Untitled

Science, Innovation and Technology Committee

Oral evidence: Digital centre of government, HC 790

Tuesday 8 July 2025

Ordered by the House of Commons to be published on 8 July 2025.

Watch the meeting

Science, Innovation and Technology Committee members present: Dame Chi Onwurah (Chair); Emily Darlington; Dr Allison Gardner; Kit Malthouse; Jon Pearce; Steve Race; Dr Lauren Sullivan; Adam Thompson; Martin Wrigley.

Health and Social Care Committee member present: Danny Beales.

Questions 106 - 190

Witnesses

I: Louis Mosley, Executive Vice-President, Palantir.

II: Dr Vin Diwakar, National Director of Transformation (Interim), NHS England; Alex Crossley, Director of Transformation Strategy, Finance and Delivery, NHS England; and Amy Freeman, Chief Digital Information Officer, University Hospitals of North Midlands NHS Trust.

Examination of witness

Witness: Louis Mosley.

Q106       Chair: Welcome to the Science, Innovation and Technology Committee’s third inquiry session in our digital centre of government inquiry. We are very pleased to be joined by our first guest, Louis Mosley of Palantir. Thank you for joining us this morning. To start off, could you introduce yourself and say a little bit about Palantir and what Palantir currently does for the NHS through its Foundry and its federated database services, and how you started working for the NHS?

Louis Mosley: Thank you very much, Chair, for the opportunity to speak to you today. By way of introduction, my name is Louis Mosley. I am the executive vice-president of Palantir Technologies. I lead our business here in the UK and across Europe.

Palantir is a software and AI company. We help large, complex organisations to organise the data they already hold and then deploy artificial intelligence across that to support improved decision making. We work with public and private sector organisations of the large, complex type. In the private sector in the UK, for example, we work with BP. In the public sector, we work across the MOD, the NHS, as the Chair mentioned, and a number of other Government Departments and arm’s length bodies. In the NHS, we help them cut waiting lists. For the police, we help them keep the streets safer. For the MOD, we help our armed forces to protect us from threats abroad. I would be delighted to go into more detail about all of that work in due course.

Palantir has been in the UK for about 10 years. It is our second largest market in the world. We employ 25% of our global workforce here in the UK, which I think is far larger than any comparable top 25 tech company in the world. We are a magnet for talent. We hire some of the best engineers in the world. Having a large presence in the UK means that we bring that talent here. We hire it out of British universities. Many of them, when and if they leave Palantir, start their own company; a significant cohort of Palantir spin-outs has emerged in the UK, so we play an increasingly important role in the broader tech ecosystem in the UK. We are also, particularly through that workforce, a major contributor to HMRC. Over the last five years, we have paid in the order of almost £1 billion.

Q107       Chair: Thank you very much for setting out the contribution you are making. I want to follow up on two things before I ask more questions.

Palantir’s main entry into working for the NHS was during covid, when you offered to help manage the covid data for a token sum of £1. That entry then went on to enable you to be in a better position to win significant contracts. You have just won one valued at over £300 million for the federated database. Do you understand that there might be concerns about you buying your way into being a provider to the NHS? Do you think that that is best practice for public procurement?

Louis Mosley: I am very aware of those critiques, and I strongly reject them. I would be happy to go back to the early days of our involvement with the NHS and how it began.

It was a national emergency. We were invited to No. 10, along with pretty much every other tech company that has a presence in the UK. That was in February 2020. There was the leadership of the NHS and key members of the Government. Each of us was asked what we could contribute to help tackle the covid pandemic. The list of needs was read out. One of those was aggregating data—that was what they described it as—and that was something that fitted squarely into our bailiwick, so we offered to support it.

Given the national emergency, there was no time to run long procurement processes. A decision was taken to expedite that. We offered, because it was a national emergency, to provide our support free. The decision was made to charge £1 because of some procurement process whereby we needed to be on a payment system in order for the contract to be stood up, but it was really a token. Of course, I remind everyone that we did not know what we were facing at the time or how long it might last. It was a three-month trial, in effect, of the software.

As to the question around whether it is the proper way to run procurements, it is very common in lots of sectors to have a try-before-you-buy kind of approach. That is why we have always offered our public sector clients the opportunity to do that. It can come in the form of a free trial or a discounted trial, very much in the same way that you might subscribe to a newspaper or a magazine. You get the first few issues discounted or free and then, if you like what you read, you sign up for full price. That was actually, in substance, how that procurement unfolded. It is also something that I believe the technology code of practice and the chief commercial officer of Government recommends as an approach for Government procurement.

Q108       Chair: Thank you for that. It is something that the Committee would be interested in looking at further. A try-before-you-buy approach in that way can obviously discriminate against smaller businesses that cannot offer services for free. The NHS does not necessarily have a good track record of vendor choice or procurement, so as a recommended approach I think it has significant disadvantages.

To try to understand a bit more about the service that you provide—I am a chartered engineer myself—would you agree with the characterisation of your software as what I would call middleware? You take all the messy, different systems that the NHS has all over the place, with legacy systems and different proprietary standards, and you put your software on top of it to clean up all the data and give a view of the data or processes that can be used by users and customers. Would you agree with that basic characterisation?

Louis Mosley: I think that is spot on. That is exactly right. Those of us who have worked in the NHS or have been patients will have had the experience of lots and lots of different IT systems, and that can be in an individual hospital, never mind a trust or on a broader scale, none of which talk to one another and all of which have critical information about each of us that is required for our care. Those systems need to talk to each other. They need to be connected. That information needs to be surfaced to the appropriate person at the appropriate time in order to support a better decision. That is precisely what our software helps to do.

Q109       Chair: Obviously, clean access to great data improves the clinician and user experience. As part of that, it obviously gives the technical keys to all the existing systems that are being used. How do you protect patient privacy? Can you specifically say to me that no data that is being processed is processed outside the United Kingdom or can be accessed or seized in any legal sense by any foreign Government?

Louis Mosley: The critical thing to bear in mind about the way our software works and the way it is deployed in the NHS is that the data controllers, the organisations that have legal responsibility, which in the NHS are typically trusts, maintain control over their data. Each of them gets their own instance of our software and they control who has access to it. They control what data is integrated into it. In effect, they implement and enforce the data protection policies that they deem appropriate.

Of course, much of that is determined from laws that you make here, down to policies that are made in Whitehall and down to the trust level as well. What our software does is provide the best-in-class capabilities for enforcing those protocols to ensure that nobody ever sees a piece of information that they are not entitled to see. It is possible to audit who has seen what at any point in time. Those are the two most important assurances that you can give in terms of protecting patient privacy over their own data, as you say, Chair.

Chair: Thank you for that. You have not quite answered the question, which may well be what Lauren wants to come in on.

Q110       Dr Sullivan: Do you store the data on the cloud?

Louis Mosley: Yes. In the NHS’s case, all the data is stored in the public cloud. It is stored in the London region of AWS, which is Amazon Web Services. In that sense, it is all resident in the UK and it is not exported elsewhere.

Just to go back to answer your specific question, Chair, it is at the discretion of the data controllers who can see their data and where that data is processed. If they want to impose residency requirements that mean that data can never be seen outside the UK, that is absolutely something that we can enforce. It is not Palantir’s decision; it is the data controller’s decision.

Q111       Chair: Is that required? Do you have examples of that being required?

Louis Mosley: Yes. That is currently the case in every instance of our deployment across the NHS.

Kit Malthouse: I want to ask a couple of questions about the architecture. You say that the NHS data is sitting in an Amazon web server in the UK.

Louis Mosley: Yes.

Q112       Kit Malthouse: What platform is used to hold the data? What is the database platform? Is it Oracle?

Louis Mosley: It is stored in AWS. It is stored in open formats. The data is stored, if you like, in formats that are exportable to any other system that can support open-source protocols. The code and the logic are all written in open-source languages that you will be familiar with—Python, for example. Again, that aids in the exportability of all the content of the database.

Q113       Kit Malthouse: There is no Oracle involvement in the process at all?

Louis Mosley: Oracle provides an equivalent service to AWS, like a public cloud provision, which at some stage may be used to store data in the same way that we use AWS, but that would be in a UK region of Oracle as well.

Q114       Kit Malthouse: What about your software, or middleware, maintenance? Where is it maintained from? Presumably someone in California can use remote access to fiddle around with the software.

Louis Mosley: Yes. The software is developed and maintained with teams around the world, many of which are in the UK, but they are also in the US and in Singapore, for example. The crucial thing to bear in mind is that the NHS’s instance of the software is not accessible to anyone outside the UK. None of that data can be accessed by anyone who is not on UK soil and who has not been explicitly granted that permission from the data controller or, in this case, an NHS trust.

Q115       Kit Malthouse: So the Palantir system is not error reporting and performance reporting through to headquarters, wherever your headquarters is in the States.

Louis Mosley: This may be unfair on other tech companies, but we have a fully UK-based cyber protection capability. For example, the logs associated with users in the NHS instances are not exported to the US in the way that is often typical. That monitoring and that assurance is all provided here on UK soil.

Q116       Kit Malthouse: Other than the direct money that the NHS pays you on invoice for the production of servers, there is no further revenue stream that emanates from NHS activity.

Louis Mosley: Correct. I am very keen to emphasise this. Our business model is to license the software. We do not derive any economic benefit from the data. The data belongs to the customer. We do not derive any economic benefit from the logic or code that they write to transform that data. Again, that is intellectual property that belongs to the customer. Our interest is purely in the tooling itself. In effect, they license or rent that from us.

Q117       Kit Malthouse: It is just license and support.

Louis Mosley: Correct.

Q118       Adam Thompson: Continuing with the points we were just making about the federated data platform generally, concerns have been put forward that it might not necessarily be suitable for every trust. Every trust operates differently. How have you addressed those concerns? How have you specifically addressed concerns that some trusts may already have better processes in place than you are offering?

Louis Mosley: I would be keen to hear what your next guests have to say about that, because this is also a programme decision more than it is necessarily the technology provider within the programme’s decision.

