Report

by the Comptroller
and Auditor General

Department of Health

General Practice Extraction Service – Investigation

HC 265 Session 2015-16 2 July 2015

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office scrutinises public spending for Parliament and is independent of government. The Comptroller and Auditor General (C&AG), Sir Amyas Morse KCB, is an Officer of the House of Commons and leads the NAO, which employs some 810 people. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether departments and the bodies they fund have used their resources efficiently, effectively, and with economy. Our studies evaluate the value for money of public spending, nationally and locally. Our recommendations and reports on good practice help government improve public services, and our work led to audited savings of £1.15 billion in 2014.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 30 June 2015

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Sir Amyas Morse KCB
Comptroller and Auditor General
National Audit Office

29 June 2015

This investigation examines the General Practice Extraction Service, an IT system designed to extract data from GP computers. We investigate concerns about whether it can provide the public service intended.

Investigations

We conduct investigations to establish the underlying facts in circumstances where concerns have been raised with us, or in response to intelligence that we have gathered through our wider work.

© National Audit Office 2015

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.gsi.gov.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

10769 07/15 NAO

The National Audit Office study team consisted of:
Joanne Raby, Philip Wherry, Naz Jabeen and Michael Burke, under the direction of Colin Wilcox.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

This investigation

1 This investigation examines the General Practice Extraction Service (GPES), an IT system designed to extract data from GP practice computers. We focus on specific concerns that:

it cannot yet provide the service intended;

The NHS Information Centre signed off and paid for a contract to develop part of GPES despite the system being unfit for use; and

the costs of the system have increased, while its expected life has reduced.

2 We learned of this through our financial audit of the Health and Social Care Information Centre (HSCIC). The system was not working as expected and HSCIC had agreed to pay additional charges through a settlement with one of the main suppliers, Atos IT Services UK Ltd.

3 Most people interact with the NHS via their local general practice. However, the NHS’s ability to interrogate data held by GPs is limited when compared with hospitals’ ability. GPES would allow NHS organisations to extract comprehensive data across England. This would be used to monitor quality, plan and pay for health services and help medical research.

4 Work on the GPES project began in 2007, first by the NHS Information Centre, and then by the HSCIC. We have examined progress from then until now. On 31 March 2013, the NHS Information Centre closed and responsibility transferred to the new Health and Social Care Information Centre (HSCIC). The HSCIC combines the Department of Health’s informatics functions (previously known as NHS Connecting for Health or CFH) and the former NHS Information Centre.

5 We did not examine HSCIC’s methods or policy to govern using patient identifiable data that could be extracted via GPES, or the wider Care Data project. We have not assessed the value for money of the GPES project.

6 Our methods are in Appendix One.

Summary

1 The vision for the GPES project as a comprehensive source of data on general practice has not been achieved. The project is delayed and many customers have not received data. Mistakes in the original procurement and contract management contributed to losses of public funds, through asset write-offs and settlements with suppliers. The need for the service remains and further public expenditure is needed to improve GPES or replace it.

Procurement and system development

2 The GPES project has been significantly delayed. The original business case said the service would start in 2009-10, but it took until April 2014 for HSCIC to provide the first GPES data extract to a customer. Customers have developed alternative sources of data over this period and have begun to use these in its absence.

3 The NHS Information Centre (NHS IC) changed its procurement strategy and technical design for the GPES extraction systems during the project. This contributed to GPES being unable to provide the planned number and range of data extracts.

4 The NHS Information Centre (NHS IC) contracted with Atos to develop a tool to manage data extraction. In March 2013, the NHS IC accepted delivery of this system from Atos. The system transferred to the HSCIC from 1 April 2013, who found that it had fundamental design flaws and did not work. The system test did not reflect the complexity of a ‘real life’ data extract and was not comprehensive enough to identify these problems.

