NHS software supplier DXS International has disclosed a cyber attack on its internal systems.

The company provides clinical support solutions for clinical commissioning groups, doctors, nurses and pharmacists as part of their workflow and during patient consultations.

Its products integrate with core NHS systems, and in some cases are hosted on the NHS’ Health and Social Care Network (HSCN).

The company says it supports around 10% of all NHS referrals in England. Its ExpertCare solution, for example, helps clinicians quickly understand prescription needs for cardiovascular diseases, and is used by around 2,000 GPs, overseeing the care of around 17 million patients.

In a filing with the London Stock Exchange, DXS International said it had discovered a security incident affecting its office servers in the early hours of Sunday, 14 December.

"Once discovered, the data security breach was immediately contained by means of a joint effort by DXS’s internal IT security teams in close cooperation with NHS England," said the firm.

"The Board has appointed an external cyber security specialist agency whose thorough investigations are underway to establish the nature and extent of the incident."

The company said there's been "minimal" impact on its services, with front-line clinical services unaffected and operational.

DXS has notified the relevant regulators, authorities, and law enforcement agencies, including the Information Commissioner's Office (ICO), and is fully cooperating with their investigations. It's also working with various NHS bodies

“We, along with the National Cyber Security Centre and law enforcement partners, are working with an NHS supplier who is investigating a cyber incident," an NHS England spokesperson told ITPro. “We are not aware of any patient services being impacted.”

DXS International the latest NHS supplier hit

Attacks on NHS suppliers are becoming increasingly common, with threat actors viewing third-party providers as a potentially lucrative source of data.

Earlier this year, Birmingham-based software provider Advanced Computer Software Group was handed a £3 million fine by the Information Commissioner's Office (ICO) for security failings that led to a ransomware attack on the NHS.

In another example, thousands of procedures were canceled at London hospitals after an attack on blood testing company Synnovis. The attack was claimed by Russian-speaking ransomware group Qilin.

Last month, the government proposed new laws to strengthen cybersecurity in public services, including the NHS.

Medium and large companies providing services like IT management, IT help desk support, and cybersecurity will be regulated for the first time, required to report incidents promptly, and implement more robust recovery plans.

As a result, critical suppliers such as those providing healthcare diagnostics to the NHS will have to meet tighter security requirements, and enforcement will be toughened up.

"The reforms will make fundamental updates to our approach to addressing the greatest risks and harms, such as new powers to designate critical suppliers," said national chief information security officer for health and care at the Department of Health and Social Care, Phil Huggins.

"Working with the healthcare sector, we can drive a step change in cyber maturity and help keep services available, protect data, and maintain trust in our systems in the face of an evolving threat landscape."

FOLLOW US ON SOCIAL MEDIA

Maintaining medical records for tens of millions of people in the UK has become a colossal administrative challenge for the NHS. A recent trial of Microsoft’s AI-driven healthcare tool Dragon Copilot has improved efficiency and enhanced the doctor-patient relationship.

One of the essential responsibilities for clinicians (healthcare professionals, such as a doctor or nurse, who provide direct patient care) is accurate record-taking. This adds a substantial administrative burden to each consultation and takes up a considerable amount of time.

The NHS has been undergoing a period of fundamental change, following the rollout of the electronic patient records system, a digital tool that brings together all of a patient’s medical information into a single, unified platform.

A small group of clinicians at Manchester University NHS Foundation Trust were invited to be the first in the UK to try Dragon Copilot. Part of a private trial, the aim was to assess the impact the technology could have on efficiency.

The Dragon Copilot operates by transcribing notes based on the conversation, together with commentary provided by the clinician during an examination. Previously, note-taking was undertaken by the clinicians themselves, either during or following a consultation.

By connecting a microphone to the system and processing the incoming audio through Microsoft Dragon, the system was able to generate patient consultation summaries based on the recording.

“We've been live for a couple of weeks, so it's early days, but having it running in the workflow and populating into our clinic notes is making a fairly substantial difference,” says Peter-Marc Fortune, paediatric intensive care physician and chief medical information officer with Manchester University NHS Foundation Trust.

During the development process, recordings will remain available for a short period of time so that any issues can be fully explored. Once the production version is deployed, the intention is not to store the audio recordings.

Lost in translation

In general, audio transcriptions are rarely completely accurate. In the trial, this was especially the case for complex and technical terms, which the system was unfamiliar with. It would then tend to use the closest-sounding word in its dictionary. As such, a human review of the generated summary and treatment plan still needs to be undertaken in order to ensure accuracy.

“Whilst it's remarkably good, we have seen some extraordinary things occasionally on it – more so when we first went live, than we're seeing now,” says Fortune.

“Every now and again, it picks up something unexpected, usually around the technical language, where it misinterprets a complex medical word and uses one that sounds fairly similar but is completely different. The necessity to ensure that you read it is something that we need to embed with our clinicians.”

Early in the trial, notes needed to be copied across into patient records. However, an embedded version of Dragon Copilot was released, which was able to automatically populate the patient’s notes once the consultation was complete.

“The greatest challenge was NHS network infrastructure, and particularly Wi-Fi. One of the things that we're in heavy discussions about is the product being optimised,” says Fortune. “We're quite keen to explore a good old-fashioned USB microphone approach, where we've not got to involve Wi-Fi infrastructure.”

As Dragon Copilot was developed in America, much of its structure and formatting was designed with the American healthcare system in mind. One example of this was the date formatting system, which had to be changed from America’s month-date-year format to the UK’s date-month-year. There are also differences in how patient summaries are structured, which need to be updated to suit the NHS’s template.