Our technology is very flexible and highly configurable. There is lots of scope for it to be adapted to specific contexts and uses, which is one of its principal value propositions. Where there is a push, I believe, to homogenise across the NHS, it is at data level. As we deploy the software and as data from different systems across trusts is integrated and, as the Chair said, that data is cleaned and harmonised, the ambition is to end up with a homogeneous ontology, or what the NHS calls a canonical data model. In that sense each of the objects that represents the physical reality of the NHS—the doctor, the nurse, the patient, the site and the operating theatre—is modelled in the same way and is consistent across the country. That will have enormous benefits, about which I can go into more detail, and is an instance of where the FDP is pushing towards a kind of homogeneity in the way that you described.

On the application layer that sits above that, however, there is enormous scope for heterogeneity and divergence in which application trusts want to use, decide to use or need to use. That can be absolutely flexible according to their needs. Where a trust has already developed an application that is working extremely well, and the offer in the FDP family of apps is not as good as the one that they have, there is no requirement for them to swap that out. Where there is a trust that may have nothing or may have a solution that is not as good as what the FDP offers, we can introduce that application in that site.

Q119       Adam Thompson: Looking far into the future at this point, let us for the sake of argument assume that this software is the right solution for now. In 10 years, that might not be true; there might be an alternative out there that is better. What are you doing in your software in terms of adhering to international standards that might or might not exist? Forgive me, I am not an expert in this. What I am interested in is how portable what you are doing is to another piece of software in the future.

Louis Mosley: Interoperability is our bread and butter. As the Chair described, one of the core value-adds of the software is the fact that it can interact with and read and write data from pretty much every system out there. Its nature is that everything is in open-source languages and everything is stored in open-source formats. That will mean that as technology progresses, and if the NHS or any other customer decides that there is something better on the market, they will be able to lift and shift the intellectual property and the data that they have developed in our software and put it into another platform.

There are examples of that already happening across Government. There was a programme that we supported in Cabinet Office from around 2020 until last year when the contract expired. That was around the flow of goods across the border, in relation to Brexit and concerns that as checks were introduced, the channel ports in particular might get blocked up. The Government wanted a granular understanding of the flow of goods. When that contract came to an end and the issue had abated in importance, they were able to stand down their instance of the Foundry platform and export the data and logic that they created in it to another system. As far as I know, that went seamlessly.

Q120       Adam Thompson: Following on from that, to be very explicit, in your assessment what is the risk that the NHS becomes locked into your software?

Louis Mosley: Technically, I think it is extremely low.

Adam Thompson: Thank you so much.

Q121       Chair: To clarify two things on that, do you support the fast healthcare interoperability resource standard for data APIs which is adopted by the NHS?

Louis Mosley: We do. Both FHIR and OMOP are standards that we support.

Q122       Chair: You said that it was easy to port, but we also agreed that this middleware has tentacles and roots in all the complicated existing systems. What is it that you port? Do you take out the Foundry and then have to develop your own new interface for all the existing legacy systems, or does the customer continue to own the middleware that has been developed with you?

Louis Mosley: They own the data and the logic—the content of it.

Chair: Just the content—right.

Louis Mosley: The tooling, but they would need to have some substitute for the connections. Absolutely.

Chair: There is a lot of interest.

Q123       Dr Gardner: A lot of my questions have been answered, which is fantastic. I just want to dig a bit deeper. You mentioned earlier that nobody outside the UK can access the data. NHS England says, “Only authorised users will be granted access to data for approved purposes.” Does that include researchers? If so, how do you define researchers? My concern is that a company could be set up in the UK and present itself as a researcher but actually have links with other companies. Palantir could also simply do that, linked for example with private health insurers. What are the risks there?

Louis Mosley: It is probably best to address the question to Vin Diwakar, who will give evidence shortly, but to my knowledge there is currently no access for research purposes. Of course, research is a secondary use. The FDP is, currently, primarily a direct care, and that is the basis on which access to the data has been granted and the purpose for which the data is being processed.

It comes back to a question of purpose. One of the key features of the software is that we support purpose-based access controls. This is not the classic role-based approach. It is role plus purpose. That is to say that you can create, if you like, a discrete container into which data that is required specifically for that purpose can be integrated. Then the roles associated with that purpose can be granted access to the container.

The crucial thing is that it remains within the data controller’s power to decide who has access and on what basis. Theoretically, research could absolutely be one of those purposes. It would be up to the data controller to determine whether that was being done appropriately.

Q124       Dr Gardner: Are you confident that there are no loopholes?

Louis Mosley: From a technical point of view, yes, I am very confident, in the sense that we can enforce whatever level of assurance is required, and then audit on that. Ultimately, the decision about who has access and on what basis, and for what purpose, is for the data controller.

Q125       Martin Wrigley: I am always very interested in these sorts of systems, having put in a number of them over the years. In my day, they were called data warehousing. It sounds to me as if you have built a super data warehouse with an AI analytical engine on top of it. What you have described as going into AWS, I would describe, in simplistic terms, as extracts from NHS systems: you are going into NHS systems and pulling out bits of data, and then you run your processing on top of those extracts, so that you are not interfering with day-to-day operational systems. Then, to use a technical term, you munge it to get some interesting answers out of it.

What you have spoken about so far is how you protect the extracts and deal with that data. Something much more interesting and unclear—I don’t think we have talked about it at all so far—is what you do with the output from the mungeing process, how you teach your AI system about what is going on, what it learns, how that is then shared within the AI system, and who is doing all the work on developing that. One element is the development of your interconnectors into each of the NHS databases—lists of patients, to put a simplistic case, or operating theatres and the things we have talked about. That is relatively straightforward and quick in the deployment.

That is not the interesting bit. The interesting bit is the AI analysis of the big dataset that you have built, and what you do with it. I have seen things on your website, such as, “Drag and drop between Foundry and Gotham.” Those are your health systems and your defence systems. I find that profoundly worrying. I have heard different stories about the border flow system example that you talked about and that it ended up not being used; and my understanding is that Palantir resisted the decommissioning of it. I hear different stories about the NHS system, specifically in terms of some of what I am told is termed the spend control condition, which required the NHS to build its own systems within seven years, to replace Palantir.

I have not heard anything in what you have said about protection of the process on the analysed data once it has come out of your warehouse depositories, shall we call them, at the AWS sites. Who is accessing that, and who is controlling that amalgamated data? It is no longer as clear as you were describing in terms of the data controller, when you are for example looking at multiple hospitals that you are combining, and if you are not, you are not doing the job I am expecting you to do. That is not a single data controller, and it is very unclear. Can you describe for me, please, how that is controlled?

I would also like to understand who is doing the development of the integrated analysis. Somehow, I don’t think that is going to be NHS employees, ever. I think it will be Palantir forever, so your answer about the only revenues being licensing fees is a little light. Can we hear a little bit more about how that works, how it is safe, and how it is replaceable in seven years?

Louis Mosley: Thank you. There were lots of interesting questions there.

Martin Wrigley: First of all, have I summarised what your system does in a reasonable way?

Louis Mosley: You have summarised it extremely well, yes. You are obviously very familiar with the underpinnings of tech systems in large, complex organisations.

Q126       Martin Wrigley: I have been designing, developing and architecting them for 40 years.

Louis Mosley: Right, okay. That is very clear. On the governance question, the same governance processes and controls that apply, as you described it, on the extracts apply for the full lifecycle of the data and all the logic associated with it. That might turn into a dashboard that someone looks at—just a report, if you like—or a much more complex interactive workflow, where they make a decision and that decision generates new data, which is captured and written back into the data asset that is being curated in what you described as the mungeing layer. The software provides, for example, for that access control model to perpetuate throughout the whole lifecycle. You have the same level of assurance and audit across everything.

The corollary to that, of course, is the write-back element. It is one thing, as you will be very familiar with, to take data out of a system. Of course, then you are mungeing it; then you may make a decision and need to write the nature of the decision back into the source system. For example, in a hospital, you may have a patient administration system, which is your canonical source of which patient is expected in which operating theatre and when. You may need to combine that, in the FDP, with data from a rostering system, so that you know which members of staff will be available then, to decide which patient to schedule, but you will want to write that information back into the patient administration system, so that that remains the canonical source of truth.

That can be challenging. In some ways, it is more challenging than reading from these systems, especially in systems that are very old and were never designed to have data extracted or written back to them. That is a challenge across the NHS. One of the biggest challenges that the FDP programme faces as a whole is that if ultimately the end step of the process is a manual write-back, where someone has to key a decision into a system, a lot of the efficiency is lost. That is a big challenge, and I urge the Committee to ask other suppliers to the NHS to ensure that their systems support write-back as well as reading. That will add an enormous amount of potential and efficiency to the system as a whole.

On your question about who is doing what, there are a lot of NHS analysts and other users—thousands, at this point, including many who are highly technical analysts. Vin Diwakar will, I am sure, talk about this better and in much more detail than I can, but there are many aspects of the core management of both the data and the ontology—the data model and so on—that are now fully owned by the NHS and do not have any Palantir involvement.

Our business model is to license software. We do not try to be a services business. Over time, we want as far as possible to minimise the services component of anything we do, but inevitably, when we first start a client engagement, there is a process of standing up the software, configuring it and training the earliest cohorts of users. Often that is work that Palantir will take on. However, in the FDP’s case, we are part of a consortium that includes Accenture, PwC and Carnall Farrar, all of which are doing the lion’s share now of the adoption and training on-site in trusts. We are starting to build up an ecosystem of third parties that specialise in services and all those associated pieces of work and can take that on over the longer term.

Q127       Dr Sullivan: The British Medical Association passed a motion last month, and I would like your thoughts on it: “Palantir (inclusive of any associated companies) is an unacceptable choice of partner to create a Federated Data Platform for the NHS. It recognises that this partnership threatens to undermine public trust in NHS data systems, due to a lack of transparency in how the data will be stored and processed, a track record of creating discriminatory policing software in the US, and close links to a US government which shows little regard for international law.” Would you respond to that assessment?

Louis Mosley: Of course. I was very disappointed to see that. I think the accusation that we lack transparency or that this is secretive is wrong. I am here partly to be as transparent as I possibly can and I hope that, in every way that you and other stakeholders require, we are meeting you where you need us to be. If I may be frank, I think that the BMA has chosen ideology over patient interest. I think our software is going to make patients’ lives better, by making their treatment quicker and more effective, and ultimately by making the healthcare system more efficient. As a patient and a user of the NHS, I want it to be as quick, effective and efficient as possible. I am very sad that ideology seems to have taken precedence over those interests.

