflective of the whole agency.

The maturity levels we will be using for data maturity are:

• beginning
• emerging
• learning
• developing
• mastering

Through recommending and implementing specific actions, investments, and policies on how teams can improve their maturity, we will create a data environment that can achieve our strategic health objectives.

Evaluation

Implementation of the data strategy will improve the health security outcomes set in our UKHSA strategic plan. The impact of this will be measured through data-specific metrics to measure the adoption of our data principles, as well as improvements in the maturity of our data capabilities, as defined in the Data Capability Framework. Some natural interconnection exists between these 2 strands of the data strategy impact evaluation. Therefore, some evaluation metrics may overlap or be reused. An overview of both evaluation approaches is provided below.

Data principles adoption

We will measure the adoption and embedding of the 5 data principles across the agency. The evaluation framework used will define success criteria for each principle, and quantifiable metrics to measure progress towards them. This will result in multiple, defined metrics for each principle and may include such metrics as:

• percentage of critical data assets with fully defined ownership roles
• percentage of critical data assets that can be shared internally from source, for example, via an appropriate analytics platform (API)
• percentage of data products with appropriately complete and visible documentation
• percentage of automatable analytical process appropriately automated
• number of partnerships established with appropriate feedback mechanisms in place

The combination of multiple metrics for each data principle will allow for close monitoring of progress. Combining these will enable a wider view of the progress on embedding the data principles as a set.

Data capability maturation

The data capability maturity assessments will produce results and data maturity action plans that map to the UKHSA Data Capability Framework. Maturation will be evaluated through measuring progress towards the targets set in Data Maturity Action Plans, and changes in scores at re-assessment.

Implementation plan

For the data strategy to succeed, we need each team across the agency to actively support and adopt the data strategy so we can drive a change in our data culture and reap the health security benefits of improved data capabilities. We also need a clear implementation plan that outlines what actions we will be taking to drive the strategy forward. This implementation plan has 4 main strands:

• communication
• data maturity action plans
• embedding the data strategy
• creating a unified data portfolio

An overview of each implementation strand is provided below.

Communication

Communication is essential in achieving data culture change. For the data strategy to be successful, it is important that all members of our organisation are aware of the goals and objectives and understand their role in achieving them. This includes awareness and adoption of the data principles, and the action plans that result from data maturity assessments. We will follow a structured communication plan to embed the data strategy across the agency through multiple mediums.

Data maturity action plans

The data maturity assessments will provide specific recommendations on actions we can take to improve our data capabilities. Assessments will be conducted at least once a year to ensure our understanding is up to date, and so that we can monitor our progress over time and provide recommendations for further actions.

Only after completing the assessments will a comprehensive list of recommendations be provided, but examples of potential recommendations, split by data principle, are provided below.

While these recommendations provide a high-level direction to take, implementation to drive change will be carried out following the creation of data maturity action plans. This allows for personalised actions targeted at specific teams and groups across the organisation.

Data principle 1. Responsible

To encourage adoption of the Responsible principle, the assessment will identify opportunities to map, rationalise, and simplify our approvals processes. The assessments will identify potential areas to consolidate processes. This may include actions such as de-duplication of work through using a single common application form for ethics, information governance, and other access permissions.

Data principle 2. Accessible

To support the Accessible principle, the recommendations will underpin decisions on creating new, fast access rules and processes for users of our data, ensuring insights can be acted upon quickly. Code for data curation and analysis should be shared openly, with appropriate technical documentation, with all users of the data. It is also important to acknowledge that ‘open code’ is different from ‘open data’ and as a result in many cases will be treated differently. It is reasonable for UKHSA and the government to carry out some analyses discreetly without sharing all results in real time. In adopting the Accessible principle, we will strive to release more data and statistics for public access, at the right time.

Data principle 3. Trustworthy

Concrete actions on privacy and transparency will be recommended to decision makers across the organisation to support the adoption of the Trustworthy principle. For example, data platform owners will be encouraged to ensure analysis and modelling can be conducted on secure data platforms rather than requiring downloads to local laptops. The data platforms should provide greater visibility of the data held, and maintain logs of activity, building public trust.

Data principle 4. Efficient

To support the Efficiency principle, the assessments will identify opportunities to consolidate the numerous data systems in place today and improve interoperability between them. This will support decisions for investing in an appropriate number of secure data analytics platforms. This work will integrate and align with work to transform data platforms in the agency. The strategy aims to build a culture of openness and re-use around our code and platforms, with an aspiration to reduce duplicated efforts and duplicated governance.