Cost of the GPES programme

5 The total expected cost of the GPES programme increased from £14 million to £40 million during planning and procurement. Further cost increases have been smaller, but the project has had at least £5.5 million of write-offs and delay costs. The value of the system to the HSCIC and its projected useful life has significantly reduced because of design and development failures.

Capability of GPES

6 GPES can extract data from all GP practices in England, unlike existing systems. However, only one customer, NHS England has so far received data from GPES. The time needed to design a new type of extract and restrictions in the contracts severely limits HSCIC’s ability to provide data to those who request it. It is unlikely that GPES in its current form can provide the NHS-wide service planned.

7 The HSCIC have recognised the failures highlighted and have already put in place a remediation plan which will replace those parts of GPES that do not work to provide a suitable data extraction service in the future.

Part One

Background

Using NHS data in England

1.1 Organisations within the NHS routinely collect data about patients and the care they receive. The main use for this data is for direct patient care; a record for medical professionals to refer to, when caring for their patient. Electronic health records and systems make it easier for professionals caring for a patient to share data. This means, for example, that a doctor providing out-of-hours care can access notes and prescription details from the patient’s GP practice.

1.2 As well as direct patient care, professionals use data for ‘secondary uses’. Quality data allows health professionals, commissioners, regulators and researchers to:

assess service quality and safety;

monitor trends in disease prevalence and treatment;

plan new services to improve care quality;

pay healthcare providers for services they provide; and

do medical research.

1.3 The Health and Social Care Act 2012 set up the Health and Social Care Information Centre (HSCIC) as an executive non-departmental public body in April 2013. The HSCIC collects, analyses, presents and publishes national health and social care data. It sets standards and guidelines in data collection, and publishes rules about how the NHS should look after and share personal confidential information.

1.4 The NHS collects data from ‘primary care’ and ‘secondary care’ sectors. Primary care includes general practice, dentists and optometrists. Secondary care is specialist medical services, often provided in hospitals.

1.5 For secondary care data in England, the Department of Health developed the Secondary Uses Service (SUS) to be a single, comprehensive source. It enables reporting and analyses to support the NHS in providing healthcare services.1 NHS providers and commissioners can use data for other purposes than direct care of a patient. For example, Hospital Episode Statistics (HES), a major part of SUS, includes details of all NHS admitted patient care, outpatient appointments and A&E attendances in England. Interrogating HES allows users to monitor trends and patterns in hospital activity, assess effective care provision, reveal health trends and inform patient choice.

1.6 In contrast to secondary care, data collection and analysis in primary care is fragmented, despite it forming some 90% of patient interaction.2 In general practice, there are four main suppliers of clinical IT systems:

Egton Medical Information Services (EMIS).

The Phoenix Partnership (TPP).

Microtest.

In Practice Systems (INPS).

Three of these use data from their clinical systems to provide databases for research or disease surveillance. These are QResearch, ResearchOne and THIN. There are also commercial (Apollo) and NHS-led (MIQUEST, CPRD, QMAS) extraction systems and databases. There are many ways to extract data, but no single one for all data or all practices.

Development and design of the General Practice Extraction Service

1.7 The NHS Information Centre (NHS IC) developed the idea for the General Practice Extraction Service (GPES) in 2007. GPES would be a central service, which the NHS IC managed, getting information from all GP practices in England, in a similar way to existing systems which can get data from hospitals. The Department of Health would approve sponsored customers to use the data to benefit patient care and support NHS work. Figure 1 shows expected customers and the potential benefits GPES could offer over existing systems.

1.8 NHS IC designed and ran the GPES project, but the Department oversaw it, through approving the business cases and funding. It contributed technical expertise in design and integration with other NHS systems.

1.9 The NHS IC’s business case stated that local NHS organisations should be able to use GPES as part of a second phase of development. This would allow GPES to replace the existing MIQUEST system. MIQUEST was developed over 22 years ago and requires manual intervention by staff in each practice from which data is extracted.