Q128       Dr Sullivan: Ideology and motives are the cornerstone or core of a lot of these things. I suppose that there is some cynicism about all big tech at the moment, but in terms of the motives that you have set out, and the service you are able to offer NHS trusts, what is Palantir getting out of holding on to this big data? Would you say trends? Are there any by-products of being able to hold and process these large datasets from United Kingdom healthcare? Is there any other outdoor space where you would look to take that data—anonymised trends or whatever? Is there any other way in which you would be able to capitalise on any of the data?

Louis Mosley: No, categorically not. It is not our business model. It is just not what we do. Palantir was set up 20 years ago to support the most critical institutions in the west, broadly defined. It started, as I am sure you are aware, in intelligence and military work, and has more recently expanded into healthcare and other critical areas of government. Really, the founding purpose of the business is to help organisations precisely like the NHS to be the best versions of themselves. That is ultimately to the benefit of our whole society and economy.

Q129       Dr Sullivan: One final point, if I may, Chair. Trust, in all this space, is hard fought for and easily lost, so this will be a question for the second panel as well: how can we empower patients to have ownership of their own data, so that it is not shared outwards? You described the trusts as being the data controller. They can sell the data, or do whatever they can with it. What controls or regulations do you suggest to lawmakers, so that we can help to protect patients and empower them to have voice and agency over the data and where it goes?

Louis Mosley: I was very heartened to see in the 10-year plan such a big emphasis on patient experience and needs. That has perhaps been lacking for a number of years. Clearly, the 10-year plan set out some very ambitious programmes, such as the single patient record and others that I think will be instrumental in that.

Through my narrow technical lens, we have the technical capability to support whatever level of nuanced and specific access controls any data controller, whether it is an organisation or an individual, would want to apply. There is enormous scope to make that much more granular than it currently is. For example, to Dr Allison Gardner’s question about research—I speak here entirely as a user of the NHS and perhaps not wearing my Palantir hat—I would welcome the ability to see in the NHS app every purpose for which my data was being processed, including research, and that I would have the opportunity to opt in to or out of different research programmes, for example. Technically, that is possible and I would love to see a world where that is standard for all of us.

Chair: I am sure we would too. Thank you.

Q130       Steve Race: I want to talk about public sector capability and capacity. How would you assess the quality of digital technical leaders in the NHS, whatever level they are working at, from the centre and down to individual trusts? Where are the opportunities? Where have you found it quite easy, and what have been the challenges in working with the organisation?

Louis Mosley: Over the five years we have been working closely with the NHS, I have seen an enormous amount of change, and enormous improvement. When we started in February or March 2020, the NHS had, in effect, three different IT departments. NHS Digital was its own arm’s length body. NHSX was created as a sort of shadow IT department in the Department of Health, and NHS England was still running, in effect, a shadow IT department of its own. All three were dysfunctional in different ways, and that was exposed very clearly to everyone when the pandemic hit. The unintended benefit, perhaps, of the covid pandemic was, in an inexorable way, to discover which parts of the system were competent and worked—the classic, “When the tide goes out, you see who’s wearing shorts.” The system as a whole has greatly benefited from that process. The organisational redesign has been trying to tackle that dysfunctional beginning, with the tech sides of the NHS finally being centralised into a single organisation. The merger of DH and NHS England is a step further with that.

Of course, at the trust level there is, again, a high degree of variability, but there are outstanding examples of tech leadership. The challenge is to help those to continue to improve and to bring up the long tail of others that are, if you like, relative technical laggers. The big challenge that the NHS has had historically, at trust level, is chronic under-investment in capital, particularly IT. It is a lived experience of all of us users of the NHS that many of the systems are very old, and in some cases there is no system at all, with things still done on pen and paper. I really welcome the steps that the Government have taken in the 10-year-plan, with the ambitious digital plans to address that, but the challenge will be the implementation.

Q131       Steve Race: You referred to NHSX and NHS Digital sitting outside, and being brought into NHS England. Obviously, NHS England is now going, merging with DH. That means that the technical aspects of the team will sit within the Department, essentially. Do you think that that is the best place for them? Some people have said to me that you might want an external NHS digital body again. What do you think is the future for innovation and expertise in the NHS, if it sits within DH?

Louis Mosley: It is very important, wherever possible, to consolidate that experience. Technical expertise, as the members of the panel know, is quite specific and distinct. The more you can centralise it and not allow it to become diffuse across a very large organisation like the NHS, the higher are the chances that you can successfully compound that experience.

One of the biggest lessons that I have learned from working with many large, complex organisations’ IT functions is that the more subordinate the IT function is to the operational arm, or business arm, of the organisation—the deeper it is nested within that operational arm, and directly accountable to it—the more effective the technology function will be. The conclusion from that would be that a functional separation like the one that existed with NHS Digital as its own arm’s length body is a source of dysfunction. You lose the accountability. Ultimately, technology is an enabler. It is not an end in itself and it needs to be highly responsive to the operating brain of the organisation. Therefore, it needs to be structurally nested as close as possible.

Q132       Steve Race: We had Iain Duncan Smith here a couple of sessions ago, talking about the implementation of universal credit in DWP. His big challenge to the rest of the Government was that you cannot have big transformational IT programmes delivered by, essentially, civil servants who do not have a technical background. You need programme leaders to do that. His view was that that lesson had not necessarily been learned by all Departments in Government. Where do you think DH in particular sits on the spectrum of having real technical expertise separate within the organisation and having parity of esteem with senior civil servants to deliver projects, rather than being subsumed in a traditional civil service structure?

Louis Mosley: I recognise Sir Iain Duncan Smith’s concerns. That is spot on. The NHS, for reasons that I mentioned earlier around the experience during covid, is perhaps a rare example of where that is not the case across Government. I think the technical leadership is very strong, is highly respected and has that parity of esteem. You see it play out in the 10-year plan, and other documents like it, where the centrality of digital is recognised. It is broadly a positive story on the NHS.

Q133       Steve Race: Finally from me, where do you think the challenges are in attracting real talent from the tech sector into public service? What should the Government do to change things and get the best people into the service?

Louis Mosley: I welcome the moves that the Government have made around fellowships and incubators, and the emergence of DSIT as a sort of centre of technical knowledge, expertise and talent across Government. It is really positive and an important first step. The AI Security Institute is another great example of that. The Government have one massive advantage over the private sector, which is proximity to the mission—the sort of feedback loop from the impact that anything you do has on the public service. The sense of achievement will be much stronger when you work directly for the Government in public service than it will be if you are supporting them at second or third hand. It will always have a big advantage there and will attract some of the most talented people into public service for that reason. It needs at the same time, therefore, to become more permeable. The possibility for people to do a stint in public service and then leave, and vice versa, could do with strengthening.

Q134       Dr Gardner: As a provider of defence technology, do you think the recent strategic defence review fully addresses the challenges facing the UK?

Louis Mosley: Again, rather like the 10-year plan from the NHS, I really welcomed the SDR. It was a very comprehensive document that highlighted the existential importance of digital and tech in our ability to fight and deter adversaries. We have seen that starkly in Ukraine. An enormous number of lessons from the fight in Ukraine need to be absorbed as quickly as possible into our own armed forces. The SDR was an important first step in recognising that.

Q135       Dr Gardner: How is the defence data being protected? You have had some contracts recently, haven’t you, looking at how you can predict outcomes in decision making, which I have some concerns about, so I raise that. How is the data being protected in defence contracts, and is it true that the armed forces have to pay to use their own data?

Louis Mosley: The latter is not true. We provide our services to the MOD on exactly the same basis as we do to the NHS, in the sense that they are licensing a tool set. The data is theirs. The logic and the code that they write to transform the data belongs to them. They may be buying data from third parties. They may have commercial arrangements with other data providers, but we are not a data provider. We are not in that business, so we do not get involved in that.

Q136       Dr Gardner: You are very heavily involved with the US, with the Maven smart system. You are looking at some contracts with other NATO countries. How secure is the UK defence data? How can we be assured that it is not going to be shared elsewhere?

Louis Mosley: Exactly as with the services that we provide to the NHS, the software that we provide to the MOD is subject to the same kinds of controls, but there are also significantly greater controls, depending on the level of classification. The deployment of software at secret, or above secret, is done on air-gapped networks. It is not on the public cloud, for example. That is obviously a far higher level of assurance and protection than one would have in the public cloud alone.

Q137       Emily Darlington: You have contracts in the NHS, defence and now in education.

Louis Mosley: No contracts in education, no. We have some police contracts, and local authorities.

Q138       Emily Darlington: Do you think that there is a risk of Government dependency on your company, given that it permeates lots of other services, or is that an advantage because they are using a similar platform across different services?

Louis Mosley: On the question of dependency on a technical level, as I think I mentioned in a previous answer, there is no technical lock-in, so the dependency is not technical. However, if our services are very useful and they enable the Government to deliver very important outcomes, arguably that creates a form of dependency. It is not a technical one, but we are essential to the provision of something very important that the Government provide for citizens. The best way, in my opinion, to manage that is commercially, to ensure that the contracts are done appropriately and that you have all the commercial controls you would expect in contracts of that kind. We, as a supplier, are very keen to engage with Government to ensure that that happens.

On the second part of your question, there are advantages, but the nature of our software is that it is that integration layer, so where parts of Government may want to use completely different technical set-ups we are able to interact with those seamlessly on a read-write basis. That is part of the value proposition.

Q139       Emily Darlington: How would you respond to this? Palantir is a US firm and there are some very big differences in approach to public services in the US and the UK. Some unflattering comments have been made by the chief exec about our citizens and their relationship to the NHS—calling it Stockholm syndrome. Given that you grew up in the UK and you know how important the NHS is to the public sector ecosystem, how would you respond to criticisms that a company led by somebody who clearly does not understand the UK and the way it provides services to our citizens—I am trying to put this politely—

Chair: I think Mr Mosley will get your point.

Emily Darlington: I think you get my point: the criticisms that have been laid, and the potential risk to our ambitions and how we further develop those public services for our citizens.

Louis Mosley: I absolutely get the point. I think the comments you are referring to were made by Peter Thiel, who is our chairman. He was speaking in an entirely personal capacity. He was not speaking for Palantir, and he certainly was not speaking for me. I think there would be general disagreement across the company with the views he holds about the NHS. I also note that our chief executive, Alex Karp, is on record as saying, effectively, the diametric opposite. He is a US citizen as well, and he wishes the US had a healthcare system like the NHS, which is an exemplar to the world; I think that is the term he used. He sits on a different end of the political spectrum in the US from Peter Thiel.