Greater engagement

Although patient feedback was limited, one of the key improvements that was found in the Dragon Copilot trial was that patient engagement was much improved.

Instead of the doctor having to type their observations as the patient is talking to them, the doctor was able to rely on Dragon Copilot to record the consultation and thereby focus more of their attention on the patient. It was particularly noted that the older patients preferred this approach, as it felt more like the ‘traditional’ doctor’s consultation patients experienced in the past.

The initial trial was akin to a toe-in-the-water, but future trials of the Dragon Copilot will focus on the administration aspect and on obtaining more detailed feedback from patients.

The next stage of the trial will be expanding the functionality of Dragon Copilot so that it incorporates more smart links within the Epic electronic health record system to pull specific patient information directly into documentation. For example, it could automatically generate orders for prescriptions and examinations (such as X-rays), thereby improving efficiency and reducing the administrative burden on clinicians even further.

Yesterday's government spending review included a major investment in NHS technology, as part of a record £29 billion funding boost for the health service.

Rachel Reeves announced plans to spend up to £10 billion on technology and digital transformation in the NHS by 2028‑29 - up almost 50% on today's figure.

Overall, the government said, funding provided through the review will enable the NHS to deliver productivity growth of 2% each year, unlocking £17 billion in savings over three years.

All of these savings, it noted, will be reinvested back into the NHS to improve patient care.

"There’s no strong economy without a strong NHS," Reeves told the House of Commons. "We are investing £10 billion to bring our analogue health system into the digital age, including through the NHS app, so patients can manage their prescriptions, get their test results, and book appointments all in one place."

Cash will also go to the development of the single patient record, giving patients a unified view of their medical history and enabling two-way communication and active management of their healthcare, along with the continued adoption of the Federated Data Platform.

With the NHS notoriously reliant on legacy technology, the move has been welcomed by tech experts as a positive move toward driving productivity.

"You can’t build a digital NHS on analogue infrastructure. The government knows this and understands it will only be able to drive long-term efficiency in the NHS through investments in technology to modernize healthcare," said Flann Horgan, head of the healthcare sector at NTT Data UK & Ireland.

"The ten-year plan for the NHS sets out a clear direction for this: move from analogue to digital, modernize infrastructure, and harness technology to deliver better care at lower cost. To get a return on the investment announced today, the government is looking to make digital the default across the NHS and not the exception."

NHS AI approach requires caution

The government is keen to exploit AI to improve efficiency across the board - and the NHS is no exception. However, the government needs to act with caution, warned Hogan.

"To get a return on the investment announced today, the government is looking to make digital the default across the NHS and not the exception. AI will be key to this, but it won’t be an easy feat to scale across the NHS without tackling siloed data and outdated systems," he said.

"At The Royal Marsden, we’ve seen this at work: AI tools being deployed to help radiologists diagnose and monitor cancer progression with greater accuracy and speed. This can be delivered, within real-world NHS constraints – when the right technical and clinical foundations are in place. Without these, AI risks becoming just another layer of complexity rather than a tool that genuinely improves care."

In last year’s Autumn Budget, Reeves pledged to invest more than £2 billion in NHS technology and digital initiatives.

However, there are questions over whether the money will be enough. Last month, research published by the Health Foundation charity concluded that digitizing NHS and adult social care services across the UK would require around £21 billion over the next five years.

MORE FROM ITPRO

• How is AI improving healthcare?
• NHS England launches cyber charter to shore up vendor security practices
• US healthcare data breaches are out of control

Two NHS trusts have suffered cyber attacks which exposed staff data, prompting fresh calls for more robust supply chain security practices.

University College London Hospitals (UCLH) NHS Foundation Trust and University Hospital Southampton NHS Foundation Trust were targeted in an attack which exploited a flaw in Ivanti Endpoint Manager Mobile (EPMM) - a tool used to manage employee mobile devices.

The flaw was discovered on May 15th, and has since been patched by Ivanti.

UCLH said it was investigating with the help of cybersecurity experts at NHS England, but said it had 'no evidence' that patient data was accessed.

"The UCLH system which was compromised contained data about staff mobile devices such as the mobile number and the IMEI number (a unique code to identify the phone on the mobile network)," it said in a statement. "It did not contain passwords or patient data."

According to reports from Sky News, which first revealed the incident, analysts at security firm EclecticIQ have identified other victims, including agencies and businesses across Scandinavia, the UK, the US, Germany, Ireland, South Korea, and Japan.

The attacks originated from a China-based IP address, although there's been no definite attribution.

NHS cyber attacks continue

The NHS has repeatedly fallen victim to hackers over the last couple of years.

In June 2024, for example, thousands of procedures at London hospitals were cancelled following a cyber attack on blood testing company Synnovis, claimed by the Russian-speaking ransomware group Qilin.

Similarly, last November Wirral University Teaching Hospital Trust in Merseyside was hit by a major cybersecurity incident that led to appointments being cancelled.

This latest attack highlights the risks of poor vendor security management within the NHS, according to Dray Agha, senior manager of security operations at Huntress.

"The breach reportedly stemmed from a recently discovered exploit in third-party software. This is a stark reminder that healthcare security isn't solely about the NHS trusts' own systems," said Agha.

"Robust vendor risk management, continuous vulnerability patching across the entire digital supply chain, and swift incident response coordination with suppliers are absolutely critical defences."

