Corporate report

UKHSA Advisory Board: Technology Strategy Implementation

Updated 16 September 2024

Date: 17 September 2024

Sponsor and Presenter: Chris Coupland

1. Purpose of the paper

To share progress on the implementation of the Technology Strategy.

2. Recommendations

The Advisory Board is asked to comment on the approach and progress being made.

3. Background

The over-arching UKHSA Technology Strategy was developed in 2023 and shared at the September 2023 meeting of this Board. It is founded on 7 pillars and 25 underpinning building blocks, as reprised at Annex 1.

The Board requested a future update on progress towards the implementation of the Strategy and the next steps described. This narrative focuses on the former, while an update on the latter can be found at Annex 2.

4. Strategy implementation

Long-term goals – in the form of what success looks like in 2029 – have been defined, for each pillar of the Strategy and can be found at Annex 3.

In support of delivering these long-term goals, and by way of assurance that 2029 remains on target, various ‘waypoints’ have been set. Taking the form of specific outcomes, over a two-year horizon (currently covering both financial year (FY) 2024 to 2025 and FY 2025 to 2026), these will allow progress to be measured and adjustments to be made as necessary (a condensed version of which can be found at Annex 4). Once the current Spending Review (SR) outcome is known, these ‘waypoints’ will be extended, and then updated each year, once specific budget allocations have been agreed.

As previously highlighted, implementation is intended to be progressive, through individual planned strategic investments in Agency capability, as well as specific transformation initiatives and other interventions, including ‘Big Rocks’, ‘Safer Cyber’, ‘License-to-Operate’, and the implementation of the Government Digital and Data (GDAD, previously DDaT) Framework and associated good practice.

5. Implementation progress

The following highlights the good progress (and small number of disappointments), made over the past year, by pillar (noting that some examples inevitably contribute to multiple pillars). The various capabilities referenced collectively serve some 100,000 users today, a figure which is expected to rise to circa 300,000 in due course.

5.1 Prioritise cloud technologies

Big Rocks has implemented a new strategic cloud platform and assessed the UKHSA’s on-premise (that is non-cloud) estate. Work in FY 2023 to 2024 reduced the latter by some 13%, while a further 12% reduction is targeted in FY 2024 to 2025, through multiple migration waves. The separate genomics programme will deliver a production service in the cloud this year also.

5.2 Adopt a product-centric approach

Following on the success of the UKHSA Data Dashboard, introduced in FY 2023 to 2024, various other digital products are in development, including the National Poisons Information Service, enabling members to submit product information digitally, a new digital Pre-entry tuberculosis screening capability to protect our borders from a health perspective, and a prototype of the digital service for the Centre for Climate Health and Security, supporting its aspiration to be the trusted source of authoritative expertise for climate and health. The work to shape and deliver the new Surge Response Service is a further exemplar of modern product ways of working.

5.3 Leverage core platforms and drive convergence

The CareOBRA service for reporting threat outbreaks in care homes re-uses an open-source solution that was produced by another government agency, as well as UKHSA’s Salesforce platform. This has been rolled out across our regions, and is being integrated with other, new digital services, helping local health protection teams through automating the risk-assessment and earlier provision of advice. Separately, the new Case and Incident Management System, to assess and manage enquiries, cases and incidents for all health protection hazards across England has been successfully launched. This platform replaces the limited, legacy HPZone system, and will use Application Programmable Interfaces (APIs) to integrate with multiple other services and capabilities, driving re-use and much greater efficiency in data entry / operations.

5.4 Enable data sharing and exploitation

Big Rocks will deliver the API platform, in Minimum Viable Product form, by the end of 2024, enabling the use of APIs to cost-effectively, and flexibly, integrate services, and access data.

5.5 Embrace innovation

The new Electronic Notification of Infectious Diseases service removes the need for users to manually type responses into the UKHSA’s core Case and Incident Management System, by exposing an API to capture data and pass it to a Robotic Process Automation solution – providing a direct time saver for the HP Operations team, who previously spent large amounts of time re-keying data from forms and spreadsheets. And, we have recently concluded a digital ‘proof-of-value’ on the application of Generative Artificial Intelligence to scientific reviews – successfully demonstrating how the process of identification, selection and appraisal of relevant research evidence from the typically hundreds of full-text scientific papers used in providing public health advice and guidance, can be significantly accelerated.