Palantir is not, therefore, political. We represent a diversity of political views and do not take political positions as a company. That is a foundational element to Palantir’s approach to the world. We do not—unlike some tech companies, I am afraid—pick and choose which Government policies we will support and which ones we will not. We are here to support democratically elected Governments in delivering the mandate that they have been elected to deliver, and to do so subject to the rule of law. We are not in the business of deciding what we think is the right thing to do and whether it is illegal or legal. The proper place to do that is with you, the House, the Government and, ultimately, the courts—not in company boardrooms.

Q140       Emily Darlington: Given the Trump Administration’s closeness to the digital and AI sector in the US, Trump’s personal intervention in banning states from having regulation in this area and his very different approach from us in terms of data management, online safety and all those sorts of things, how does a company like Palantir manage to work in two very different environments? How do you balance that? Is there pressure from the US-led part of your firm to push and lobby here for similar provisions to those in the US?

Louis Mosley: Absolutely not. In that sense, we operate very independently. What goes on in the US and the policies that the Administration of the day are pursuing in the US is a US matter; it is not something that affects the UK business. I emphasise that we have worked now for 20 years in the US; we have worked for Administrations of every colour and have supported a broad variety of political objectives. We do not see it as our place to pick and choose which of those we will support.

Q141       Chair: I want to push that political connection a little more. You yourself were present at the meeting between President Donald Trump and Prime Minister Keir Starmer in February. Was that at the request of the ambassador to the US, Peter Mandelson? Is Palantir still a client of Global Counsel, which was founded by Peter Mandelson?

Louis Mosley: To clarify the first point, when the Prime Minister visited the White House in Washington in March, he then, as a second stop on that trip, came to our offices in the city. They were two separate events. We continue to use Global Counsel as one of a number of companies we work with.

Q142       Chair: Did Lord Mandelson arrange that visit for the Prime Minister?

Louis Mosley: No, it was done through the proper channels.

Q143       Chair: You continue to be a customer of Global Counsel.

Louis Mosley: Yes, we are.

Q144       Kit Malthouse: If I may ask a practical question and then a question related to reputation, you said that you were basically different from what people use your AI for. In a defence environment, for example, would it be possible for a Government to use your AI applied to data about individuals to target particular ones for attack?

Louis Mosley: I didn’t mean to imply that we were different. If you go back to the genesis of Palantir, Peter Thiel may have some political views with which we all disagree, but he is certainly a kind of card-carrying capital-L Libertarian. Part of the reason he wanted to found Palantir was his deep concern about privacy and civil liberties and the way in which the war on terror back in 2003-04 was being conducted, and the fact that organisations charged with defence of the US were at risk of hoovering up many people’s emails and listening to many phone calls, all under the justification of keeping us safe. He felt that that was an unacceptable trade-off and that in doing so you would compromise the very values you were trying to protect, and that the reason for this was a lack—

Q145       Kit Malthouse: Forgive me, but that was not really the question I asked. I asked you a practical question. If I have a large pool of data about a set of individuals and, in a defensive or offensive capability, I wish to target particular individuals with particular characteristics, your AI would allow me to do that.

Martin Wrigley: Drag and drop can deliver that.

Louis Mosley: On drag and drop, Foundry is used in military contexts alongside Gotham. That is why those two platforms are interoperable, so that moving data and other applications between the two is seamless. Targeting is an area where, again, rather like the governance around the data, we provide an enormous amount of control and governance to the organisations that use our software for that purpose, to manage precisely the kinds of risks that you are talking about so that, through that targeting cycle, you have assurance and, at the end of it, end-to-end auditability.

The decisions you are alluding to are some of the gravest that any part of British, American or western, broadly defined, military institutions have to take. When they do so, the first question that is always asked by the individuals who are charged with that responsibility is, “How do you know that this is who we think it is? How do you know that that data is trustworthy and accurate?” Part of the value proposition of our software is to provide precisely that assurance.

Q146       Kit Malthouse: That sounds like a yes. My second question is allied to that. Obviously, Palantir has reputational difficulty. Everybody is slightly suspicious about what you do. Part of that reputational difficulty has been caused by your software being used in the war on Gaza and the targeting of Palestinians with particular characteristics. What protections would you put in place for UK programmes to make sure that they are not complicit in the commission of war crimes?

Louis Mosley: I would push back on the question around reputation. Much of the concern and suspicion you mentioned is the result of misunderstandings about the nature of our software, our business model and the kind of work we support. I emphasise the fact that we have never worked, and never will, in countries adversarial to the west like China, Russia or Iran. We work in Israel; we are proud of the work we do there. We have provided the Israelis with support since 7 October, but our work there also predates those events. I cannot go into operational details of the way in which our software is used, but I think the systems to which you might be alluding, like Lavender, are not ones in which we are involved.

Q147       Jon Pearce: I want to take us back to the NHS. In your evidence to the covid public inquiry you said that the NHS had “fragmented data, underpinned by manual data collection processes, stored in varied formats across disparate and uninteroperable systems, inflexible access control frameworks and broken information governance audit trails”—quite damning. You suggested that it would be helpful to have a common operating system. I have two questions. First, have you had any discussions about moving forward with a common operating system? Secondly, if we have another pandemic tomorrow, is the NHS in a better position than it was in the first?

Louis Mosley: The short answer to the first question is no. As you noted, I put forward that suggestion in my witness statement, partly at the prompting of the inquiry itself. I submitted the witness statement, and they came back and asked me to elaborate further on the idea of a common operating platform, so I did. That has not led to any conversations with any part of Government as yet.

As for whether or not the NHS is ready, many things are much better than the situation I described in the witness statement five years ago. Have they all been fixed? No. Part of the problem with being ready is that you never know what you are ready for; you never fight the last war. The next pandemic may not be an airborne one; it could be contact. Indeed, it may not be a pandemic; it may be a natural disaster or a war. There could be all kinds of civil emergencies that the Government will need to tackle, for which something like the capability I described would be extremely valuable, but it does not exist.

Q148       Chair: We are running out of time. Thank you very much for responding to our questions. We have heard from Committee members about reputational challenges that I think you would admit Palantir has. We have heard about the thoughts of your founder and chairman, Peter Thiel. You have also said, Mr Mosley, and I agree with you very strongly, that technology is about enabling people. Whatever the problem, technology on its own is never the answer; it is about the people who design it and implement it and the people who use it. Given the work that Palantir does in Gaza for the Israel Defence Forces, and given NHS values, do you really think that Palantir is the organisation to bring together 42 integrated care boards and over 200 NHS trusts that champion NHS values around one federated data platform and, in the future, a single patient record?

Louis Mosley: I believe that the most important thing, when serving the NHS, is to ensure that we help the NHS to treat its patients faster, more effectively and ultimately more efficiently. That is the reason we are engaged with the NHS. The question of trust should above all be about our competence. Are we delivering what we promised to deliver? Are we making the patient experience quicker, more effective and more efficient? If we are, we should be trusted with that.

Q149       Chair: Mr Mosley, you cannot tell people how and why and on what basis they should trust you; you can only address whether and how they trust you. In the NHS, we need cultural change in order to drive technology adoption. Do you think that you are the right organisation to drive the cultural change for technology adoption in the NHS?

Louis Mosley: I do. We are one of the world’s leading tech companies. We have experience of driving precisely that kind of cultural change and digital transformation across a very wide array of large, complex organisations in both the public and the private sector. The NHS is one of the largest and most important organisations of that kind anywhere in the world. We are incredibly proud of the work we do and proud to have been given the opportunity to try to do this. We are fully committed to making it work.

Chair: Thank you very much for your contribution this morning.

Examination of witnesses

Witnesses: Dr Diwakar, Alex Crossley and Amy Freeman.

Chair: Welcome to the second panel in today’s third session of the Select Committee’s digital centre of government inquiry. We are now looking at digital transformation in the NHS, and we have witnesses from NHS England. I ask them to introduce themselves as they respond to our first question. I welcome Danny Beales MP, who is guesting from the Health and Social Care Committee, who will kick us off.

Q150       Danny Beales: Thank you, Chair. The NHS 10-year plan is incredibly significant for digital transformation. It is one of the three major shifts in reforming the NHS and fixing some of the underlying issues. In terms of the published 10-year plan, could you outline your perspective? Is it as ambitious on digital transformation as you hoped? Is it an achievable vision? Perhaps you could highlight your reflections on where the plan eventually ended up.

Dr Diwakar: I am Vin Diwakar. I work on clinical transformation in NHS England. I am a doctor by background, a consultant paediatrician. I was the chapter lead for the analogue-to-digital chapter of the 10-year health plan, so I am probably a little bit biased in saying that I think it was ambitious in scope, particularly when you look at it over a 10-year period. It was necessary for it to do so.

Secondly, when we were talking about it, we focused very heavily on the experience of patients, particularly looking at the end-to-end pathway for patients, starting with the point when you want to prevent illness and going right up to the point when you might have a long-term illness or, sadly, be in palliative care. I can expand a bit on that if necessary.

It also refers, importantly, to the experience of staff. I think staff will tell us that they are frustrated with the number of systems they have to log into with slow hardware and software. For example, the plan also makes reference to and commits to single sign-on for the NHS by the end of this Parliament, and also the implementation of something called ambient voice. We were very pleased with it.

The other thing we were pleased about was that in the spending review the Chancellor announced £10 billion-worth of investment in technology and data in the NHS. We are pleased that the Government have set out a clear vision for us and the funding that will be required in order to deliver that vision.

Q151       Danny Beales: It is good to hear that you are happy with what you wrote. In implementing it, there is an underlying significant reform and shift. We have heard previously about the shift of NHSX and NHS Digital into NHS England. NHS England is now ceasing to exist. ICBs are being merged; accountable care organisations are being set up. Do you think the practical implementation of digital transformation in that context will be a challenge? How will digital transformation land successfully in a system that is shifting? Who will lead that transformation?

Dr Diwakar: I will make a brief comment, and then the Committee may wish to turn to my colleagues. If I divide up implementation into what we have to do at the centre and what happens when we get into organisations, Alex will be able to talk a bit about the fact that, in order to access the funding that the Chancellor has announced, we will have to write Green Book-compliant Treasury business cases over the course of the next few months. We are cracking on with writing those business cases. They will set out clear timelines and they will be tested, quite rightly, very heavily by colleagues both in the Department and in the Treasury to make sure that they are deliverable, and that they deliver real-world benefits on the ground.