The NHS is all too aware of the problems it faces with regard to cyber threats, and recently launched a new cybersecurity charter aimed at strengthening vendor security practices.

Suppliers will be asked to adhere to eight core principles, including staying up to date with the latest patches, applying multi-factor authentication (MFA) on their networks and systems, keeping 'immutable' backups of all critical business data and conducting round-the-clock threat monitoring.

MORE FROM ITPRO

• Criminal records, financial data exposed in cyber attack on Legal Aid Agency
• Why DragonForce is growing in prominence
• The UK’s science funding agency is being bombarded with cyber attacks

NHS England is calling on suppliers to sign up to a new cybersecurity charter, asking them to implement measures aimed at countering 'endemic' ransomware threats.

In a letter to suppliers, it warned that incidents are often very severe and are becoming increasingly frequent. To address the issue, the health service is asking them to make eight security commitments.

"The complexity of cybersecurity and the NHS's supply chain alongside the endemic criminal cyber threat faced by the UK make partnership crucial. Collaboration through our supply chain is crucial, and we must work together to protect healthcare and defend as one," wrote Mike Fell, NHS director of cyber, in a post on LinkedIn.

"Today we are setting out our expectations, abstract of contractual terms, of the key things required to help harden our systems and protect delivery of care."

Suppliers signing the charter should make sure their systems are properly supported and have the latest patches applied to deal with known vulnerabilities. They should achieve and maintain at least 'Standards Met' as part of the Data Security and Protection Toolkit (DSPT).

They're also asked to use multi-factor authentication (MFA) on their own networks and systems, and to support identity federation or make MFA functionality available on the products they provide.

Infrastructure improvements are a key focus of the charter, with the health service asking suppliers to deploy effective 24/7 cyber monitoring techniques and log their critical IT infrastructure.

A key aim here is to ensure suppliers are better equipped to prevent and detect cyber attacks, and make incidents easier to investigate.

Backups and software security in the spotlight

The importance of backups were highlighted in particular, with the charter calling on organizations to keep immutable backups of critical business data.

Suppliers should also plan for business continuity and rapid recovery of essential IT systems in the event of a breach or incident.

Similarly, suppliers should carry out board-level exercises to make sure they're confident in their ability to respond in the event of a cyber attack.

If an incident occurs, they must report promptly to their clients, working with NHS England and adhering to all regulatory requirements.

Finally, software suppliers to the NHS must make sure that the software has been produced in adherence to the software code of practice from the Department for Science, Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC).

The charter requires them to adhere to the principles of secure design and development, secure build environment, secure deployment and maintenance, and communication with customers.

Closer collaboration

NHS England said it will do what it can to help its supply chain comply, developing tools to help providers identify their critical suppliers to carry out appropriate assurance, defining requirements for a national supplier management platform, and developing a risk assurance model.

It will also review its contractual frameworks to include appropriate security schedules and make expectations clear.

This will include the launch of a self-assessment form later this year, giving time for suppliers to work through the eight statements and be ready to commit. It's also planning a series of webinars over the coming months, with a supplier forum for cybersecurity scheduled for the autumn.

The charter follows a series of high profile supply chain attacks. Last summer, for example, a Russian-speaking ransomware group attacked blood testing company Synnovis.

The attack on Synnovis disrupted services at NHS King's College and Guy's and St. Thomas'.

Later this year, the Cyber Security and Resilience Bill will come into force, tightening supply chain security within essential services, infrastructure and digital services, including the NHS.

MORE FROM ITPRO

• US healthcare data breaches are out of control
• Healthcare systems are rife with exploits — and ransomware gangs have noticed
• Healthcare organizations need to shake up email security practices

A Birmingham-based software provider has been handed a £3 million fine for security failings that led to a ransomware attack on the NHS.

The Information Commissioner's Office (ICO) said Advanced Computer Software Group failed to use appropriate security measures before the 2022 attack, which put the personal information of tens of thousands of NHS patients at risk. 

Advanced provided the NHS with a range of patient management and health-related products, including Adastra, Caresys, Carenotes, Odyssey, Crosscare, Staffplan, and eFinancials.

But there were gaps in its use of multi-factor authentication (MFA), a lack of comprehensive vulnerability scanning, and inadequate patch management, according to the data protection watchdog.

"The security measures of Advanced’s subsidiary fell seriously short of what we would expect from an organisation processing such a large volume of sensitive information," said information commissioner John Edwards.

"While Advanced had installed multi-factor authentication across many of its systems, the lack of complete coverage meant hackers could gain access, putting thousands of people’s sensitive personal information at risk."  

The hackers, believed to be the LockBit ransomware group, accessed certain systems of Advanced’s health and care subsidiary via a customer account that lacked MFA.

Personal information belonging to 79,404 people was taken in the attack, including details of how to gain entry into the properties of 890 people who were receiving care at home.

Emergency prescription services, ambulance dispatching systems, and the non-emergency 111 phone line were affected, with some healthcare staff unable to access patient records.

"People should never have to think twice about whether their medical records are in safe hands," said Edwards.

"To use services with confidence, they must be able to trust that every organisation coming into contact with their personal information – whether that’s using it, sharing it or storing it on behalf of others – is meeting its legal obligations to protect it."

The fine forms part of a voluntary settlement. And while very large, it's less than Advanced might have been facing - the ICO warned last summer in its provisional findings that it planned to hit the company with a £6.09 million penalty.

What's changed since then is the company's proactive engagement with the National Cyber Security Centre (NCSC), the National Crime Agency (NCA) and the NHS, and the steps it's taken to mitigate the risk to those impacted by the attack. 