5.6 Build an enduring digital, data and technology capability

Governance has been re-vamped, providing a much more robust challenge to requirements, solution and spend, ensuring compliance with Government Digital Service standards and actively promoting re-use; all attracting very positive feedback from the Department of Health and Social Care (DHSC) and Central Digital and Data Office (CDDO) colleagues involved. Separately, since the beginning of FY 2024 to 2025, some 50 (+40%) net new Technology colleagues have been recruited – helped by a wider implementation of Market Pay Supplements – filling critical gaps in capability across the spectrum and reducing the team’s reliance on contractors. The envisaged implementation of the Government Digital and Data Capability Framework fell victim to what has proved to be an extended process to achieve final approval of our business case by CDDO, exacerbated somewhat also by the General Election being called, pausing the process. The route to approval has now re-opened and we now hope that approval may be forthcoming by October, with implementation, including Trade Union engagement, commencing by the end of the calendar year. Notwithstanding this, key elements of the Technology Target Operating Model have also been introduced, although implementation was paused in response to the proposed move to subsume technology into Data, Analytics and Surveillance. Finally, effective partnerships have also been forged with new suppliers, both on the delivery side and to augment internal resources, where necessary.

5.7 Strive for operational excellence

Remaining COVID-19-specific services and associated duplicate infrastructure have now been either decommissioned or re-platformed, reducing operating costs, with further optimisation planned to be delivered in FY 2024 to 2025 as part of Big Rocks. The ‘FinOps’ capability currently being built out has already significantly improved our ability to manage and optimise cloud consumption costs. Work to introduce basic, industry-standard service management disciplines and remediate inherited, poorly implemented tooling should conclude this calendar year. And, effective, but one-off, initiatives to address unpatched infrastructure, will be replaced by a policy and plan to get on top of patching as a ‘business-as-usual’ activity.

As outlined above, Big Rocks continues to make a significant contribution towards implementing the strategy. Progress was, however, disappointingly impacted in Q1 by the need to off-board the external team and stop work, while awaiting first DHSC and then HM Treasury investment approvals for the FY 2024 to 2025 tranche of funds, finally received on 21 June 2024. Work planned this year, with £3.6million of spend committed so far, should result in technology operating cost savings of around £1.4million per annum, in addition to the inherent security, resilience and scalability benefits that all systems migrated to the cloud will also enjoy.

Similarly, the Safer Cyber and License-to-Operate programmes have both continued to mature the UKHSA’s capabilities and processes, although much more is urgently needed. Technology is working closely with Cyber to shape a more ambitious and integrated plan to address the former challenges, and to provide an effective response and plan to our latest understanding of the risk informed by the work to investigate the extent of ‘Shadow IT’ within UKHSA and a recently concluded assessment by the National Cyber Security Centre, to be published shortly.

6. Next steps

Once SCS consultations have concluded, and whatever resulting new organisation implemented, then an assessment of any consequences on the Technology Strategy and its delivery vehicles will be carried out. Subject to any resulting edits and the usual process, then it is envisaged that it would still be beneficial to publish it externally.

Further implementation will be heavily dependent on the outcomes of the SR, its funding for the ongoing programmes of work, and the subsequent internal distribution of budgets. Funding requirements will accordingly be reflected in the SR and business planning rounds.

Chris Coupland

Chief Technology Officer

September 2024

7. Annex 1: Technology Strategy (7 pillars and 25 underpinning building blocks)

Prioritise cloud technologies:

• adopt a cloud-first approach
• migrate legacy systems, wherever appropriate, transforming them, as necessary
• build a Cloud Centre of Excellence, including an effective ‘FinOps’ capability
• minimise any ongoing on-premise datacentre footprint (by exception only)

Adopt a product-centric approach:

• define enduring Products, mapped to the UKHSA’s remit
• implement a user-centred, agile approach, based on DevSecOps principles
• resource via long-lived, dedicated multidisciplinary teams (or leveraged model)
• ensure a composable build approach, utilising re-usable components
• focus on value and continual improvement, through lifecycle

Leverage core platforms to drive re-use:

• identify critical capabilities using the UKHSA’s Business Capability Model
• develop and maintain ‘blueprints’ for these capabilities and enterprise architecture domains
• converge underpinning technologies, deprecating or decommissioning, otherwise

Enable data sharing and exploitation:

• collaborate with DAS colleagues to implement the UKHSA’s Data Strategy
• implement an Application Programmable Integration (API) first approach to improve visibility, access to and the exchange of health data across systems and partners
• evolve the UKHSA’s infrastructure to support a unified data platform, as part of a wider data fabric architecture

Embrace innovation:

• foster an open, supportive, cross-discipline, learning and ‘outside-in’ culture
• focus on value, including opportunities for digitisation and automation, including the use of Artificial Intelligence (AI)
• leverage partners