Data principle 5. Innovative

Actions, such as ensuring there is adequate ‘onboarding’ training for software developers and data scientists who are entering the workforce, will support the Innovative principle. This will also ensure partnerships with academia and industry are encouraged through improvements to our governance processes, data sharing and platforms. Additionally, governance will need to consider the commercial use of data for innovation, but only after we have adequately addressed privacy issues through wide adoption of the Responsible and Trustworthy principles.

Case study: Improving efficiency and interoperability in laboratory surveillance

Laboratory surveillance plays a crucial role in public health emergencies, as collecting and analysing data from various laboratories is essential for detecting and monitoring infectious disease outbreaks. UKHSA is responsible for the country’s laboratory surveillance system and has taken several measures to improve its efficiency to respond promptly to public health emergencies.

UKHSA’s laboratory surveillance system collects data from multiple sources, including NHS labs, UKHSA labs, and Environment Agency (EA) labs, and processes it through different systems such as Modular Open Laboratory Information System (MOLIS), Second Generation Surveillance System (SGSS), and disease-specific surveillance systems. This complex system does bring some challenges, ranging from ensuring there is clear ownership across the data sets and systems involved and ensuring data is accessible to those who need it. The system and processes also need to ensure public trust is maintained and ensure efficiency in data sharing and processing, as well as fostering innovation.

We have made progress to support each of the data principles outlined in the data strategy as part of our work:

Responsibility

We ensured clear system ownership and implemented a defined process for sharing data. Efforts have been made to address ambiguities when data is passed between systems for onward use and transformed for secondary use cases. UKHSA is developing sharing agreements and standardising methodologies for using the data.

Accessibility

UKHSA recognizes the importance of making data accessible to those who need it. Tools such as LeanIX promote transparency of systems and processes. Work is underway to develop a data catalogue to help users identify potential data sets.

Trustworthiness

UKHSA understands the crucial need to maintain public trust. The management and use of SGSS, the main lab surveillance system, is well documented and set out in open access documentation. Improvements are being made to use case approvals and access processes for the numerous other systems that contribute to surveillance. To enhance trustworthiness, UKHSA is developing a central assurance process to approve data use cases.

Efficiency

UKHSA has been working to implement interoperability standards that will enable systems to proactively prepare for integration ahead of public health emergencies. Efforts are being made to explore ways to integrate different systems, reduce duplication, and simplify processes, resulting in better service overall.

Innovation

UKHSA has a proven track record of finding solutions and quickly implementing them. For example, during the COVID-19 pandemic, they rapidly developed the Real-time Testing Service (RTTS) to transfer COVID-19 test results from private laboratories into SGSS. Interoperability standards would have made this delivery easier.

UKHSA will continue to enhance its laboratory surveillance system by refining data sharing and processing, improving public trust, and fostering innovation. The data strategy will serve as a guiding framework for future improvements, ensuring that efforts align with the principles of responsibility, accessibility, trustworthiness, efficiency, and innovation. By focusing on these principles, UKHSA aims to deliver a more comprehensive and responsive laboratory surveillance system, ultimately benefiting public health and safety.

Embedding the data strategy in existing workflows

For the data strategy to achieve the culture change and capability improvements required, we must embed the data strategy in existing governance mechanisms and workflows. The data strategy should be used to aid investment, service and policy decisions that are being made today.

We will work closely with teams responsible for setting the strategic direction for UKHSA, business planning and evaluation of performance to embed the data strategy into UKHSA’s internal oversight, governance, and reporting mechanisms. The data strategy will work with teams providing internal data support functions across the agency, such as the compliance team, data operations teams, security and privacy teams, who enable the agency in adopting good practice and adhering to our data principles.

The data strategy will work with governance boards, such as the Digital, Data and Technology (DDaT) Assurance Board, to address challenges in data governance and build capability in this area. In practice, this will mean ensuring the data principles set out in the data strategy are being adhered to, through review of newly proposed as well as existing data projects, particularly when making new investments.

In addition to ensuring the data strategy is embedded into existing governance mechanisms and boards, it is important that the guidance and artefacts are widely available for individuals to make the right decisions as part of their daily work. Guidance and tools will be created, such as checklists and canvases, to aid teams in adopting the data principles when working with data and to support rapid response to health security incidents.

The data strategy supports our compliance, Senior Information Risk Owner (SIRO) and assurance objectives by bringing together each of these streams under a consistent and unified approach across the agency. This includes actions such as informing Data Security and Protection Toolkit (DSPT) returns, to reducing corporate risk on data retention and ensuring data security and management frameworks are being applied consistently.

Creating a unified data portfolio

The data strategy will implement actions to move towards a consolidated view of the data projects and programmes across the agency. This will support adherence to the Efficient principle, providing a clearer view of what investments have already or are already being made.