However, the ICO said the fine sends a salutary message to other organizations that may be a bit slapdash about the security of personal data.

"With cyber incidents increasing across all sectors, my decision today is a stark reminder that organisations risk becoming the next target without robust security measures in place," said Edwards.

"I urge all organisations to ensure that every external connection is secured with MFA today to protect the public and their personal information - there is no excuse for leaving any part of your system vulnerable." 

MORE FROM ITPRO

• More than 300,000 US healthcare patients impacted in suspected Rhysida cyber attacks
• Cyber attacks on healthcare organizations are surging
• Healthcare organizations need to shake up email security practices

An NHS hospital has admitted its cancer treatment wait times increased in the wake of a cyber attack that took down its systems at the end of last year — and it will take many months to recover.

Last November, NHS hospitals and health centers that make up Wirral University Teaching Hospital Trust in Merseyside were hit by a major cybersecurity incident, with appointments cancelled and patients at some locations told to only attend A&E if necessary.

The incident was still ongoing weeks later, according to an update on 5 December.

Because the hackers accessed systems via an online portal for appointments, the hospitals had to switch to paper-based operations.

In a report referencing the incident, the trust admitted all outpatient appointments were cancelled from 25 November when the attack began until 4 December, when services were reinstated

"The trust has been in a strong position with improving waiting times for elective, diagnostic and cancer pathways but this performance has been significantly impacted by the cyber attack that was experienced late November and into early December," noted the report.

The human impact of cyber attacks

The report noted that cancer diagnosis and treatment performance for October and November was positive. However, that fell in December, in part due to seasonal reduced capacity but also because of the impact of the cyber attack — and that would take months to catch up.

"The cyber incident was seen to impact elective performance both in terms of the loss of activity that would have provided treatment / diagnostic and stopped waiting times for patients, and on the ability to validate the waiting times position. Performance across RTT, cancer and diagnostics was affected,” the report added.

Despite the admitted delays to care, a Wirral University Teaching Hospital Trust spokesperson told DigitalHealth that staff had managed to maintain some services by implementing business continuity plans.

“Recovery plans were implemented immediately to proactively recover any lost activity, ensuring patients affected by the disruption are prioritized," the spokesperson told the publication.

"Our teams are focused on restoring performance across elective, diagnostic, and cancer pathways as quickly as possible, and we have already made significant progress."

Healthcare attacks are a growing problem

Research shows the healthcare sector is a major target for hackers, with organizations operating in the sector attacked four times as frequently as the global average for all industries.

Indeed, the Merseyside attack is one of a long line of cyber incidents to impact British hospitals. Last year, NHS Dumfries and Galloway was hit by a data breach, while King's College Hospital Foundation Trust and Guy's and St Thomas' Hospitals Foundation Trust in London had to reduce operations after a cyber attack on provider Synnovis.

This incident led to at least two cases of severe patient harm, according to reports.

Trevor Dearing, director of critical infrastructure at Illumio, said at the time of the Merseyside incident in November that hospitals would continue to be targets, and needed to find ways to keep providing care to patients even when under attack.

"Cyber attacks aren’t going away, but hospitals must reach a point where patient care — urgent or routine — remains uninterrupted," he said.

MORE FROM ITPRO

• Why healthcare firms are a lucrative target for hackers
• Five ways threat actors target healthcare companies
• 190 million US citizens were impacted in the Change Healthcare breach

Alder Hey Children’s Hospital Trust has confirmed it has suffered a data breach after sensitive information including medical records was published on the dark web and shared on social media.

The trust updated its previous statements to confirm that it suffered a single cyber incident where threat actors were able to gain unlawful access to sensitive data through a digital gateway service.

The trust said the exposure has impacted patients from three facilities in the Liverpool area, with hackers able to steal data from Alder Hey Children’s NHS Foundation Trust, Liverpool Heart and Chest Hospital, and Royal Liverpool University Hospital (RLUH).

The trust has launched an investigation into the incident, which it says is still ongoing, to determine the specific details of the intrusion and establish exactly what types of data were taken.

According to the trust’s website, it provides care to more than 450,000 young people each year and employs over 4,000 staff, making it one of Europe's biggest and busiest children’s hospitals.

Liverpool Heart and Chest Hospital is relatively smaller, with just over 100,000 patients each year, including virtual appointments.

RLUH is the largest hospital in the region, caring for over 750,000 patients each year, although Alder Hey’s statement clarified that the incident only impacted a “small amount of data from Royal Liverpool University Hospital".

No hospital services were affected and continue to operate, with patients advised to continue attending appointments as they normally would do so.

“As part of our response to this threat we have made progress in securing impacted systems and ensuring the attackers do not have continued access. This means that we are in a position to begin to reconnect our systems when it is safe to do so,” the statement clarified.

The incident first came to light on 28 November after the threat actor Inc Ransom posted on its dark web leak site, claiming to have stolen sensitive patient records from Alder Hey.

Alder Hey said it is still trying to establish whether or not the attacker did, in fact, obtain confidential data, but warned this process could take a while.

“We are continuing to take this issue very seriously while investigations continue into whether the attacker has obtained confidential data. The investigation into the data may take some time, and there is a possibility that the attacker may publish the data before our investigation is concluded.”

Hospitals across Merseyside are cancelling appointments following a 'major' cybersecurity incident.

Arrowe Park Hospital in the Wirral was the first to sound the alert, with patients asked to avoid attending the hospital's A&E department except in cases of medical emergency, and outpatient appointments cancelled.