We have tipped our approach from the one we had historically. Historically, in the NHS we tended to regard programme delivery as a measure of success. We have changed our approach to being focused on benefits and the delivery of benefits, and that is what we will be working with organisations to do.

The second bit of that is that you can plan, but it will nevertheless be a challenge as to how we get the delivery capacity right at each level of the system. At my level of the system, we clearly have to deliver a 50% headcount reduction as NHS England is folded down and moves into the Department. One of the things we are looking at very carefully is that when I travel around trusts across the country—Amy will be able to come in on this as well—I detect a lack of both digital capability and capacity for digital transformation. In particular, I think that at the moment organisations have a real problem with that. As we consider how to rebalance the centre, one of the key themes in the whole plan is about making the centre smaller and distributing more resource to the frontline so that they can build capability.

Q152       Danny Beales: To challenge that point, the centre is getting smaller but ICBS are having to reduce their headcount by 50%. A lot of trusts are being directed to frontline-focus on resource, which often means management being cut, and digital usually sits within an operational capacity. Is there a risk that at every level the capacity around digital transformation will reduce, not increase, at the same time that you are trying to deliver this transformation?

Dr Diwakar: In that middle area, in ICBs the digital responsibilities are not in the ICB plan that NHS England published. There are different views as to whether or not that is an appropriate function for ICBs. At trust level, we want to take as much as we can of the £10 billion and make sure that that gets to the frontline in order to build capacity. There is no doubt that this year the NHS faces significant cost pressures, but some of the new investment that the Government have announced—the £10 billion going into tech investment—will obviously need to go into the centre to build central platforms, like the NHS app, but for implementation we want to make sure that much more of that—

Q153       Danny Beales: Is capacity being protected for digital at local and national level?

Dr Diwakar: Protecting it is always very welcome. That would be the ambition. What I cannot do is talk for individual organisations because they will have to balance off other pressures that they face. For example, during the industrial action last year we had to reduce considerably the technology investment to balance off the extra costs.

Danny Beales: So I can take it as a yes from your perspective, nationally.

Dr Diwakar: Yes, ideally.[1]

Q154       Danny Beales: Amy, perhaps you could give a local perspective on implementation.

Amy Freeman: I am Amy Freeman, chief digital information officer. I look after digital in a fairly large teaching hospital in Stoke-on-Trent in Stafford. I echo the welcome. It would be good to be able to protect digital budgets. Certainly, in my area my digital budget equates to 1.4% of turnover, which is very low. We have to do a lot with that, so as much as that money coming into frontline would be welcome, there is something around how we change the perception of digital being a back-office function, which is subject to the cuts, rather than an enabling function and part of the solution. We have not got there yet. Those cuts are being made and there is a very challenging financial position at the moment. The risk is that as more pressure comes—welcome pressure, I hasten to add—to do more with digital, we have potentially lost some of the good people who were subject to cuts. It is definitely a tricky balance.

Q155       Danny Beales: If that happens, do you think that there is a risk that we will lean more on the private sector and contractual relationships such as those that we heard about in the previous discussion with Palantir, and that we will get locked into contracts, perhaps bad contracts, if we do not have that expertise?

Amy Freeman: I think you are right, particularly if we want to do things at pace, because the way to get people in at pace is to use contracting and consultancy services. That would not be my preference; I would prefer to keep those who have organisational history and skills, rather than losing them and trying to get them back.

Q156       Danny Beales: There are broader lessons that I suppose you have learned. This is not the first digital transformation in the NHS that has been promised. A major NHS contract in the noughties was overspent and under-delivered. Even more recently, for organisations like the CQC, for instance, one of the main drivers behind its failure was the roll-out of an IT system that was meant to solve all their problems, but tripled the workload of frontline staff and led significantly to disarray. What are your reflections about where the NHS has gone wrong, and how those lessons are not repeated?

Alex Crossley: I am Alex Crossley, director of transformation strategy, finance and delivery. The key difference this time is that this is not a technology plan; it is a transformation plan for what the service will look like in 10 years’ time. I joined DHSC, and then NHSX, in 2019 from DCMS. Since that time, the conversation has fundamentally been about technology programme systems and what technology options we choose. The conversation has shifted in the last year or so towards one of system transformation and how our colleagues outside the technology and transformation team can start to embrace technology to deliver fundamentally different business models and get benefits out of what they are doing.

I am pleased that we are in a different space. That will honestly be worth its weight in gold in driving a culture change because, as the Chair said earlier, fundamentally this needs to be about implementation on the ground. I think we will see a shift in the approach of our clinical and operational colleagues to embrace technology as a result.

Q157       Dr Sullivan: On systems transformation, I come from a council, and local councils are undergoing transformation every year. The good ones listen to the frontline staff and know exactly what they have got and what they must deliver. I believe that the success criteria you mentioned earlier are about the benefits. How are you capturing and making sure that staff voices are the ones that will help to lead and direct the digital transformation that they need to do?

Dr Diwakar: First, extensive consultation on the plan took place with staff, who went through their concerns. There was an extensive consultation period with patients, with thousands of people contributing. As part of the plan, we are confident that patients and staff played a big part in it. The second bit is that when you are designing digital products user experience is a core part of it. In the NHS and in councils we talk about co-production in the digital world, and one of the things I have learned as a doctor is that they talk about user experience and there are proper experts who do that.

Where we really need to work—this goes back to the question about how much investment we put into trusts to build capabilities—is that 97% of trusts now have a digital electronic patient record, thanks to investment over the last four-year period. That has been delivered well. It has been rated by the Infrastructure and Projects Authority as a well-run project that is meeting its milestones. That is because the milestone is implementation. If you actually look at the evidence as to whether it has created productivity benefits, which I would suggest mean real changes that benefit staff on the ground, they are not there; it is a bit thin. When you go into trusts some say, “The EPR is fantastic; it has made a huge difference; we are not using paper.” Other trusts say, “We’re now doing admin tasks that used to be done by a secretary.” One of the things we are working on now, which we have been challenged on by Sir Jim Mackey, chief executive of NHS, is what we need to do now with our existing very expensive investments to make sure that we have optimised them for staff to use for patient benefit.

Alex Crossley: There are two additional things. One is that we need to be building technologies in a way that is user research-led and that is how we are building technologies, particularly with our products and platforms teams. They have a huge pool of people they go and talk to. They test things with A/B testing. That is really powerful. Then we need to roll out those systems first with a pilot and discovery, alpha, beta and the usual technology development cycle. We are getting much better at that. The things in the plan are things that we are in discovery and alpha with now, so we can take the time and get the deployment right.

The second point is that, through the spending review, one of the things the Treasury has been helpful with is adjusting the balance of our revenue and capital settlement. Historically, we have had far too much capital. With capital, we cannot go out and do things like implementation work on the ground. That is a revenue cost. That has driven a focus on developing the asset but not getting the implementation right. They have responded by giving us a significant increase in our revenue base, which means we can go out and do that work through the coming SR period.

Amy Freeman: Can I give a frontline position on that? To take a frontline position, years ago we did not have chief clinical information officers prevalent across the organisation. They are medics who have an interest in digital, but they are also the sounding board for the locum in the hospital. They now have a strong voice and drive innovation. They also have a national platform. They meet once a month to come together to talk about the issues. That was not there before. The ability to have that voice is important, and, locally within the trust organisations, to have clinical and digital working very closely together as a team makes a difference for the design and development of solutions on the ground. I think that is quite a big differentiation.

Q158       Dr Gardner: It is nice to meet you all. Amy, it is nice to meet you—I know UHNM very well, and I visited your radiology department to look at some of the innovative technologies that they have there, which was incredibly useful in my previous role at the AI and Digital Regulations Service. One of the areas that I am really interested in is the barriers to adoption of innovative technology. You touched a little bit on your revenue spend. This is to all three of you: what are the main barriers to the adoption of innovative technologies across the NHS?

Dr Diwakar: First, we know that the NHS has a challenge in scaling up innovation. There is often the phrase that the NHS has more pilots than British Airways. We know that there is a problem. I was also one of the chapter leads for the innovation and life sciences plan on two sides: what we call supply-side reform and demand-side reform. On the supply-side reform, one of the things that we talked about is boosting the ability for innovators to come in and test their products and gather evidence. XR Therapeutics talked about the importance of the small business research initiative, which my team runs. We have a number of other initiatives in order to do that.

We also talked in the plan about health innovation zones. These are areas where we would allow those areas to use the freedoms that are set out in the broader plan in order to support innovation, because one of the important things, as Alex said, is that you cannot just drop an innovation into an unreformed system; you have to do both, and that is one of the challenges that we faced.

Q159       Dr Gardner: Can I interrupt? That is a familiar story. A lot of healthtech companies tell me there are lots of pilots, innovations, zones, competitions and funding, but getting into adoption and regular use—we will come to a question about what you do once you have adopted those technologies—is one of the blockers. How are you addressing that?

Dr Diwakar: For widespread adoption across the NHS, the current system is that you have to have approval by NICE that it is cost-effective technology and that it is recommended for widespread use across NHS. Then, either NHS England, a local commissioner or a local provider has to make a resource-based decision as to whether it wishes to prioritise that. In order to speed up that process, one of the commitments in the plan is that both NICE and the MHRA will speed up their processes and there will be more parallel approvals; if one area is approved, it will not need another approval to do it.

The second barrier is that you have to go around every organisation in the NHS and agree that information governance standards meet it, and that is because the risk is held by the organisation, as the previous witness laid out. That is quite right, but it creates a massive overhead and time for businesses. One of the things in the innovator passport is to explore whether we at the centre can do some of those checks to such high quality that an individual information governance lead could accept that. That is really the plan about how we would like to expand it.

Q160       Dr Gardner: That is a very useful answer. Thank you very much. I have one final question to you, Amy, because obviously I am going to ask this. Once the AI technologies get implemented, I am really interested in how you govern those technologies, how you ensure that they remain clinical and cost-effective post deployment and how you manage issues such as updates. This is linked to clinicians’ resistance and concerns about the technologies that you use and the assurance that the governance is there. How do you set that up in UHNM?

