Patient and Public Involvement in TRE Governance
Patient and public involvement (PPI) in Trusted Research Environment governance means giving patients and members of the public a formal, resourced role in deciding how a TRE is run: which uses of data are acceptable, who gets access, what counts as public benefit, and how the environment reports back to the people whose data it holds. Done well, it moves the public from being informed about decisions to shaping them, and it is now an expected part of how health data platforms earn and keep a social license to operate.
Why public involvement matters now
Trusted Research Environments (TREs), also called secure data environments, have become the default model for giving researchers access to sensitive health data in many countries. In the UK, the 2022 Goldacre Review, “Better, broader, safer: using health data for research and analysis,” recommended TREs as the route for health data analysis, and the Data Saves Lives strategy committed the NHS to secure data environments. The European Health Data Space regulation requires secondary use of health data to take place in secure processing environments. As TREs become national infrastructure, the question of who governs them becomes a public question.
Public attitudes research by organizations such as Understanding Patient Data has consistently found that people’s support for health data use depends on who is using it, for what purpose, and with what safeguards and transparency. Trust is conditional. It can be lost quickly. When approved researchers walked UK Biobank data out through a centralized platform’s normal workflow in May 2026, no policy was technically broken; the architecture allowed it. The public response showed that governance on paper is not enough. People want to know that the rules are shaped with them and that the technology actually enforces those rules.
What PPI in TRE governance covers
Setting the rules
Public contributors help define what uses are acceptable. This includes questions such as whether commercial access is permitted and on what terms, how public benefit is judged, and which categories of research need extra scrutiny. These decisions shape the access policy long before any individual application arrives.
Reviewing access requests
Many programs include lay members on a data access committee or an equivalent review panel. Lay reviewers bring a perspective that technical and academic members often miss, such as whether a project’s purpose would make sense to the people whose data it uses. Our guide to how modern data access committees work covers the committee model in detail.
Overseeing operations and incidents
Public involvement should not stop at the front door. Contributors can review audit summaries, incident reports, and changes to technical controls, and they can ask whether the environment works the way it claims to.
Communicating back
Transparency registers, plain-language project summaries, and published outputs let the wider public see what their data has been used for. Public contributors are often the best judges of whether those summaries are understandable.
The Federated TRE angle: governance the architecture can enforce
Public involvement creates commitments. A panel might decide that a class of research is off limits, that commercial users can see only aggregate results, or that no individual-level data may leave the environment. Those commitments are only as strong as the technology that enforces them. In a centralized model where data is copied into researcher workspaces and downloaded extracts, a panel’s decision governs the application form but not necessarily what happens to the data afterward.
A federated Trusted Research Environment gives public commitments a technical backbone, because data never leaves the source. Approved analyses run where the data is held, and only results that pass an automated airlock, which checks outputs for disclosure risk, are released. The ONS Five Safes framework (safe people, safe projects, safe settings, safe data, safe outputs) gives public contributors a vocabulary for asking the right questions, and a federated architecture lets the custodian answer “safe settings” and “safe outputs” with evidence rather than assurances.
This matters for the credibility of PPI itself. Public contributors who are asked to shape rules the platform cannot enforce will eventually stop trusting the process. Governance and architecture have to be designed together. For more on the framework, see what the Five Safes framework is.
Questions public contributors should be able to ask
A useful test of any TRE governance model is whether a lay panel can get straight answers to a short list of technical questions. Can any researcher download individual-level records, and if so, under what conditions? Who reviews outputs before they leave, and how many were blocked last year? Where is the data physically held, and does it ever move to another organization or country? What happens if an approved researcher tries to reconstruct identities from aggregate results? Who can see the audit logs, and how long are they kept?
In a centralized platform, several of these answers begin with “it depends” or “we rely on the researcher’s agreement.” In a federated TRE, most of them have a fixed architectural answer: records stay at the custodian, analysis runs inside the environment, every release passes the airlock, and every action is logged. That difference changes the nature of the conversation. Public contributors spend less time asking whether rules are followed and more time on the questions only they can answer well, such as which research is worth doing and how benefits should be shared.
Governance across many sites
Federation also raises a governance question of its own. When one analysis spans several custodians, each custodian keeps its own rules and its own public panel. A good federated model respects that: each node applies its local policy, and a study only proceeds where every participating custodian has approved it.
