Oversight Committee report into data security at UK Biobank published

The governance and reporting of such incidents within UK Biobank have been reviewed. The internal protocols themselves have worked reasonably well but need to go further and faster.

Action: A standing committee of the Board has been established so that appropriate risks/incidents can be brought to their attention as soon as possible and within 24 hours of an incident first being recognised and then prioritised and escalated to the Board as necessary.

It has taken too long to contact the participants.

Action: UK Biobank will seek to obtain the contact details for all its participants and procure an email service and postal service which can email/hard-copy mail all participants on the same day and be on permanent standby.

Although this was not a factor in the Incident, a number of healthcare organisations have experienced external hacking and other cyber threats from State, quasi-State and non-State actors. The security of UK Biobank’s data storage, use and infrastructure needs to be reviewed and, if necessary, further strengthened (and demonstrated to be properly robust).

Action: An external security review of UK Biobank’s systems and data management will be commissioned immediately.

To evaluate the access policy and procedures. Establish where there is reliance on functionality, reporting, policy or legal compliance. Review the legal framework in which UK Biobank operates and the oversight of applications. Review the use of more extensive sanctions on researchers.

Action: Commence forthwith an end-to-end review, with such external assistance as may be required, of the access procedures and related controls, including the effectiveness of any monitoring controls.

To continually assess and review access, security protocols, and the effectiveness of monitoring in order to identify and mitigate examples of researcher or third-party misuse or revealing the existence of UK Biobank data in public-facing on-line environments. This will need significant input and advice from the external security consultants to establish a state-of-the-art capability.

Action: Set up a robust proactive capability, which will include the establishment of a dedicated security team within UK Biobank.

It is necessary to remove – as far as possible – downloaded datasets in the possession of researchers. This will require confirmation, and audit thereof (which is allowed by the terms of the Material Transfer Agreement), of the deletion of the downloaded data from completed or terminated projects. The latter will involve incentives to move all research projects onto the UK Biobank Research Analysis Platform.

Action: Operate protocols for removing these data rapidly with a risk-based audit of the results.

This requires the prevention of any future downloads of participant-level de-identified data from the UK Biobank Research Analysis Platform. The Department of Health and Social Care (DHSC) are soon due to set out guidelines for a Secure Data Environment (SDE) and the UK Biobank Research Analysis Platform will need to meet these requirements when they become available.

Action: Immediate evaluation and implementation of the functionality needed for the planned manual data airlock, in conjunction with a review of the specification for the automated data airlock (which should also include, as soon as available, controls over data ingress ability). Ensure the UK Biobank Research Analysis Platform meets SDE relevant requirements when these are known.

Although this topic is widely covered in scientific journals, there is a lack of hard evidence and probabilistic rigour, and a wide variety of measures used for assessing and measuring risk.

Action: This issue impacts on all research projects involving consented participant and/or patient data and it is proposed to set up a collaborative review – in conjunction with other research resources – to commission external research into the risk of re-identification and the measures that can deployed to reduce the risk (such as generalisation, differential privacy, randomisation and use of homomorphic encryption). This will need to take into account both current and prospective technology (particularly in the context of next generation AI models).

This Incident should prompt the Board to review its appetite for risk, focusing in the short term on data exposure or loss.

Action: The Audit and Risk Committee shall refresh the strategic risk description and examine what new controls are needed to give the Board the assurance that the risks are within (or will become within) the proscribed appetite reviewed and agreed by the Board.