Amy Freeman: It is a really timely question, because we have just got approval in the last three months to set up exactly that: an AI governance body. It is a multidisciplinary team that includes ethics and clinical safety. The technology, the data and the information governance all sit as part of that group, and all new AI capabilities come through that group. Significant changes either in use or type of AI for an existing tool come through that group as well.

That is what we do at UHNM. It is not the same across the piece. Not everyone has managed to secure that, but we have, because we are really driving AI at UHNM. You have been to visit and you saw some of the stuff that we are doing there. It is something that I am really proud of. We had to have that governance in place. Otherwise, it could become the wild west, and that is a place of danger for us. The governance structure is multidisciplinary, including clinical ethics, data, tech and IG.

Q161       Dr Gardner: Sorry, Chair, but I have a sneaky last question. You are providers of a service. You have public sector equality duties that give you some degree of liability in terms of the systems you use. Do you think that the CQC has a role in monitoring your delivery and your use of these technologies, rather than the MHRA?

Amy Freeman: In terms of whether they are used safely and the outcomes for patients, for me that should sit with CQC. If we have an organisation that is not using and adopting those technologies, someone is potentially going to have a second-class service, because you have a trust that does and a trust that does not, and that does not seem okay to me. The question that could be asked by the CQC is: are you using it, and why are you not? The clinical safety assessment needs to be done where it is today.

Q162       Kit Malthouse: You guys are one of the enablers of technology in the NHS. What is going to happen when you are swept away?

Dr Diwakar: We are doing other work at the moment to determine both what the operating model for the new system will be and how we will go about discharging that. There are a number of elements to that. First, there is—

Q163       Kit Malthouse: Sorry, the decision was made to get rid of NHS England without there being a plan for what would replace some of the critical functions like yours. Are you just working on that plan now?

Dr Diwakar: Yes.

Kit Malthouse: Okay.

Dr Diwakar: One of the questions is whether it is right that the Department of Health and Social Care will continue to do all the functions that NHS England has. That is a legitimate question that we are currently working through with the transition board that is co-chaired by Penny Dash and Alan Milburn. We will provide some advice to that. The second bit, as I said earlier, is that as the headcount comes down, we want to get those skills out as much as we can to the frontline.

Q164       Kit Malthouse: Is it clear yet whether the health innovation network will survive?

Dr Diwakar: Yes, it will. For the health innovation network, there is a specific commitment to it in the 10-year health plan.

Kit Malthouse: The academic health science network with them at the heart of it is going to continue.

Dr Diwakar: Yes.

Kit Malthouse: But it is not clear what is going to happen at head office yet.

Dr Diwakar: Not yet.

Kit Malthouse: Okay. Good luck.

Dr Diwakar: Thank you.

Q165       Kit Malthouse: My guess is that the adoption of innovation in the NHS is not dissimilar to the adoption in the police or local authorities, which is that, in each discrete organisation, if there is one motivated individual they will generally pull the technology into their organisation, and as a result you get a patchwork of adoption. You get one oncologist who is particularly keen on whatever their technology might be; you get one police officer who is particularly keen on facial recognition, and that kind of stuff. You can either push against that model or work with it.

What can you do to stimulate a situation where there are lots of those motivated individuals across the network so that they naturally adopt and pull in a thing? It is a bit like how, if a mother bird shows up to a nest of baby birds, they all open their mouths eagerly to grab whatever it might be. How can we make the NHS more culturally open in that way?

Dr Diwakar: Yes, innovation. In terms of stimulating innovation, first, there are a number of trusts that are doing what Alder Hey has done. I have seen similar systems in Newcastle and in Guy’s and St Thomas’ where they try to stimulate innovation and get their clinicians to do things, and they support them as well with joint institutes. That is what the health innovation networks do.

The second bit is that we have a number of programmes that support them. The clinical entrepreneur programme is a specific programme that my team runs and which you can apply to get on to. That will help you develop your product and then get it to market. Then we have things like the national innovation accelerator, where you can go into the next step and gather the evidence.

Kit Malthouse: That is also building a network of individuals.

Dr Diwakar: Yes, exactly.

Q166       Kit Malthouse: Do you think it would be sensible for routine CQC inspections to rate or comment on how far advanced each institution is in its adoption of new technology and techniques? Would that be possible? “Alder Hey, you get a 10 out of 10, but I’m afraid Broadgreen just up the road—d’you know what? You’re about a 6.”

Dr Diwakar: In the 10-year plan group, we talked about an innovation scorecard. Whether the CQC as the regulator is the right way to do that, or whether you use a scorecard more broadly for NHS England to look at or for the public to look at, so you put pressure on in different ways, is a question, because the CQC, as you know, has a lot of things to do at the moment. It may be that providing an innovation scorecard is a way of doing that, looking at the uptake of innovation across the piece.

Kit Malthouse: I only suggest the CQC because it looks at health outcomes as well as quality, and that is intrinsically related to the adoption of technology.

Dr Diwakar: Yes, it has. I am sure that the new leadership team at the CQC will work through that with us, but that is a discussion that certainly they have not had with me.

Amy Freeman: May I comment on that? From a frontline perspective, we have to contribute annually to the digital maturity assessment that assesses our digital maturity, and that includes innovative technologies that some organisations have adopted and some may not have. That is already a measure of the digital capabilities in trusts across England, and that information is held nationally and can be used to help drive the gaps in the services—

Kit Malthouse: So I can look at my local hospital and say, “You’re great,” or, “You’re a load of rubbish.”

Amy Freeman: Yes, you could.

Chair: But not more generally—not for the broad ranges that we saw this morning from our innovation showcase. You are talking specifically about digital.

Amy Freeman: Yes, absolutely. But if we agree that core capability should be part of the capability of the organisation, that could be part of the digital maturity model. We have a vehicle already.

Chair: Can I ask you to lean forward when you speak, because I am having difficulty hearing?

Q167       Emily Darlington: I have two questions. The first builds on Kit’s point. One of the biggest barriers to adoption of technologies is the GP network, which from the public’s perspective is our first point of contact with the NHS. What are you doing to get the digital strategy adopted at GP level and integrating GP practices into the information, data and other services of the NHS?

Alex Crossley: In some respects, primary care is the most digitised service. The lived experience of patients is very different. We know that something like 99% of GP practices have the capability to run digital telephony. The NHS app has the technical capability to manage 98% of GP appointments in the country. We know it does far fewer than that. I cannot manage my own GP appointment in the NHS app. That is ultimately a local decision for GP partners. They are independent businesses. We announced a few months ago some reforms to the GP contract, which we expect will really drive those values up. I would expect to see us doing far more in the coming months.

Part of the message that we need to land with the system is that fundamentally we need to improve productivity and user experience, and the only way you are going to achieve that is through technology. We have seen really good adoption of technologies where primary care sees the benefit. The “Register with a GP surgery” service is now managing something like 60% of all registrations with general practice. That is a service that did not exist a couple of years ago. We are in over 80% of GP practices.

For me, it is a case of showing GPs the benefits, assuring them that the systems are safe, that they are financially viable and helpful to them, and that they are making the implementation of those systems really easy, which I do not think we have always done previously, to my point about implementation. With the “Register with a GP surgery” service, currently you still have to do some manual workarounds once the patient has gone through that service. The GP receptionist has to do some local workflow to upload the patient into their system. I hope we will hit 35% full automation this year, and we will keep growing that in later years. We need to make those services really easy for GPs to use so that they want to adopt them.

Q168       Emily Darlington: I have a second question in a different vein. The Palantir service, we heard, is very good at sorting data to ensure that you could get patient cohorts and other sorts of identifiers. What is the regulation around academic researchers using those platforms and data to do their work? On what basis do we make that kind of information available to the life sciences sector, which may be looking to conduct clinical trials or develop medical technologies? Are we commercialising that? Is it a paid-for service? How do we ensure patient protection within that? That is a big question, but it gets to the more interesting bit, which is how we are actually using this.

Dr Diwakar: For NHS data, over the last few years we have been operating on the principle that it is about data access and not about exporting data out of systems. Across the country and nationally, we have set up a set of things called secure data environments. They are analytic platforms. The data is extracted and goes into a secure data environment. There are huge protections around it. If you are a researcher, you can apply, under conditions that are determined by the GDPR, for access to that platform. You can conduct your analysis there. You can bring your analysis out at high level, but you cannot bring out any of the raw data. That is the way it works at national level for NHS England data.

It is clear, in relation to the commercialisation comment, that the UK does not maximise the opportunities that we have with one of the world’s few cradle-to-grave datasets, linked by a unique number—the NHS number—in the way they do in the US and other parts of the world. We have done a large amount of consultation with the public. We have talked to about 2,000 people in a set of public deliberations and citizens juries over the last year. The vast majority of the public understand the need for research and are comfortable that the NHS is able to extract value from the use of that data. They want to know who is using the data, and, secondly, they want to see that value going back into the NHS; they do not want to see it going into the pockets of shareholders, for example. There are various ways in which you can get value. You can pay for access to the data. You can also pay for access to data services like the analytical services that we provide, which is not taking the data out.

One announcement that was made before the spending review, but is going to be reiterated in the spending review and in the 10-year health plan, is the set-up of a national health data research service. That will take the role that I have described of bringing the UK’s various data assets together, having a properly co-ordinated system so that if you are a researcher—you might be pharma, you might be funded by Cancer Research UK, you might be funded by public research—you can come in and say, “These are the datasets that we need in order to conduct this research.” It is provided as a concierge service and then you can do your research pretty easily. That is the way the relationship works. Most researchers will tell you now that there are so many data sources that it is difficult to work out where to do your research currently in the UK. We are punching well below our weight.

Chair: Thank you very much for that. We are running out of time, so we have to move on.

Q169       Steve Race: This is a question for Dr Diwakar and Mr Crossley. What feedback have you had from trusts on the federated data platform, and what is the feedback mechanism?

Dr Diwakar: About 125 trusts have expressed an interest in taking up the platform. We would never force it on people if they do not want it. We set ourselves an ambition that it would be taken up by at least 85%. We always said that there would be 15% that might have their own systems. About 71% have implemented it, and where they have implemented it, where there was a gap in their own systems, they have seen benefit.[2] About 75,000 additional operations have been done in places that have adopted the federated data platform. By integrating datasets between patient administration systems and clinical records, we have been able to remove about 210,000 either incorrect entries on the waiting list or patients who do not need to be seen. It has helped waiting list management. There is a 17% reduction in people using the tool for discharge co-ordination in the number of patients whose length of stay has been greater than 21 days.