1.10 The main feature of the GPES design was to simultaneously extract data from major GP clinical systems in a single query. Figure 2 shows how it would work. Each GP clinical system supplier would build a tool to extract data from their system. A central query tool would send commands to extract data from each system and receive it back. GPES would be able to extract statistics about a group of people (such as those in a practice with a particular diagnosis) and individual ‘patient level’ data. The NHS IC would use the extracted data to do data matching and analysis and give the user the results.

1 See the HSCIC website: www.hscic.gov.uk/sus

2 See the HSCIC website: www.hscic.gov.uk/primary-care

Part Two

Procurement and system development

Summary

2.1 The GPES project has been significantly delayed. The original business case said the service would start in 2009-10, but it took until April 2014 for HSCIC to provide the first GPES data extract to a customer. Customers have developed alternative sources of data over this period and have begun to use these in its absence.

2.2 The NHS Information Centre (NHS IC) changed both procurement strategy and technical design part way through the project. This contributed to GPES being unable to provide the planned number and range of data extracts, as discussed in Part Four. The NHS IC and Atos found it difficult to agree all the detailed requirements for the GPES query tool. This delayed development and meant some elements of the system were never built, or never used.

2.3 In March 2013, the NHS IC accepted the system from Atos. The system transferred to the HSCIC from 1 April 2013, who found that it had fundamental design flaws and did not work. The system test did not reflect the complexity of a ‘real life’ data extract and was not comprehensive enough to identify these problems.

Facts

The GPES project has been significantly delayed

2.4 The NHS Information Centre started the GPES project in 2007 and by October 2008 had developed its first draft business case. The timetable in the business case expected the service to start late in 2009-10. However, progress was disrupted by several factors. These included uncertainties over Department funding, the Cabinet Office review of ICT projects after the 2010 general election, difficulties in recruiting skilled staff and delays in procuring the GPES extraction systems.

2.5 The NHS IC produced the final business case in late 2011 and the Department approved it. The NHS IC expected to complete the GPES system in September 2013, but HSCIC did not provide the first extract of data to a customer until April 2014 because of delays in completing the GPES query tool.

2.6 Figure 3 shows the overall procurement timetable for GPES, from early ‘market soundings’ in 2008 to the final settlement with Atos to complete the GPES query tool in 2014.

2.7 The delays affected potential take up of the service. Data from primary care is critical to many NHS organisations and they have used alternative data sources while waiting for GPES. For example:

Public Health England use data from the existing ‘QResearch’ and ‘ResearchOne’ databases to carry out surveillance on infectious diseases and vaccine uptake.

UK Biobank and the Medicines and Healthcare Products Regulatory Agency have approached GP system suppliers to develop data extraction methods.

2.8 GPES still has potential advantages over these alternatives. Chiefly, extracting many data types across England as described in Figure 1. These organisations may be interested in using GPES eventually. However, the scale of future use is limited by the capacity to develop new types of data extracts, as discussed in paragraph 4.4.

The NHS Information Centre changed the design and procurement strategy for the extraction systems part way through the project

2.9 In the 2008 outline business case, the NHS IC planned to use the existing ‘General Practice Systems of Choice’ (GPSOC) framework contracts to procure the GPES extraction systems. This framework contract is how the Department of Health funds the suppliers of GP clinical systems. It specifies the standards that systems must conform to. It is how the Department has required suppliers to allow the use of non-proprietary extraction systems such as MIQUEST.

2.10 The Department’s gateway team expressed concerns through their Gateway 3 Review in May 2010 that delays to procurement could delay the project to the point where it was no longer viable.3 They also mentioned having to build procedural and working relationships between the GPSOC team at NHS Connecting for Health and the GPES team in NHS IC.

2.11 NHS Connecting for Health did a technical review of GPES in early 2011, which recommended several significant changes to its design. In the original design, each GP system supplier would use a common ‘query language’ as part of their extraction system. This would allow the NHS IC to design a single extract centrally using the query tool, which all GP clinical systems could understand.

