Seòmar agus comataidhean

Obviously, the impact of the cyberattack is significant, and it will be felt throughout the organisation. I have questions about staff training and future workforce planning.

You all seem to be in quite good spirits this morning, but you might want to say a little about the impact of the attack on staff morale and how that has been managed since December 2020.

A stark statement in the report, at paragraph 45, is:

“The scale of delayed diagnosis and treatment and what this means for NHS services and patients is not yet known.”

To make progress on that, you recommend that

“a cohesive strategy is needed to better understand ... the wider health impact of Covid-19 ... on NHS services and inform future service provision.”

Do you know whether the Scottish Government has any plans to develop such a strategy?

That is reassuring—thank you.

Do you have any way of assessing or measuring how many patients might have chosen to self-fund their treatment in the independent sector during the pandemic? I asked NHS Lothian that question last week. Is there any way of capturing that detail, other than by looking at what happens when a patient’s appointment comes up or seeing whether they have elected to drop off the waiting list?

The issue of general practitioner appointments—face-to-face appointments and appointments through NHS Near Me—has featured significantly in the news. The report highlights that data is not yet available on the number of GP appointments that have been carried out. That means that it is difficult to determine the true number of people who have avoided seeing their GP during the pandemic and who might therefore, in effect, be storing up health problems that could become more extreme later. Do you know why that data is not available? Should the Scottish Government be doing more to gather and disseminate it?

Good morning, Mr Boyle. As we know, the diagnosis and treatment backlog has got significantly worse because of Covid, but, in many respects, Covid is not its principal cause. Although NHS boards around Scotland are trying to tackle the backlog, it is, as you say in the report, still significant. Are you aware of any health boards in Scotland that are making good progress in that area? Conversely, are there any boards that you are concerned about with regard to the pace of tackling the backlog?

Ms Johnston, as you said, the report includes a recommendation to publish data on waiting times based on the categories in the clinical prioritisation framework, and that is being progressed by Public Health Scotland and NHS boards. What role is the Scottish Government playing in implementing that recommendation? If the information has not yet been published, what more should be done to get that data out there?

As a result of the SBRC review, there was quite high awareness of and training in cybersecurity—95 per cent of staff underwent cybersecurity training in 2020. Since the attack, how have you approached the issue in order to raise awareness and develop skills among staff in relation to emerging and future risks to cybersecurity?

I will put this question to both David Pirie and Helen Nisbet for SEPA’s and the Scottish Government’s perspectives. Earlier, Helen described the situation as a game of cat and mouse, and cybersecurity is getting increasingly sophisticated. What impact is that having on workforce planning to ensure that public bodies—SEPA and the wider public sector—have the skills that they need to make sure that they can not only recover from this attack, in the case of SEPA, but safeguard against future attacks?

I will turn now, in some detail, to governance and oversight. I accept that you were not in post in 2017 when the Scottish Government established the Enterprise and Skills Strategic Board. The view of the Auditor General is that

“The ESSB lacks the authority to hold the skills agencies to account”.

In 2020 the Scottish Government proposed a new skills alignment assurance group to replace the governance arrangements. In 2021 the Scottish Government wound up the SAAG. Here, in 2022, we have the shared outcomes assurance group. It strikes me that we have more groups than Eurovision and more directors than Hollywood, but this document might now be the one that works.

Looking back at that history, could you say what issues affected governance and what steps the Government is taking? Is the document the one that will get us to the point at which there will be sufficient assurance that appropriate governance and oversight arrangements are in place?