There is no doubt that many organisations are seeing benefit from it. I can see those benefits at central level. One of the benefits of a digital system is you are collecting the data in real time, so you can see the benefits accruing over that period. It is true that the experience is variable. Amy might want to expand on that a bit. In Stoke-on-Trent they have systems already in place, so as an organisation they have not found that the federated data platform necessarily meets their needs as a system. Amy, do you want to comment?

Amy Freeman: An earlier witness commented about the ability to write back and about how if you cannot write back into source systems it can be a productivity challenge. If the system that a trust or organisation has is old and does not support write-back, that can be an issue. That has been the case where I work. We have used the tools. We have been able to do good stuff with the tools, but being able to write that back into the source systems has been a challenge because of the age of those systems.

The starting point of an organisation depends on what value they will derive from the solution, but having a solution there is helpful. Colleagues of mine across in my opposite county are doing really good things in terms of replacing their local data stores, their local data warehouse, with this solution. It is saving them some real frontline cash, so that is really helpful. The starting position is important. We have other organisations with mature digital systems that already do a lot of the capability of the FDP, so it is variable.

Q170       Steve Race: Does your platform communicate with the federated data platform?

Amy Freeman: Yes, we send data in to the federated data platform. What is interesting about that is that as a trust we are not consuming those services, but as a system we are. We are setting up with the FDP control centre capabilities, so they have visibility of the performance of all hospitals in our area, including other trusts like mental health and community as well. They have a single dashboard so that they can see the performance of the whole area, which is really useful. Although we are not consuming the data currently, we are putting data in so that it can then be used by the system to help support.

Alex Crossley: An important point is that in a system as large and complex as the NHS, it is never going to be true that we will be able to apply a single system everywhere because of the start point of the organisations, so we need to make sure that those systems are based on technical standards that mean we can drive increasing interoperability. We are doing a number of other things in that space to try to make that true.

Parliament has just passed the Data (Use and Access) Act, which includes provisions that will enable us to mandate technology standards on suppliers in a robust way for the first time. That will have a huge effect in driving out some of the challenges that my colleagues have identified.

Q171       Dr Sullivan:  Where there is greater access for researchers and the ability to look at data, there is another side of the coin, which is about a person’s own special data. In the single-use space, you are looking at being able to opt in and opt out, I believe, and protect privacy. Having gone through Facebook and trying to do all the privacy stuff, it is very complicated. You used citizen juries and you spoke to 2,000 people, which is great. I wonder about those who may be hard to reach and who may have concerns and fears, and how we can help to empower them to maintain the data for themselves and have trust in the system so that they can keep going. Could you expand on that?

Dr Diwakar: When we have done public polling, about 85% of the public said they trust the NHS with the data, but about 50% are worried about the risk of cyber in particular.[3] On the opt-out, there are three layers. First, under legislation at the moment, you cannot opt out of data sharing for clinical purposes for direct care use. That seems eminently sensible. Once I was looking after a patient who did not want data to be shared with their community care team, which was not appropriate for their child, so I spent a lot of time talking to them about what that is.

You can opt out of the use of your data for secondary purposes. I would always encourage patients not to opt out. When I did one of the public deliberations, I met a patient who had a very rare disease. When I talked to her about how data is used in order to find a treatment for her disease, she said, “I’m going to go home and opt back in again now. No one’s ever explained that before.” We need to get better at explaining it.

The third thing is that if you still want to opt out, you just need to Google search “Opt out,” and there is a simple, single, easy way of doing it. We track the number of opt-outs that we get whenever there is a load of publicity about it.

One of the areas where I might point the Committee’s attention is this: if you look at it from the other end of the spectrum as a researcher, one of the biggest gaps that we have in the UK is access to primary care data in a safe environment. Currently, that is because individual GPs are data controllers. They have entirely legitimate concerns, because they do not have the information governance departments like they do in hospitals to help them understand it.

We also have to negotiate access with the BMA, which we talked about earlier in the session. My colleagues in the Department of Health and Social Care are producing advice for the Secretary of State on reform of the control of patient information rules that were used during covid to allow data sharing for certain uses. There is a broader question of whether, in any forthcoming NHS Bill, Parliament and Ministers may wish to look more radically at things like the GDPR and the use of data for health purposes. I will not comment on it here, but it is a legitimate question—not just because the research will have benefit to patients directly, but because it will add benefits to the economy. We know it is one of our greatest assets.

Q172       Jon Pearce: Good morning, all. Can I look briefly at the Foresight generative AI tool? My understanding is that Foresight was trained on anonymised data of about 57 million people in England, including data from the pandemic planning and research dataset. I understand that concerns have been raised about how that was done and how the data was used. There was some suggestion that Foresight was trained without undergoing an additional review, and as a consequence it has now been paused pending an internal audit. Can you update the Committee on what the current position is and whether we have an outcome of that audit?

Dr Diwakar: To give a bit of context, the data was made available to the researchers on the basis that they were consistent with the COPI regulations that legitimised the use of data for covid purposes. The BMA raised concerns that that goes beyond what the COPI regulations allowed. As you say, an audit has taken place, and we have taken legal advice on the basis of that report. We are about to present that report to the Information Commissioner’s Office. The commissioner will take a view, and then we will proceed from there, depending on what they say. I estimate that we will be able to conclude that process in weeks, not months. A decision from that is imminent. We are aware of the need, both from a researchers’ point of view and for those with legitimate concerns, to bring this to a conclusion pretty quickly.

Q173       Jon Pearce: Thank you. To be clear, data processing has not resumed at this stage.

Dr Diwakar: No, that study has been paused until we get the advice.

Q174       Jon Pearce: Obviously I do not want you to prejudge the outcome, but are there any proposals for additional safeguards to be put in place to make sure that this does not happen again?

Dr Diwakar: For this particular study, we will rely on the advice that we get as to whether it was consistent with the COPI regulations. The next legitimate question is about the advice that we are presenting to Ministers about COPI reform that would allow a wider use of data in the NHS for secondary purposes. We need to be clear that that provides sufficient safeguards, both for researchers and for patients, to make sure that they can still have confidence in using larger datasets to train AI models.

Jon Pearce: Thank you. That is helpful.

Q175       Chair: Jon’s point raises some of the challenges, the issues and the mistakes that the NHS has made in the purchase of technology and the use of technology. I was very struck, Dr Diwakar, by the fact that when my colleague Lauren asked you about patient control of their own data and opt-out, you turned that into advocacy for more access to GP records without patient control. How is the patient advocacy for control of their own data—the voice that is heard there—integrated into your processes for technology diffusion?

Dr Diwakar: I will divide that up into different things. For direct care purposes, I passionately believe that patients should have access to all the data.

Chair: I wasn’t asking for your views; I was asking how the views of the patients come into it.

Dr Diwakar: That was something that we heard very strongly from patients as part of the work that we did as part of the 10-year plan. I was very pleased to see the Government make a commitment to legislative reform that will make that possible through the single patient record that is available. For direct care purposes, we should be able to end this business that we all get frustrated with, and every patient tells us they are frustrated with, of having to tell your story multiple times and repeat tests because people could not access them and all that sort of thing. We very much heard the voice of patients on that.

For secondary care purposes, there are a lot of safeguards built in already. We work closely with a number of advocacy organisations. There are data access committees across the country and there is a central data access committee for the federated data platform. We have a “check and challenge” session that brings in people like the BMA and privacy campaigners to make sure we get robust challenge from that. We are aiming to hear from the whole spectrum of views, both patients who are comfortable with data use and those who are privacy campaigners and raise often legitimate concerns.

Chair: Great. Thank you very much for that.

Alex Crossley: We have said through the 10-year plan that we will develop a single patient record. We will give patients access to that record through the NHS app. There are a series of other things that we can do through the app to allow patients to express their preferences, communicate with their care providers and really give them a voice. That user empowerment, patient empowerment, is one of the key themes of the plan.

Q176       Chair: I would challenge that on the basis that access is not the same thing as control. Obviously it is important for transparency, but having access to the single patient record does not mean that patients have greater control of their own data. When it comes to the single patient record, of course it has to be successfully developed to bring us all these advantages. It is a huge project. We have this diagram, which I am holding up, of all the different types of data that patients generate, and they are all going to come together, apparently, in one single record. During the national programme for IT some years ago, there was the project Lorenzo, which also tried to bring together an electronic patient record just for the north midlands and the east of England—30 million citizens. It was not as ambitious, but it failed notoriously. Can you briefly say how this project is different from that?

Dr Diwakar: For context, I was a consultant paediatrician in the midlands at the time of Lorenzo, so I experienced the challenges that it produced. First, we have learned lessons from that.

Chair: Can you be specific?

Dr Diwakar: Secondly, the technology has moved forward in this respect as well.

First, we are clear in the single patient record about the use case for patients. Patients have told us that very loudly. Secondly, we have not made any assumptions on this occasion about the type of technology that we need to deliver it. In the original national programme for IT, a number of suppliers were engaged by the programme, and they were, effectively, imposed on different parts of the country. The hospital where I was working at the time was not given any choice. We were just told, “You’re going to have Lorenzo,” and somebody else was told something else. Amy may remember that as well.

Amy Freeman: Yes.

Dr Diwakar: In this, we have been quite open about the fact that there are various options for the way that we build this technology. We have been quite open that no decisions have been made. In fact, we have just gone out to industry to write to us—“What are the things we should consider? How can technology solve this? What would be the different ways we can do it? What are the most cost-effective ways of doing it?”—so that we get the balance right and make good use of public money. How do you get the balance right between, on the one hand, building on the systems that we have at the moment and, on the other hand, getting value, if those systems don’t work, in building something entirely new? No decisions were made about that, but we are really clear about the use case that is set out clearly in the plan.

Q177       Chair: Finally, will you commit to the Committee that it will be based on open standards, open source, and it will not be proprietary systems or dependent on any one vendor?

Dr Diwakar: It will be based on the right standards. That is absolutely—

Chair: Open standards, not right standards.

Dr Diwakar: Yes, open standards. We will comply with the Data (Use and Access) Bill, and it will have to be cyber-secure by design right from the start. I cannot comment at the moment because, as I said, we have not made any decision, so I cannot comment as to exactly what technology will be the best way of delivering it and how we will go about procuring it. We can come back to the Committee to give evidence on that on a future occasion.