Build an enduring Digital, Data and Technology capability:

• implement a unified operating model, based on a full-lifecycle, product-centric model, while also catering for the effective ongoing management of legacy
• develop and implement a compelling proposition to attract, develop and retain an effective, in-house Digital, Data and Technology workforce
• partner with industry and other organisations to obtain, and selectively build specialised capabilities, provide flex capacity (to enable scaling), and access best practice

Strive for operational excellence:

• instil a continuous improvement culture, where management and their teams are invested in business outcomes and empowered to implement change
• attribute product and platform costs fully and aim to be benchmark on cost, service, productivity, delivery and security
• embed an effective governance and assurance model
• promote a sustainable approach

8. Annex 2: next steps (from September 2023) and status

	Next Step	Status
a)	Finalise the more detailed Technology Strategy, incorporating feedback.	Complete. Feedback from colleagues across the Agency has been reviewed and incorporated, as appropriate.
b)	Review it with Corporate Comms., prior to publishing it formally.	Ongoing, Corporate Comms. input incorporated (as above), and engaged; publication subsequently paused, pending the Senior Civil Service restructure.
c)	Develop further sub-strategies for key capabilities and associated domains.	Ongoing. Integration strategy completed; Network and Platforms under development; Cloud expected by year-end.
d)	Continue to work with DHSC to secure investment approval to implement DDaT.	Ongoing. DHSC and Ministers approved UKHSA’s business case in December 2023; however, it subsequently stalled awaiting final approval by CDDO / Chief People Officer. Post-election this process has re-commenced, and from recent engagement it is hoped approval may be forthcoming sometime in the autumn.
e)	With DAS (Cyber), submit a joint proposal to ExCo to better understand ‘Shadow IT’.	Complete. Shadow IT work initiated and completed in March.
f)	With DAS, table a joint submission to the Advisory Board and / or Audit and Risk Committee on AI.	Complete. Tabled in November 2023, with a further update in January 2024.
g)	Table the milestones and metrics by which the Technology Strategy, ‘Big Rocks’ and related programmes, will be monitored and assured.	Complete. Technology Strategy milestones developed and outlined in summary in this paper (Annex 4). Big Rocks milestones and metrics developed and included as part of the refreshed FY 24/25 business case submission and rolling plan.
h)	Reflect the Technology Strategy in the FY24/25 business planning round.	Complete. The Strategy was reflected in Technology’s FY24/25 business planning submission, noting that key initiatives, such as Big Rocks, ultimately received a reduced allocation, and others, such as the network modernisation work, did not make the FY24/25 priority cut.

9. Annex 3: target state, 2029

	2029 Target state
1. Prioritise cloud technologies	Cloud-first architecture fully implemented. All services run from the cloud, unless by agreed exemption
2. Adopt a product centric approach	Operating model centred on agile delivery and product-centric approach
3. Leverage core platforms to drive re-use	Converged, efficient and mature self core UKHSA platforms
4. Enable data sharing and exploitation	UKHSA data widely, securely and efficiently accessed contributing to better health outcomes
5. Embrace innovation	Established innovation culture, recognised by colleagues as driving value in UKHSA and the wider health sector
6. Build an enduring Digital, Data and Technology capability	UKHSA attracting and retaining digital and technology professional providing a compelling career path
7. Strive for operational excellence	UKHSA meeting, or beating government digital/technology benchmarks for service, costs, delivery and standards

10. Annex 4: (selected) waypoints, 2024 to 2025 and 2025 to 2026

	End March 2025	End March 2026
1. Prioritise cloud technologies	25% of services in the cloud. Cloud-first governance in place	65% of services in the cloud
2. Adopt a product centric approach	Product-centric operating model defined, together with a route to implement it	Products defined with product owners. Agile delivery methods used consistently
3. Leverage core platforms to drive re-use	Path to platform convergence identified (laying out the associated choices, impacts and costs)	All Groups have a defined target architecture and digital capability roadmap
4. Enable data sharing and exploitation	Integration strategy defined and minimum viable product API platform implemented	All new capability using APIs as standard. Measurable increases in efficiency and degree, of access to our data
5. Embrace innovation	Methodology defined to measure the adoption of new technology and innovations	Discernibly increased level of innovation, gauged by ideas generated and implemented and colleagues’ involvement
6. Build an enduring Digital, Data and Technology capability	Government Digital and Data Capability Framework approved	GDAD Framework implemented. Defined sourcing and supplier management strategy
7. Strive for operational excellence	Operational excellence metrics defined and initial baseline against government benchmarks established	Agreed plan to lose gaps and underway. Continuous improvement culture the norm