2.12 This technical review recommended an alternative where each supplier would be free to develop their own query methods. New queries would no longer be designed in the query tool using a common language, but would instead need to be designed as logical ‘business rules’ and sent to GP system suppliers to implement.

2.13 The NHS IC decided to abandon both the GPSOC contract approach and the common query language, as they could not agree either with the Department and GP system suppliers. They then procured the extraction systems by negotiating direct with the GP clinical system suppliers.

2.14 NHS IC’s using a non-competitive procurement approach, plus the changes in design, contributed to the restrictive process for designing new extracts. As described in our findings on capability in paragraphs 4.4 to 4.5.

2.15 The HSCIC, as successor to the NHS IC and NHS Connecting for Health, has continued to use the GPSOC framework to require data sharing between NHS systems. The new framework, effective from 2014, says that principal clinical system suppliers must provide an interface method for third-party systems to use. This would improve interoperability between systems in GP practices and the health community.4

The NHS Information Centre and Atos found it difficult to agree the requirements for the query system.

2.16 The NHS IC began procuring the GPES query tool in April 2009, using a fixed-price contractual model with ‘agile’ parts. The supplier and NHS IC would agree some of the detailed needs in workshops, after they signed the contract.

2.17 There was contemporary evidence in central government and the private sector that the NHS IC’s contractual approach, combining agile with a fixed price, was high risk. Our report Shared Services in the Research Councils reviewed how research councils had created a shared service centre, where a similarly structured IT contract failed.5 In the report, Fujitsu and the shared service centre told us that: “the fixed-rate contract awarded by the project proved to be unsuitable when the customers’ requirements were still unclear.” A similar failure was highlighted by the court case of De Beers vs. Atos Origin.

2.18 Several factors increased the risk: limited staff capacity at NHS IC, their reliance on contractors for development and procurement expertise and high turnover in their project team. Ten project managers were responsible for GPES during the period from September 2008 to September 2013.

2.19 Once the NHS IC and Atos had signed the query tool contract, they found it difficult to agree the detailed requirements. This delayed development, with Atos needing to start development work while some requirements had yet to be agreed. NHS IC and Atos agreed to remove some minor components. Others were built but never used by HSCIC, as discussed further in paragraph 3.5.

2.20 The Department’s Gateway 4 review (December 2012) reported that the difficulties with deciding requirements was possibly exacerbated by development being offshore. They raised concerns about the project management approach:

“The GPET-Q [query tool] delivery is being project managed using a traditional ‘waterfall’ methodology. Given the degree of bespoke development required and the difficulties with translation of requirements during the elaboration parts of R1, the Review Team considers that, with hindsight, it might have been beneficial to have adopted an Agile Project Management (PM) approach instead.”

The testing of the query system did not identify flaws in the design

2.21 The NHS IC accepted delivery of the GPES query system in March 2013, after system testing which the NHS IC developed.

2.22 This testing did not identify design flaws that meant it would be impossible to extract data from all GP practices. These problems were severe and required Atos and HSCIC technical staff to carry out remedial work, taking six months to complete.

2.23 The test was not comprehensive enough to identify these problems. To work in a ‘real life’ situation, the GPES query system needs to accurately communicate with the four separate extraction systems and other systems relying on its data, such as CQRS.6 The test NHS IC and Atos agreed was less complex. It did not examine extractions from multiple extraction systems at once. Nor the complete process of extracting and then passing GPES data to third-party systems.

2.24 The Department of Health, through its NICA (National Integration Centre and Assurance) unit advised the NHS IC to carry out more tests. They suggested testing whether GPES could extract data from more than one system at once and whether it could handle a number of different queries at once. The NHS IC did not take this advice and accepted the risk.