Chair: We will be very interested to hear that. Lauren, Martin and Danny have some quick questions before we finish.

Q178       Dr Sullivan: A very quick question. There is a risk and a concern that consent and data will be sold to American companies, or whatever companies. Will there be locks in the NHS app so that that would not be able to happen and so the person has control and consent over where their data goes?

Dr Diwakar: Yes. As a general thing, you cannot export data to the US. We are working with the Cabinet Office because there is a set of red list and white list companies to which, under specific research terms, data access can be given.[4] That might be one of the areas that the Committee may wish to look at because we need far more consistency in that area. There is a cohort study involving about half a million people called UK Biobank. Patients in that study have given their consent for data to be shared, but absolute clarity about which countries the study can share the data with needs more definition.

Q179       Chair: When they give their consent for data to be shared for a project, does that limit where the output of that project can go? If there is a project to co-ordinate on some treatment, does it limit where the output of that study can go?

Dr Diwakar: Yes. On an individual study-by-study basis, we and UK Biobank would go through a very rigorous process of applying standards to make sure that that data could not be exported for anything other than the purposes of the study. We apply very strict standards. In fact, in the past, UK Biobank operated under old standards. We are currently working with them so that they have to apply the new standards.

Amy Freeman: And consent is for that purpose only.

Q180       Martin Wrigley: There were a couple of things that the previous witness told us about the Palantir system, the federated data platform. One that I was particularly curious about was the people working on it. He said that there were thousands of them in the NHS. Do you recognise that? He also stated a preference for people migrating from private companies into NHS, and possibly high-level civil service roles—the classic rotating door that has often been cited. Do you think that is a good idea, or should the contracts we are having with people like Palantir have non-poaching and non-compete clauses so that we do not see senior civil servants going off and taking nice jobs with Palantir?

Dr Diwakar: On the second question, if civil servants wish to go and work, they have to go through the ACOBA process.

Martin Wrigley: But it never says no.

Dr Diwakar: I can’t comment on that. That is the process for that route. Again, I cannot comment because I do not know how many people Palantir employs in the UK.

When you visit a trust that is implementing the federated data platform, they have their own local team of people, they have people provided by the other suppliers like Accenture that are part of the contract, and they have Palantir people physically on the ground. When I went to Bath and they were implementing and developing their new Cancer 360 tool, the secretaries and the administrators on the ground knew the name of the Palantir person who was with them and developing the technology with them. He was widely known through the organisation for the work he did with quite junior members of staff. The staff from Palantir who are working in trusts supporting staff do add value.

Alex Crossley: There are something like 38,000 digital and data professionals in the NHS, roughly 3% of the workforce. The recent GDS review had similar figures. Is it accurate that the Palantir team is working with a very large number of colleagues to try to drive change in the system? Yes, it absolutely is.

Martin Wrigley: That wasn’t the question. It was working on the Palantir system, not working with. You are including all the people who work on the old systems that they are getting data from, and of course they are working with them, but it is working and understanding what the Palantir system itself is doing. This is the point about avoiding lock-in, which I think we are currently walking towards with a blindfold on.

Q181       Chair: Do you specifically have a view as to whether they are being locked into Palantir systems?

Dr Diwakar: First, the contract with the consortium led by Palantir is a seven-year contract. At the end of that period, we will have to make a decision about what we procure next. Secondly, Palantir does not hold other contracts with the NHS at the moment. If there are other use cases for research purposes and so on, we will go through a proper and robust procurement process.

Q182       Chair: Did you say that Palantir doesn’t hold any other contracts with the NHS apart from the federated database?

Dr Diwakar: I don’t think so. I will have to check the accuracy of that.

Chair: Can we check that? I understood it had contracts with individual trusts.

Dr Diwakar: I’m afraid I don’t know. As far as I know, at national level, it does not have any other contracts with us. There is always a risk of vendor lock-in in any procurement process. Of course, that would be one of the things that you would absolutely check. We would want to avoid vendor lock-in. We would want to make sure that our systems were robust and secure. It is a legitimate point and something that we are very aware of.

Alex Crossley: We are also trying to actively develop a marketplace within the FDP called the solutions exchange, which will enable third parties, be they NHS trusts or companies, to build on top of the platform and to use the canonical data model, the data schema that sits underneath it, so that we can bring additional players into that market.

Q183       Martin Wrigley: Why was that delayed? I understood that that was supposed to be part of the initial contract.

Alex Crossley: I will happily take that away and check, but I thought it was active and that we would have products available this year.

Chair: Okay, let’s have a look at that.

Q184       Danny Beales: I have two quick points. On the point about contracting, do you currently look at the exposure across Government, the reliance across Government, of your contractors, the competitive environment and the market share that they might have? Is diversifying the market share of data and digital a key consideration around contracting?

Secondly, on the single patient record, it is true that patients often talk about telling their story multiple times, but patients also say that sometimes they do not want elements of the health or care system to know personal details about them. How do you get the balance right? I worked in HIV before. People with HIV face discrimination within the health service. They often do not want their GP knowing their status, only their specialist. A general ward staff member might have found their paper records, and that might lead to incidents. Should the patient own their single patient record and how it is shared in the care system?

Dr Diwakar: In the public deliberation, patients absolutely supported that point. They did not want everybody who had access to the single patient record to be able to see anything. If you were going for a minor complaint to see a pharmacist, you would not need to see the same depth of record as a specialist looking after a very complex condition. That would be capability procedure-based access control that we would build into the system.[5]

Q185       Danny Beales: Patient-led, so they would be able to decide?

Dr Diwakar: Yes. We will co-produce the best methods. When we did the patient deliberation, they wanted to get the balance right about how often they were disturbed to give access. As I understand it, in India, for their equivalent, you get an alert every time somebody wants to access the record, and you have to use two-factor authentication to access it. We put that example to the patients we consulted, and they said, “No, it sounds like too much.” We just need to get the balance right between ease of use and security. We will work with the public so that we get the right balance.

Q186       Danny Beales: And on market competitiveness and exposure to contracts across Government?

Alex Crossley: Can I add something? There is an important point about clinical safety. Patient control of their data is one thing. Ownership in a situation like the one Vin has just described in India is a different thing. You would have to build a whole suite of safeguards to make sure that if I turned up unconscious at A&E the doctor who was treating me could access my records. It is quite a nuanced conversation.

Q187       Danny Beales: That is not possible now. Most trusts do not have access to community care records. At the moment, that does not happen. If you turn up at A&E, they can’t say, “You saw the mental health services in Northumberland, and that’s what they prescribed you.” That doesn’t work now. There is a risk for people with complex and personal health conditions. There is a view that doctor knows best and therefore doctor should always have access. That is not always what patients want.

Dr Diwakar: When we do the co-design for all of those questions, there will be questions that we will put to the public. We have a whole programme that will be funded and planned as part of that.

Alex Crossley: To your first question about vendor monopoly, we work very carefully with the Cabinet Office and with the Government Digital Service, including the Cabinet Office complex transactions team and others, to look at monopolies and how we work with some of our strategic suppliers. It is an area where we could do more. We have a very good relationship with GDS.

Q188       Danny Beales: Is their market exposure always assessed in contracting?

Alex Crossley: I couldn’t guarantee it is always assessed in contracting. Forgive me, but commercial is not my space. I can happily take away and find out.

Q189       Chair: I am pretty sure it is not, because I have asked questions about the prevalence of Amazon Web Services versus Microsoft Azure in public services, and I have not been able to get an answer for that. That is a good point, Danny, that we should perhaps follow up, because it relates to vendor lock-in, which the Committee has clearly shown is a key concern.

I don’t want to try your patience too much, but we have a quick question on digital inclusion, which has been raised by Danny’s point. You talk about patients being able to control or access their digital data. What provision is made to make sure that is inclusive?

Dr Diwakar: First, digital technologies can be more inclusive by their own regard. Screen readers can help you access information.

The second piece is that we work closely with local authorities and others. For the NHS app, we are working with the library services so that they provide training for individuals when they walk into a library as to how to use the app. We also have a number of app ambassadors who work out of GP surgeries and health centres with specific patients, and can show them how to use technology and how we can be more inclusive.

The third bit is that utilisation of the app is much greater in younger age groups. We know that use tails off gradually once you reach 60, and only 5.2% of the over-90 population log into it. One of the ways that we have addressed inclusion within that is we are currently piloting something called “Proxy”, which means that a trusted carer under the right safeguards can access your app and help you co-ordinate your care.

The other bit is that, if you can take individuals who are comfortable in using digital technology, it clears more space for those who have the greatest need and are not comfortable using technology to be seen face to face.

Amy Freeman: Where I work, deprivation is a significant barrier for some of our patients. Even if work nationally has been done around inclusivity, we do an equality assessment locally to say, “Do our local conditions change what the national picture is?” If they do, we respond to that. We work with the Good Things Foundation to enable those areas of deprivation to get access to SIM cards, smartphones and so on. Yes, there will be a national steer, but we would also—all organisations do this—do an equality assessment anyway to consider the local conditions.

Q190       Chair: Thank you, that is very helpful.

Thank you very much for your contributions. You will have noticed that the Committee is particularly concerned about vendor lock-in and about good procurement practice, based on the history of the NHS, which has made mistakes in the past. Ironically, we are about to have a statement on the Horizon IT system, which points to significant mistakes in vendor procurement made elsewhere.

Dr Diwakar, just as we finish, can you say to me that you are confident that, in the billions that are going to be spent as part of the 10-year NHS plan, with a focus on science and technology and digital transformation particularly, we are not going to make the mistakes of the past—or new mistakes?

Dr Diwakar: To answer the first bit of your question, none of us here is a commercial expert. Both the Government’s chief commercial officer and NHS England’s chief commercial officer are the right people to ask about that. In terms of lessons learned, we always take the various reports and the look-backs that have been done, to make sure that we learn from those. We red-team all our projects in advance, a bit like the military does. You get people in and say, “Can you really find a hole in this to make sure that we have really tested our practices?” We might not make mistakes in lessons learned from the past, but of course there will always be lessons learned for the future. We need a proper and robust system for detecting those and making sure that we can course-correct as we go.

Chair: Thank you very much for the contributions you have made. We appreciate your time today.