We will create a unified data roadmap for the agency. This is vital to provide clarity to teams on which investments have already been made and when important tools, products and services will be available for the benefit of other teams. This will support the de-duplication of investments and the reliance on multiple data platforms and systems, saving cost and reducing complexity across the system.

Strategy governance

Accountability

The Head of data strategy will oversee the implementation of this strategy, and report regularly to the Director General, Data, Analytics and Surveillance.

Reporting on progress

To achieve our objectives, the data strategy will be governed through updates to the Senior Information Risk Owner (SIRO) Board monthly. Updates to the Executive Committee and UKHSA Advisory Board will be made every 6 months and on an ad-hoc basis as required.

Timeline and review period

Our data strategy is an evolving approach that must continue to adapt and align with both the priorities of UKHSA and wider government, and the health security needs of the public. Much of the fundamental approach outlined in this strategy is a long-term commitment to change and improvement. Nonetheless, we intend the current form of the strategy to span 3 years, in line with the UKHSA 3-year strategic plan.

More widely, this 3-year period aligns with an anticipated review of government priorities from CDDO at the end of the Transforming for a digital future: 2022 to 2025 roadmap for digital and data, enabling us to set a new direction at the right time. This timeline also gives scope to ensure our approach remains up to date with changes in technology and data platform needs.

Within the 3-year period, the data strategy will be reviewed annually to evaluate our progress and determine whether changes need to be made to the implementation plan.

Dependencies

The data strategy depends on numerous areas both inside and outside UKHSA. Some actions and outcomes rely on collaboration and adoption of teams across the agency, and our external partners, to succeed.

Important dependencies are outlined in Appendix C.

Working with us

If you would like to know more or discuss how to collaborate with us in the implementation of the UKHSA data strategy, you can contact us at datastrategy@ukhsa.gov.uk

Appendix A. Engagement and consultation

The data strategy has been developed with broad engagement and consultation both internally and externally to align work and spheres of influence. To ensure that the data strategy effectively enables the agency, internal consultation has incorporated the needs and goals of our experts across teams including Clinical and Public Health, Science, Health Protection Operations as well as enabling functions such as Technology, People, Finance and Strategy. Engagement and collaboration with stakeholders in data management, data governance, data protection and insight generation has also been essential to align practices and strategic plans for data to align with UKHSA’s goals and ambition.

Externally, we have consulted with colleagues throughout the public sector, embedding UKHSA in cross-government networks to identify good practice and opportunities for innovation. Consistent engagement with the CDDO, in the Cabinet Office, has ensured that the UKHSA data strategy has been developed in line with current and emerging government priorities.

This data strategy aligns with the UK National Data Strategy, the Transforming for a digital future: 2022 to 2025 roadmap for digital and data, and makes use of the Data Maturity Assessment for Government to appropriately position UKHSA in the broader government landscape. We have also engaged with representatives from across academia and industry in developing the strategy and will continue to work closely with these groups as we implement the strategy.

Throughout the implementation of the data strategy, we will continue to engage with partners throughout the healthcare, science, and data communities and ensure that we remain aligned and continue to effectively support the UK’s health objectives.

Appendix B. Scope

It is important to clearly state what the data strategy covers and what it does not cover. Data touches on all areas of UKHSA, and all areas of the agency bring invaluable contributions to achieving our strategic priorities. Our data principles, and the behaviours that these drive, will be applied across the agency. This will enable us to build a strong data culture, with all of our work with data unified around a clear, consistent set of expectations.

The primary focus of the data strategy is on data capabilities that are used in driving operational health security decisions, scientific health security insights and secondary uses, including ethically approved research.

Our initial focus is on our critical data assets; databases and data that are being processed into visualisation, statistics, reports, models, and other analytical outputs for the purpose of health security decision making and scientific insights. This data includes:

• genomics data
• environmental data
• clinical readings and data sets (for example, HPZone, ECDS, vaccination data)
• patient-level data and information
• geospatial health data (for example, mobility data sets)
• socio-demographic data (for example, census records)
• open-source data sets

There are many other data sets that are not primarily used as part of analysis to aid health security response, but are fundamental to our ability to operate as an effective, high-performing agency. These include data such as:

• finance data
• human resource (HR) data
• workforce planning data
• facilities management data
• policy evaluation data

Good management and use of this data is vital to ensure that the agency operates efficiently, effectively, and compliantly. Whilst this data contributes less directly to our analysis and insight generation, it is nonetheless vital to enabling UKHSA to mitigate health security threats to the UK public. This data is a secondary focus in our data strategy and will not be the initial priority during implementation.