The hack initially affected the Wirral University Teaching Hospital Trust, which also manages Clatterbridge Hospital, and the Wirral Women and Children's Hospital, all of which are also affected.

"A major incident was declared at the Trust yesterday for cyber security reasons and the incident remains ongoing. We are working to rectify the issue and our business continuity processes are in place," said a Wirral University Teaching Hospital spokesperson.

"Our priority remains ensuring patient safety. Some outpatient appointments scheduled today and tomorrow are cancelled. Where appointments have been cancelled, we have contacted patients directly. We apologize for any inconvenience and we will contact our patients as soon as possible to rearrange."

In addition to patient disruption, staff have reportedly been unable to access electronic records as a result of the incident.

The attack marks the latest in a slew of highly disruptive cyber attacks on healthcare organizations both in the UK and globally in recent years.

According to research from cybersecurity training firm KnowBe4, the global healthcare sector was hit by 1,613 attacks per week in the first three quarters of last year, nearly four times the global average for all industry sectors.

Earlier this year, a cyber attack forced Kings College Hospital Foundation Trust and Guy’s and St Thomas’ Hospitals Foundation Trust in London to suspend critical operations following the breach of blood test supplier Synnovis.

Other UK incidents over the last couple of years include a ransomware attack on the Barts Health NHS Trust, claimed by the Russian ransomware gang BlackCat.

The group said it had accessed 7TB of data, including the National Insurance numbers and financial details of staff and patients.

In February this year, an attack on NHS Dumfries and Galloway saw a large volume of patient and staff-identifiable data accessed.

"Hospitals are prime targets for cyberattacks due to the massive disruption they can cause — and as more connected devices and open Wi-Fi networks emerge, these attacks will only grow," warned Trevor Dearing, director of critical infrastructure at Illumio.

Dearing urged healthcare organizations to focus on reducing the impact of attacks by building containment capabilities:

"Adopting a breach containment mindset allows hospitals to quickly isolate affected systems and limit attacker movement to reduce overall damage.

"Cyberattacks aren’t going away, but hospitals must reach a point where patient care — urgent or routine — remains uninterrupted."

In September, the National Data Guardian (NDG) and NHS England released a new cyber resilience framework for health and social care organisations based on the National Cyber Security Centre’s cyber assessment framework.

Speaking at the time, national data guardian Dr. Nicola Byrne said the move represented "a positive evolution, offering organizations a more current framework for evaluating and improving their data protection and cyber resilience".

NHS staff are eager to adopt new technology, saying it could help them treat millions more patients per year.

A survey from Virgin Media O2 Business of 1,000 senior decision-makers in public healthcare across the UK found that three in five believe new digital tools could help the NHS to reach 3 to 5% more patients – potentially benefiting at least 51,000 more people every day.

According to the report, nearly nine out of ten believe that digital technologies such as electronic health recording and Internet of Things (IoT) devices for monitoring vital medicine could significantly reduce the workload of frontline staff and decrease patient waiting times.

The report notes that the introduction of Integrated Care Systems across England in 2022 has already led to progress, with 98% of respondents acknowledging it has positively influenced hospital technology adoption in their local area.

"The introduction of integrated patient care has already had a positive impact on digital progress across the NHS," said Mark Burton, health and social care lead at Virgin Media O2 Business.

"However, our findings demonstrate there is still a huge untapped opportunity to use technology to drive operational efficiencies for patients and staff across the UK."

The report did find, however, that the variety of NHS structures across the UK has brought about a regional divide in terms of levels of digital maturity.

For example, more than four-fifths of surveyed staff in London, Belfast and Edinburgh agreed current connectivity solutions effectively support efficient patient care, while this number drops to 65% of staff in the South East, South West and Yorkshire and the Humber.

"As the NHS becomes increasingly digital, prioritising digital skills and confidence for staff, fostering open communication and adopting a strategic approach to technology investment will be critical to continued progress," said Burton.

"Public-private partnerships can help here, playing a significant role in delivering robust connectivity for an NHS that is ready for anything."

A report earlier this year from the Health Foundation charity found that the technologies most likely to save staff time were AI-based clinical documentation tools and software for analysis of images.

However, it warned, productivity gains will come not just from technology itself but from how well it is used.

"We found the biggest barriers staff face in using technologies effectively in their work include underlying IT and digital infrastructure and capability, as well as challenges with implementation and usage," wrote the researchers.

"Specifically, we identified considerable frustrations about the lack of IT support, lack of funding to implement new technologies and poor-quality connectivity and equipment."

Among the technology-related plans in Labour’s 2024 manifesto, the party pledged to transform the NHS app, making it easier for patients to manage their medicine, appointments and health needs; it's also said it plans to digitise the NHS 'red book' used by parents for their children’s medical records.

NHS England has revealed that it's been forced to cancel thousands of elective procedures and outpatient appointments since the cyber attack on blood testing company Synnovis on 3 June.

Meanwhile, attacker Qilin, a Russian-speaking ransomware group, has published almost 400GB of sensitive data on Telegram and its own dark web site after failing to secure a payout from the firm. This includes patient names, dates of birth, NHS numbers and descriptions of blood tests.

At the two affected NHS Trusts, King’s College Hospital NHS Foundation Trust and Guy’s and St Thomas’ NHS Foundation Trust, more than 1,294 outpatient appointments and 320 elective procedures have been postponed this week. 

This brings the total to 1,134 elective procedures and 2,194 outpatient appointments since the original attack.