2.25 It is still not certain that all aspects of GPES work. The HSCIC’s plans for new extracts in 2015-16 indicate some areas of GPES that have yet to be tested on the live system. These include import functions and extracting patient-level data. Extracting patient-level data is a more complex procedure as opt-out markers for patients and practices should be considered.

3 Until 1 April 2015, the Department’s gateway team reviewed project and programme management across the departmental group and NHS. They were accredited by the Office of Government Commerce (and later the Major Projects Authority) to use the ‘OGC Gateway™’ process.

4 See the HSCIC website: http://systems.hscic.gov.uk/gpsoc/interface/assurance

5 Comptroller and Auditor General, Shared services in the Research Councils, Session 2010–2012, HC 1459, National Audit Office, October 2011.

6 CQRS is the Calculating Quality Reporting Service, operated by the HSCIC. Data from CQRS is used by NHS England to determine the payments due to GPs.

Part Three

Cost

Summary

3.1 The expected cost of the GPES programme increased from £14 million to £40 million during planning and procurement. Further cost increases have been smaller, but there have been at least £5.4 million of write-offs and delay costs throughout the project. The value of the system as an asset of the HSCIC and its projected useful life have significantly reduced because of design and development failures.

Facts

The NHS IC’s estimates of the cost of the GPES project increased significantly during the planning and procurement stage

3.2 Figure 4 shows how expected costs over the five-year appraisal period have changed. The NHS IC significantly increased their forecasts of the total cost through planning and procurement.

3.3 The NHS IC’s submission to the Cabinet Office ICT projects review in 2010 stated that original cost forecasts in the outline business case were underestimated. The NHS IC said this was because the NHS IC had no benchmarks or comparators to compare early estimates against. They revised the expected cost based on the results of the procurement, but expected to reduce this before the final business case.7

3.4 The projected cost nearly doubled from this submission to the final business case in 2011. The NHS IC said the increase was from greater NHS demands on GPES, from the Health and Social Care Bill – for example data to support outcomes frameworks.8 They also identified the changes to the design and procurement strategy discussed in Part 2 as explanations for the increase.

The HSCIC and NHS IC have incurred at least £5.5 million in costs of write-offs, additional settlements and through the impact of delays

3.5 The NHS IC began development work on GPES during the procurement in 2009-10. They wrote off £1.4 million of costs to develop the system specification in 2010-11 because of the changes to system requirements described in paragraph 2.11. The HSCIC is unlikely ever to use some parts of the query tool developed by Atos, tested and paid for, and have written off a further £842,000, as the estimated cost of developing these parts. After these write-offs, the value of the GPES asset is £12.9 million, in the 2014-15 HSCIC statutory accounts.

3.6 Between the expected start of the GPES service and the first live extraction in April 2014, the HSCIC and NHS IC had to pay system maintenance charges to the GP system suppliers. These costs totalled £1.4 million.

3.7 The HSCIC incurred a further £1.9 million of costs after April 2013 to pay Atos for remedial work to fix failures in the query system. These costs were not recovered from the supplier, as the NHS IC had tested and accepted the system (see paragraph 2.21).

7 Known as the ‘appointment business case’ (see figure 5).

8 Outcomes frameworks are made up of data indicators, such as smoking rates or disease mortality rates.These are used to assess the quality of health services.

Part Four

Capability

Summary

4.1 GPES can extract data from all GP practices in England, unlike existing systems. However, only one customer, NHS England, has so far received data from GPES.

4.2 The time needed to design a new type of extract, and restrictions in the GPES contracts, severely limits the HSCIC’s ability to provide data to those who request it. It is therefore unlikely that GPES in its current form will provide the NHS-wide service planned.

Facts

Only one customer has received data from GPES

4.3 Only one organisation highlighted as a potential customer in the final 2011 business case has received data so far and, even then, not all it wanted. Figure 5 shows whether the HSCIC has provided or plans to provide data to the customers previously described in Figure 1 and the business case.

