Pandemic Ready: Safeguarding Our Future Through Preparedness

Recommendation 3: Identifying and securing the effective use of data for pandemics

Whilst the use of data in the COVID-19 response in Scotland includes many success stories, the barriers and challenges experienced by those seeking to use data in a trustworthy manner to support the response to the pandemic must not be overlooked. These barriers and challenges included:

• a lack of routine cooperation between organisations holding and analysing data;
• a lack of legal agreements in place for sharing data;
• outmoded data systems which meant that data tended to be siloed, with different providers, agencies and community organisations collecting and storing data independently of each other;
• antiquated or incompatible data infrastructure which often made it hard to share these data;
• a lack of data engineering skills, leading to problems of data quality and consistency, meaning that different health providers often collected different types of data, or labelled the same data in different ways; and
• caution, inconsistency and confusion regarding whether data could or should be linked, shared and accessed despite the Caldicott principle that “the duty to share information for individual care is as important as the duty to protect patient confidentiality.”^[17]

The Committee was informed that during the COVID-19 pandemic urgent research and analysis in Scottish Universities, requested by UK Chief Medical Officers and Chief Scientific Advisors, that would have shed light on the effectiveness of vaccines and severity of variants in Scottish patients had to wait up to 18 months to be granted access to data. In some cases, as many as 27 separate approvals were required from organisations across Scotland for this work to take place. The Committee regards these barriers as harmful and unacceptable as these delays will have cost lives.

There is therefore an urgent need for legal frameworks that enable the sharing of patient data while keeping confidentiality intact. Establishing robust surveillance systems during interpandemic periods that can monitor infectious disease trends and activity will be a key part of the pandemic response and should be built with a capability to enable rapid adaptation or enhancement for any emerging infectious diseases.

Following the recommendation on data from the Interim Report, RDS was commissioned by the Chief Scientist (Health) (CS(H)) to undertake work to agree an appropriate and efficient end-to-end approvals process for access to data for use during future pandemics or emergencies. Key to this was the need to be embedding best practice into routine access to data, in order to ensure that Scotland’s data infrastructure is accessible both during and between pandemics. This is in line with the recommendations of the SG Data Strategy for Health and Social Care,^[18] published in February 2023.

The work undertaken by RDS has provided a set of recommendations which describe an aligned and efficient data access approvals system for Scotland, along with a route map for moving towards such a system. These recommendations highlight the importance of effective information governance, but also note that this is only one part of an effective data system. Effective data discovery tools, streamlined application procedures, and rapid access to data in secure data environments once approvals have been made are also elements that also must be in place. The goal should be to store, map, link, access, and analyse data within two weeks. RDS’s full recommendations have now been published on their website and can be found at the following link: https://www.researchdata.scot/media/e2cdro4e/pandemic-preparedness-review-of-data-access-approvals.docx.

The Committee welcomes the work undertaken by RDS and the recommendations as an important step in the development of data and analytics as core infrastructure for future pandemics and notes additional work underway to review the terms of reference for current data governance panels in Scotland. The recommendations build on a number of reports in recent years in Scotland which have highlighted the urgent need to address issues within the current system of data approvals.

The work required to bring about these changes is substantial. The 2024-2025 RDS Business Plan^[19] provides an update on some of this work, such as the launch of the RDS Researcher Access Service which speeds up and simplifies requests by researchers to access data. However, a step change is required and work to deliver the broader transformation of the data approvals system must continue, with clear milestones and key performance indicators, setting out the timeline for the delivery of this.

The Committee therefore makes the following recommendations on data, building on the recommendations provided by RDS.

Firstly, that the SG immediately implement a notice to notify healthcare organisations, GPs, local authorities and arm's-length bodies that they should share information with PHS to support efforts against future pandemics. RDS should support organisations to achieve this. This will also be of benefit to other major health challenges of cancer, cardiovascular disease and neurodegeneration, and the very challenging state of NHS services in Scotland.

Secondly, that a standardised data access approvals process be implemented. This should cover all controllers of data generated through publicly funded research activity and health and care service delivery. It should be based around the Five Safes^[20] and operate as equivalent to the research ethics process, with a single Research Ethics Committee for Scotland approval deemed sufficient for all controllers of data required for the research. This should ensure patients and the public are involved in decision making.

Thirdly, the Committee recommends that all publicly funded health data research projects relevant to pandemics make their data and code available for re-use via secure data environments, with access decisions managed through the process outlined above. To enable this, RDS should be supported to become an internationally competitive, fit for purpose national research data service.

Fourthly, alongside the implementation of the recommendations from RDS regarding access to data, the Committee recommends the creation of a Pandemic Data and Intelligence Strategy.

Within the next 12 months, the Partnership should establish a short-life working group, with input from PHS, RDS and other key partners, to undertake a review of key datasets for pandemic preparedness and response. These datasets should include a range of medical datasets such as GP data, vaccine data, hospitalisation data, death data, and non-medical datasets such as behavioural science datasets that are crucial to informing pandemic policy. This should also include data on trust in government, trust in each-other, sense of community, sense of Government acting with and for the community, perceived norms, and sense of voice and of being listened to.

Once identified, key datasets should be triaged – providing an assessment of the relative importance of each type and categorising these accordingly. These datasets should also be assessed to identify their state of readiness (i.e. how readily usable and linkable they are).

3. Identifying and securing the effective use of data for pandemics

We recommend that:

A. the SG, following public engagement and advice from the CMO, implement a notice to notify healthcare organisations, GPs, local authorities and arm's- length bodies that they should share information with PHS to support efforts against future pandemics;

B. a single, standardised data access and approvals process be implemented for Scotland. This should cover all controllers of data generated through health and care service delivery and publicly funded research activity;

C. that RDS is supported as the national research data service to enable all publicly funded health data research projects relevant to pandemics to make their data and code available for re-use via secure data environments. These should have access decisions managed through the single streamlined process outlined above; and

D. the Partnership leads work with partners to produce a pandemic data and intelligence strategy which identifies priority datasets, including behavioural science, for future pandemic response and which includes a readiness assessment of their usability.