"Although we are seeing some services operating at near normal levels and have seen a reduction in the number of elective procedures being postponed, the cyber attack on Synnovis is continuing to have a significant impact on NHS services in South East London," said Dr Chris Streather, medical director for NHS London.

Qilin is believed to have demanded $50 million for the data, while claiming that its attack was politically motivated; it told the BBC the attack was in retaliation for the government's refusal to help in an unspecified war.

Conor Agnew, lead cyber security assessor at Closed Door Security, said while the attack may well have been conducted for political reasons, there is undoubtedly a financial motivation at play.

"Despite the actors stating the attack is politically motivated, it is most likely spurred by a desire to make money and financially benefit from the disruptions the incident is causing to patient care,” he said.

The latest leak, he added, is meant to ramp up the pressure on Synnovis to pay up, while demonstrating the highly sensitive data the Qilin now has in its possession.

Kevin Robertson, COO of Acumen Cyber, said questions still remain over how Synnovis will respond to the incident. Although authorities have been clear that negotiating with cyber crime groups is ill-advised, the frantic nature of ransomware attacks means some organizations succumb to pressure.

"The UK government has made clear it will never negotiate with ransomware gangs, as they know this only fuels the industry. However, it’s not clear what approach a private organization like Synnovis will take. Clearly the organization is in a state of turmoil just now," he said.

"Other organizations must learn from this incident and work to harden their defenses against ransomware. These attacks are not going to go away, they are only going to increase, especially while Russia provides a safe haven for adversaries where they are celebrated for attacks, rather than penalized."

​​Bradford Teaching Hospitals NHS Foundation Trust (BTHFT) serves a population of around 550,000 people in West Yorkshire. It employs over 6,400 people across six sites, including Bradford Royal Infirmary and St Luke's Hospital.

Healthcare workers, in particular those in the Rheumatology Team, were often taking non-essential nursing query calls. With each call averaging nine minutes and 34% deemed “inappropriate,” this took time away from core duties. 

The department was also facing patient complaints over the lengthy, paper-based process for scheduling patient appointments and requirement to call the Trust for changes and cancellations. A digital patient management platform was therefore proposed, which could redirect patient advice queries and digitize appointment letters and management for an improved patient digital experience.

ITPro spoke to Andrew Mullan, service improvement lead at BTHFT to learn more about what his he and his team looked for in the new system.

“In Bradford, each hospital has 10 to 12 different computer systems and they all will be sending letters,” says Mullan. “It needed to be able to take everything that we’ve got and work with the accessible information standard as well.”

NHS contracts typically run for five years. With the current contract coming to an end, this presented the BTHFT with the opportunity to digitally transform their appointment management system, thereby lessening demand on the primary care team.

A stable approach to dropping legacy tech

BTHFT reviewed ten prospective tenders, with a focus on those able to offer a usable and simple solution. Mullan’s team opted for DrDoctor, a patient engagement platform that has an established relationship with the NHS.

With multiple systems generating letters, any digital transformation also needed to be able to sync with the Trust’s existing networks. Although hospitals can be incredibly innovative and the NHS is trialing exciting tech, the IT systems running operations at a given site may be inefficient or based on legacy tech. 

Functionality and stability are therefore the most important factors when it comes to technological onboarding in a healthcare environment, which DrDoctor was able to deliver having already having been accredited by the NHS for its services.

Given the sensitive nature of patient information, all tenders had to meet data protection requirements and provide evidence of appropriate accreditation. Data protection impact assessments (DPIAs) were required and tenders were risk assessed regarding how information is shared and processed.

The benefits of an all-digital approach

The digital transformation took three months, during which Mullan’s team worked with DrDoctor to augment existing systems rather than put in an altogether new solution. “The good thing for us is the workflow didn't change,” says Mullan. “We didn't have to tell all these different secretaries they’ve got to do something different – they don’t even need to know about it”.

While internal adoption was smooth, Mullan tells ITPro improved communication around the deployment of the new system could have improved the experience for patients. “We did okay with existing patients because it was on the back of the letters in advance, but new patients wouldn't know,” says Mullan.

Despite this, the project has been a clear success. Following the rollout, response times to patient queries were reduced from between two to three weeks to just one and a half to two weeks, while 44% of patients had questions resolved directly through the digital platform.

After eight months, the equivalent of 2.5 days of nursing time was saved due to answering fewer calls.

Through the new paperless appointments system, appointment information is now sent to patients via SMS in the form of a linked digital. This has also been a success, meeting the requests of patients and allowing them to easily change their appointment without having to spend their time and the time of staff altering information over the phone.

Parents and carers of patients can also add their mobile number and email address to the system, so they are automatically notified of patient appointments.

Mullan says that the new appointments platform has also been a big budgeting win: “With Royal Mail increasing their postage every year, which has rocketed since COVID, we'd be spending over £1,000,000 ($1.24 million) per year just on postage if we hadn't gone digital,” says Mullan.

A minor issue they encountered was that the appointment reminders sent by text were from a mobile number. While this meant that patients could reply to the text, it did mean there was a risk some patients could think the message was a phishing scam. “To alert that this is a trusted number, we put the number on the back page of all of our letter and worked with some of those ‘who called me’ websites too,” explains Mullan.

The Trust is mindful that digital tools are not for everyone. If any patients do not respond to the initial text or email, a letter is automatically sent after three days. Letters could also still be sent to patients who do not have a mobile number or email.