Designing a new GPES extract is time consuming and requires significant manual intervention

4.4 The HSCIC cannot do the wide range and scale of data extracts the NHS requests, because of the design of the GPES system and restrictions in supplier contracts. Customers have requested over 100 different data extracts from GPES, but the HSCIC estimate they will be able to design only 24 new extracts in 2015-16.

4.5 Figure 6 shows a summary of the HSCIC’s process to develop a new extract, each of which the supplier designs and programmes from scratch. The HSCIC have limited flexibility to amend extracts once developed, for example to change a time period and the specific organisations it will extract data from.

4.6 The process depends upon manual input by specialist HSCIC staff, for example to develop the logic to send to suppliers. It is time consuming. New extracts take at least five months to develop. The HSCIC and their suppliers can develop several in parallel, but this still limits the GPES’ capacity.

4.7 The HSCIC plans to complete 24 types of extracts in 2015-16, 20 of which are for commissioning GP services by NHS England.9 The HSCIC and the Department jointly decide upon which proposals for extracts should be prioritised.

4.8 GPES cannot carry out extracts for local NHS organisations as planned. In their 2011 GPES business case, the NHS IC discounted the ‘do minimum’ option of using existing commercial and NHS extraction systems such as MIQUEST. This was partly because MIQUEST had not been maintained to be compatible with the new generation of GP clinical systems. However, the time (and therefore cost) to develop a new GPES extract means only national extracts are feasible. The NHS still uses MIQUEST.

4.9 Restrictions in contracts also limit GPES’ capacity, for example for the average size of data extracts. Therefore, some larger data extracts that customers request are only feasible if the HSCIC manually bypasses the GPES query tool.

There is unlikely to be a long-term future for GPES

4.10 GPES will continue to operate in the short term, as its data is critical for determining payments to GPs. Its coverage of all practices in England cannot currently be replicated by other primary care data extraction systems.

4.11 However, limited capacity and the difficulty of developing new extracts deters wider use. The HSCIC has acknowledged there is unlikely to be a long-term future for all or part of the GPES. However, they intend to reuse parts for a replacement system if possible. The HSCIC estimate that they will achieve less than two more years of use from the GPES in its current form, in contrast to the five-year minimum lifetime assumed for new IT systems.

9 Via the Quality Outcomes Framework and Enhanced Services programme.

Appendix One

Our investigative approach

Scope

1 We investigated three specific concerns:

The GPES system cannot provide the public service intended.

Costs of the system have increased, while its expected life has reduced.

The NHS Information Centre signed off and paid for a contract to develop part of GPES despite the system being unfit for use.

Methods

2 We drew on various sources of evidence:

We interviewed staff from the Health and Social Care Information Centre to understand the history and plans for the GPES programme including the:

GPES project director at the NHS Information Centre (2007–2013);

Programme head at the Health and Social Care Information Centre (2014 to date);

Head of procurement at the NHS Information Centre and subsequently the HSCIC; and

author of the Department of Health’s technical review of the GPES programme.

We interviewed staff from four organisations across the health sector highlighted as potential customers of GPES to find out about their experiences and their alternative methods of collecting primary care data.

We interviewed representatives from Atos, the supplier of the GPES query tool.

We reviewed documents about planning and contracting for the General Practice Extraction Service by the NHS Information Centre, including the business cases and contracts with suppliers.

We reviewed documents produced during third-party reviews of the GPES project. These included the Gateway Reviews by the Department of Health’s gateway team, the Cabinet Office ICT projects review and the Department of Health technical review.

We undertook online research, including reviewing:

Health and Social Care Information Centre publications, including requests for GPES extractions to the Independent Advisory Group. This group advises the HSCIC on whether data extracts from GPES that customers request are suitable; and

websites of health sector organisations providing or involved in processing primary care data.

Design and Production by NAO Communications
DP Ref: 10769-001