Levels of public involvement compared
| Level | What it looks like in a TRE | Public influence | Typical risk |
|---|---|---|---|
| Inform | Website, transparency register, published project list | None on decisions | Seen as public relations rather than accountability |
| Consult | Surveys, focus groups, citizens’ juries on specific questions | Advisory, one-off | Findings gathered but not acted on |
| Involve | Standing public advisory panel reviewing policy and reports | Ongoing advice that must be answered | Panel sidelined when decisions are urgent |
| Collaborate | Lay members with voting seats on access and governance committees | Shared decision making | Token membership without training or support |
| Co-produce | Public partners shaping the TRE’s policies, priorities, and evaluation from the start | Joint ownership | Requires sustained funding and time that programs underestimate |
Real-world examples
Several established UK programs show what embedded public involvement looks like. Genomics England, a Lifebit customer, has a Participant Panel made up of people taking part in its programs and their families, which advises on how participant data is used and on the organization’s policies. SAIL Databank in Wales runs a consumer panel of members of the public who contribute to reviewing data access and to how the resource is governed. HDR UK and Understanding Patient Data have both invested in public engagement on health data, including deliberative work on how data should be used for research.
The NIHR UK Standards for Public Involvement provide a common reference point. They set out six standards: inclusive opportunities, working together, support and learning, governance, communications, and impact. A TRE governance model can use these as a checklist for its own PPI arrangements.
A practical framework for PPI in TRE governance
- Decide where decisions are actually made. Map the TRE’s governance: access committee, policy board, security review, incident response. Put public contributors where influence is real, not only on advisory groups that meet after decisions are taken.
- Recruit for diversity, not convenience. Include people from communities whose data is held but who are less likely to volunteer, and people with lived experience of the conditions the data covers. Work with community organizations to reach them.
- Pay and support contributors. Pay public contributors for their time, cover expenses, and provide training on data governance, disclosure control, and the TRE’s technical model. Informed contributors ask better questions.
- Give contributors real information. Share audit summaries, output checking statistics, and incident reports, not just marketing material. A federated architecture with automated logs makes this far easier to produce.
- Close the loop. Record what public contributors recommended and what the TRE did in response, including when a recommendation was not adopted and why.
- Publish what the data is used for. Maintain a public register of approved projects with plain-language summaries and links to outputs.
- Evaluate involvement itself. Review annually whether PPI is changing decisions. If it is not, change the structure.
Common pitfalls and objections
“Lay members slow down access decisions”
Poorly designed involvement can add delay. Well-designed involvement moves public input upstream into policy, so routine applications that fit agreed rules can be approved quickly and lay reviewers focus on novel or contentious cases.
Tokenism
One public seat on a committee of fifteen, without training or support, gives the appearance of involvement without the substance. Contributors notice, and so does the wider public.
Treating PPI as communications
Publishing a list of projects is transparency, which is valuable, but it is not involvement. Involvement means the public can change what happens.
Rules the platform cannot enforce
If a panel agrees that no individual-level data should leave, but the platform allows downloads, the panel has been misled. Check that every governance commitment has a matching technical control. Our analysis of the end of SaaS Trusted Research Environments explains why architecture matters here.
What to do next
Start with an honest map of where decisions are made in your TRE and where the public currently has influence. Use the NIHR UK Standards for Public Involvement as a baseline, recruit and pay a diverse group of contributors, and give them the information they need to hold the environment to account. Then test every commitment they help shape against the architecture: if the rule cannot be enforced by the platform, fix the platform or change the rule.
Frequently asked questions
What is patient and public involvement in a TRE?
It is the formal inclusion of patients and members of the public in governing a Trusted Research Environment, including setting access policy, reviewing data access requests, overseeing operations, and shaping how the TRE reports what data is used for.
Is public involvement required for TREs?
Requirements vary by country and funder. In the UK, public involvement is widely expected for health data programs and is reflected in national guidance and funder standards such as the NIHR UK Standards for Public Involvement. It is increasingly treated as essential for public trust.
Should lay members sit on data access committees?
Many programs include lay members on access committees because they bring a perspective on public acceptability that other members may lack. They should be trained, supported, and paid, and given full voting rights where possible.
What is the difference between public engagement and public involvement?
Engagement shares information with the public and seeks views, for example through events or surveys. Involvement gives the public an active role in decisions, such as membership of governance boards or access committees.
How does a federated TRE support public involvement?
A federated TRE keeps data at the source and releases only outputs that pass an automated airlock. That lets governance commitments shaped with the public be enforced technically, and it produces audit evidence that public contributors can review.
How can a TRE show public contributors that it follows the rules?
By sharing audit summaries, output checking statistics, incident reports, and a public register of approved projects, and by recording how each public recommendation was acted on.