The transformation focused on digital letters with text reminders, but the ease of installation meant they were willing to try new things. BTHFT’s new digital portal has potential for further expansion in the future and Mullan’s team have branched out into using DrDoctor for collecting patient assessments.

This is just the first stage in the roadmap for BTHFT. Going forward, it will work to expand the digital transformation into other departments and deploy further improved functionality.

A ransomware group says it holds 3TB of patient and staff information stolen from NHS Scotland’s internal systems, with a local health board confirming some of the stolen data has already been published.

NHS Scotland was identified by the Inc Ransom threat collective in a post on the group’s leaksite, providing a ‘proof pack’ that is said to include sensitive medical documents. The group is now threatening to publish the data if demands are not met.

NHS Dumfries and Galloway suffered a “focused and ongoing cyber attack” on 15 March 2024, with a “significant quantity” of patient and staff data stolen.

Ryan McConechy, CTO at Barrier Networks, said the attack bore the hallmarks of the Inc group.

“Inc has a history of attacking healthcare organizations, and most ransomware gangs avoid making false claims around victims as it tarnishes their reputation.”

“[The incident] will undoubtedly cause concern for many citizens in Dumfries and Galloway who are waiting to hear if they were impacted. Their personal data now potentially lies in the hands of bad actors, which could be used in financial and identity fraud.”

The health board has now confirmed that some of the data stolen during the incident has been published by a recognized ransomware group, indicating the Inc group was behind the 15 March attack.

In a post on its web page dedicated to providing updates on the incident, NHS Dumfries and Galloway’s chief executive Jeff Ace confirmed the data published by the group was stolen during the 15 March attack.

“We absolutely deplore the release of confidential patient data as part of this criminal act. This information has been released by hackers to evidence that this is in their possession.”

The breach underscores the elevated threat levels facing critical-national infrastructure organizations in the UK, according to McConechy, noting NHS Dumfries and Galloway is lucky its operations weren’t disrupted more severely.

“The incident once again acts as a reminder that criminals are using cyber to target the UK’s critical infrastructure more frequently today. Fortunately, NHS Dumfries and Galloway appears to be operating almost as normal following the attack, but others are not so lucky.”

Patients are still in the dark as to whether they are affected

Approximately 140,000 people rely on the 50 regional bases that make up NHS Dumfries and Galloway, as well as its 4,500 employees. 

After the incident was first disclosed on 15 March, the health board said it was working closely with Police Scotland, the National Cyber Security Centre (NCSC), and the Scottish Government.

McConechy explained cyber incident forensics is a lengthy process, and it could be some time before victims get any confirmation that their personal data was affected.

In an update posted to the support page, Jeff Ace said there was reason to believe the hackers accessed patient and staff-specific data.

“It must be noted that this is a live criminal investigation, and we are very limited in what we can say. In addition, a great deal of work is required in order to say with assurance what data may have been obtained, and we are not yet in that position”, Ace advised.

“However, as it has been noted, there is reason to believe that those responsible may have acquired patient and staff-specific data.”

“We will look to update as and when we can, but in the meantime would again caution staff and patients to be on their guard for anyone accessing their systems, or anyone making contact with them claiming to be in possession of any information. Any such incidents should be reported immediately to Police Scotland on 101.”

Like many hospitals in the UK, Princess Alexandra Hospital NHS Trust has long relied on dated infrastructure, including aging desktops and clinical systems. As this legacy tech grew unstable, clinicians were plagued by system crashes and the blue screen of death which disrupted their ability to access key healthcare applications and data. 

Without visibility into the scale and root causes of these pervasive issues, the Trust's IT team struggled to prevent and quickly resolve the infrastructure failures impacting clinician productivity and patient care.

"I came from the private sector into local authority, then into the NHS and it was like stepping back 10 years in time,” says Jeffrey Wood, deputy director of ICT at The Princess Alexandra Hospital NHS Trust. 

“So for me, it was a case of ‘there's a lot of technology out there’. There's a lot of information that we don't have.

"We had something like 65% of our equipment that was seven years or older. And we also had a significant number of issues in the trust, which meant I thought about 85% to 90% of our work was fighting fires and about 10 to 15% innovation."

Wood’s team needed advanced monitoring capabilities to proactively identify problems with hardware used by healthcare staff. By detecting performance bottlenecks and infrastructure faults as they arose, the IT team wanted to eliminate barriers to productivity and continuity of care. Princess Alexandra set a goal to restore clinician time lost to technical difficulties — time better spent delivering high-quality patient outcomes.

Deploying digital experience management for unified IT insights

To achieve better visibility into its users’ devices across its infrastructure, Princess Alexandra selected Riverbed’s Alluvio Aternity. As Wood explains, this “digital experience management (DEM) solution” uses "a client on the devices, and it collects data based on a number of different benchmarks." 

The technology delivers real-time monitoring of clinical workflows, devices, and apps to detect emerging issues before they disrupt care.

Through close collaboration with Riverbed, Princess Alexandra rolled out Alluvio Aternity across all clinician endpoints, including 4,000 desktops and 2,400 mobile devices. With insights from the DEM technology, the Trust's IT team gained an accurate picture of performance across the stack. As Wood states, he "happened to go to a presentation that Riverbed did that shows what the tool could do, how we could use it." From unstable apps to crashing operating systems and slow networks, the product was able to shed light on the sources degrading clinician productivity hospital-wide.

Armed with this unified view, Princess Alexandra could then take targeted actions, from remediating application errors to network intelligence (NI). With pervasive visibility as the foundation, the IT team could fulfill the Trust’s mission to deliver seamless IT experiences that empower rather than hinder patient care.

