Exclusive: ‘Wobbly’ tracing app ‘failed’ clinical safety and cyber security tests

The app is being trialled on the Isle of Wight this week, ahead of a national rollout later this month. Senior NHS sources told HSJ it had thus far failed all of the tests required for inclusion in the app library, including cyber security, performance and clinical safety.

There are also concerns at high levels about how users’ privacy will be protected once they log that they have coronavirus symptoms, and become “traceable”, and how this information will be used.

Senior figures told HSJ that it had been hard to assess the app because the government was “going about it in a kind of a hamfisted way. They haven’t got clear versions, so it’s been impossible to get fixed code base from them for NHS Digital to test. They keep changing it all over the place”. 

HSJ’s source described the app as “a bit wobbly”, but added that it was not a “big disaster” the app will not be included in the official NHS store at this stage, because it is at an early development stage. However, they also expressed concern about whether it will be able to pass in the near future.

The NHS Apps Library showcases dozens of approved apps which are assessed against a range of NHS standards. Products are assessed against national standards, regulation and industry best practice before they are approved for the library. Developers are asked questions on areas such as clinical safety, data protection and security, depending on the complexity of the technology.

Once the Isle of Wight trial is complete, the app will be referred back to NHS Digital, which runs the app store, for further assessment. During the government’s daily covid-19 briefing yesterday, cabinet minister Michael Gove said it was hoped that more than half of the 80,000 households on the Isle of Wight would download the app.

The app will use Bluetooth technology to register a “contact” when people come within 6ft of each other for at least 15 minutes. If someone develops symptoms of coronavirus they inform the app and an alert will be sent to other people they have been in close contact with.

Concerns regarding the app’s privacy and information governance have been discussed nationally. Senior NHS sources have raised concerns that the app could risk public trust if privacy protection is overlooked, particularly when people using the app log themselves as having symptoms and therefore become traceable. 

A senior NHS national source told HSJ: “The real problem is the government initially started saying it was a ‘privacy-preserving highly anonymous app’, but it quite clearly isn’t going to be… When you use the app and you’re not [covid-19] positive in the early stages, you’re just exchanging signals between two machines… But the second you say, ‘actually I’m positive’, that has to go back up to the government server, where it starts to track you versus other people.”

A DHSC spokesman stressed there was not a plan for the app to track people’s location, for example with GPS, but to monitor who they have been near to, with Bluetooth.

The spokesman said: “The NHS covid-19 app has not failed any clinical assessments and NHS Digital has been clear it will go through the normal assessment and approval process following the Isle of Wight roll-out.

“Privacy and security has been paramount throughout the app’s development, and we have worked in partnership with the National Cyber Security Centre throughout. The app uses low-energy Bluetooth, not GPS, and therefore it does not track people’s locations or record their locations.”

A spokesman for NHSX said the National Data Guardian’s panel had been consulted on the plans and the data collected by the app would only be used for NHS care, evaluation and research. An independent assurance board involving experts in mobile apps, data governance and clinical safety has also been set up to monitor the production of the app.

An NHS Digital spokesman said apps were not normally assessed for the app store at this “beta” stage and that, although it had been asked to carry out assessments and approval processes already, further reviews would take place after the piloting.

The spokesman said: ”The NHS Apps Library doesn’t normally assess apps that are in private beta. Apps usually come through to us for assessment later in the process when they have been proven through pilots and some degree of operational use. The CCT App is currently being piloted, as widely reported in the media, and will doubtless evolve as a result of the lessons learned during piloting.

“We have been asked by NHSX to put the CCT App through all the normal assessments and approvals required prior to promoting an app to the NHS Apps Library. We’re at an early stage of this work and expect them to submit the app for full assessment when they reach public beta.”