The effective management of the agency’s information is a separate, significant undertaking and, while there are several interdependencies with the data strategy, this falls outside of the scope of this strategy and under the cover of the UKHSA Information Management and Privacy (IMP) team, through programmes including the License to Operate Programme (LTOP). These and other interdependencies are further outlined in Appendix C. Dependencies.

Each year, the scope and focus of the data strategy will be reviewed to allow for changes as needed.

Appendix C. Dependencies

The data strategy sets direction on how we will approach developing and maturing our data capabilities. It supports the agency in understanding the current position of our data capabilities, and prioritising improvements. However, some matters lie beyond its scope and rely on collaboration and adoption of teams across the agency, and external partners, to succeed. Important dependencies are outlined below.

Other organisational strategies

As a new organisation, in addition to our data strategy, there are numerous supporting strategies in development to enable the UKHSA strategic plan, and we are working to ensure the data strategy supports their objectives throughout implementation. The data strategy also enables the objectives of the different groups in UKHSA, including the objectives of Clinical and Public Health, Science and Health Protection Operations.

Finance

The data strategy does not directly provide funding for data transformation initiatives. It sets out an approach that can be used to support decisions on targeted use of funds to mature our data capabilities over time. The data strategy aims to enable teams to use existing funding allocations in the most effective way to achieve our data ambition.

Governance

Various teams across the agency will lead on agency-wide data governance solutions for both internal processing and acquisition and release of data.

Strategy and corporate services

Implementation of the data strategy, particularly the need to embed into existing governance and portfolio management mechanisms, requires adoption of data strategy recommendations by strategy, policy, performance management, finance, and corporate services teams.

Caldicott Guardian and Data Protection Officer (DPO)

The Caldicott Guardian function has an important role in the ethical and appropriate use of data, with the power to assign section 251 of the National Health Service Act 2006 to set aside the common law duty of confidentiality, as well as make decisions on levels of relative anonymity on releases or publications.

The UKHSA Deputy DPO has a core governance role in ensuring that UKHSA processes personal data in compliance with data protection rules.

Information asset owners and data asset owners

A network of information asset owners (IAOs) and data asset owners (DAOs) will have responsibility for putting in place controls and safeguards for the use of their data asset. IAOs and DAOs may need to take on specific responsibilities to support improvements to the management of the data they contain and enable the effective use of their assets to achieve our strategic objectives.

Data Platform Transformation Programme (DPTP)

The DPTP was launched to rationalise and consolidate our existing data platform capabilities, and to help fulfil our mission and continue to deliver service to the UK government and trusted partners. As part of this programme, UKHSA has begun work to develop an Enterprise Data and Analytics Platform (EDAP) that will consolidate and unify many data assets in a common Enterprise Data Platform, enable standardisation of both processes and tools used to analyse data, maturing our data capabilities, and extending our ability to acquire data to reduce the gaps in the evidence-base for health security and protection. The DPTP and EDAP are important enablers of our data strategy.

In addition to the internal dependencies outlined above, there are also external dependencies to data strategy adoption, outlined below.

CDDO

CDDO sets direction and priorities for data across government. In order to maintain alignment with government priorities, the data strategy may need to adapt in response to changes in policy and expectations from CDDO.

DHSC

UKHSA will work constructively with DHSC, including the Office for Health Improvement and Disparities (OHID) to ensure we can best implement the data strategy in conjunction with departmental data strategies and initiatives, including the Data saves lives strategy.

Additionally, UKHSA will seek advice from and consult with the department Data Protection Officer before decisions on high risk level data actions are taken. UKHSA will also adhere to relevant departmental policies and standards across data protection, information risk management, information assurance, information security, information management and other data protection and information risk and assurance compliance policies as they arise.

NHS

DHSC expects all health and care organisations to implement the 10 Data Security Standards, developed by the National Data Guardian (NDG), and to be scored on this via the DSPT (the evolution of the information governance (IG) toolkit).

DHSC delegates authority to NHS England to assess and score organisations on data protection and data security on an annual basis, which includes the element of an annual Government Internal Audit Agency (GIAA) audit. Failure to pass DSPT each year would result in other organisations not being able to share public health data with UKHSA and the loss of our ability from DHSC to process important health data.

Office for National Statistics (ONS)

ONS processes and publishes a substantial quantity of data, statistics, and analysis on health. Implementation of the data strategy will require UKHSA to have appropriate mechanisms in place to engage with health data from the ONS on their platforms as required.

Department for Science, Innovation and Technology (DSIT)

DSIT set direction and drive innovation in science and technology across UK public sector. We will work constructively with DSIT where this intersects with data management, governance, and use for health security.

Geospatial Commission

High quality geospatial data is vital for much of our work to surveil and respond to current and emerging threats to health. The Geospatial Commission provides steer and initiatives to improve management, use, and sharing of geospatial data across government.