Measurable improvements in productivity and care

With real-time insights from Alluvio Aternity, Princess Alexandra Hospital NHS Trust was able to rapidly restore clinician productivity and availability for patient care. As Wood says, "We went down from 967 blue screens of death to about 211. So that's a huge cost saving in itself for us."

In the first year with Alluvio Aternity, the Trust regained 700 hours per quarter of clinician time previously lost to IT issues. By proactively identifying and resolving infrastructure bottlenecks, nurses, physicians, and other care providers could fully focus their hours on delivering outcomes for patients.

This time savings came alongside a 99% reduction in the volume of service desk tickets, freeing IT teams from repetitive infrastructure troubleshooting. Clinical systems demonstrated improved stability and uptime as well.

With Alluvio Aternity empowering data-driven decision-making when it came to hardware upgrades, the Trust realized substantial IT cost optimizations. As Wood explains, "Before we used to have an age-based refresh. We're now procuring based on performance." Over a five-year period, Princess Alexandra is projected to achieve £2.5-3 million  in savings, funds that can be reallocated to enhancing frontline care.

Overcoming implementation obstacles with dedicated resources

While deploying the Alluvio Aternity software itself was straightforward using existing tools like Microsoft System Center Configuration Manager (SCCM), Princess Alexandra encountered familiar challenges in the post-implementation phase. As Wood explained, "What we found, or what I found, is that we weren't then using it. You know, you have to focus on the tool and say, right, actually, I need to analyze this data and decide what I'm going to do with it."

To maximize adoption and impact, Wood knew the IT team needed to take ownership. He assigned a dedicated team to work on this for a six-month period Having this focused team was critical to push past the initial learning curve.

As Wood reflects, "The first six months is hard work. You need to concentrate in on it, you need to focus on it, and you need to find what works best for you." By powering through the steep learning curve with dedicated staffing, Princess Alexandra was able to realize the potential of the software.

Lessons learned for healthcare IT leaders

The digital transformation at Princess Alexandra Hospital NHS Trust holds key lessons for healthcare providers globally working to enhance clinician productivity. Digital experience is vital for success and IT leaders must make end-to-end visibility into employee digital experiences a top priority. Without unified monitoring capabilities, infrastructure blind spots will continue to hamper care provider productivity and patient outcomes.

"I would say digital experience monitoring is so key because the end user will often not tell you that there's a problem, Wood explains." 

Proactive monitoring and remediation are equally critical, Wood says, as these allow you to identify patterns and address bigger pain points. The volume of digital experience data can be overwhelming, but leveraging artificial intelligence (AI) and automation for data analytics can help surface and resolve the most urgent infrastructure threats in real-time.

With comprehensive visibility and proactive optimization now established as healthcare IT best practices, the Princess Alexandra Hospital NHS Trust is poised to further its mission of delivering seamless, technology-empowered experiences for clinicians and patients alike.

Ask anyone in Britain and they’ll tell you the National Health Service (NHS) is in an unprecedented crisis. Leaving aside any political debate over what got us here, the raw data paints an unquestionably bleak picture for the centrally-funded single-payer system. 

More than seven million people are now on waiting lists for treatment, up from 4.5 million at the start of the COVID-19 pandemic and from 2.5 million in 2010. The percentage of potential cancer patients seeing a consultant within a fortnight of referral has fallen to 80%, well below the 93% target. This is just a flavor of the predicament the health service is in, despite the phenomenal efforts of doctors, nurses and others.

Can technology help pull it out of freefall? Not by itself, as the NHS’s problems are too severe; they’re too complicated for silver-bullet solutions. Previous efforts to digitally transform the NHS, too, have fallen flat.

But a combination of new technologies might alleviate some of the strain. Drones delivering blood, virtual wards, and video appointments with GPs are examples of innovations that might lift Britain’s healthcare system out of crisis. 

We’ve spoken to professionals, who’ve been implementing technological solutions to some of the NHS’s biggest problems, to find out why there’s still hope of resuscitating the ailing single-payer health service.

• Part one: Making blood deliveries by drone
• Part two: Hybrid healthcare and virtual wards
• Part three: Doctors on-demand

Using videoconferencing to lighten the load

The NHS crisis isn’t only restricted to hospitals. General practitioners (GPs) have also come under intense demand in recent years, as patient numbers have swelled, while the number of GPs has declined. 

According to the British Medical Association (BMA), there are now the equivalent of 2,078 fewer fully qualified full-time GPs compared to September 2015. Fewer GPs are choosing to work full-time. And yet each practice has on average 2,224 more patients than it did in 2015.

To help prevent GP surgeries from being overwhelmed, remote GP services such as Livi have emerged, allowing patients to get access to a doctor that they might otherwise have to wait weeks to see. Livi can be commissioned by integrated care boards (ICBs) that cover an entire area or by individual practices that are short on GPs. 

Patients are urged to book appointments with the Livi app, where they are asked to choose from a list of symptoms they might be experiencing. If it’s a condition that can be dealt with remotely, the patient is booked in for a video consultation with a GP, all of whom are fully qualified GMC-registered clinicians who still work in general practice. 

“85% of patients are seen within two hours,” says Karl Stocks, who was commercial director at Livi at the time of writing. Stocks is, at the time of publication, the public sector lead at HelloSelf.

Embracing digital doctors

The Livi GPs have full access to patients’ medical records and they can book blood tests and make referrals just like a practice GP can. Stocks said that around a third of the cases dealt with by Livi GPs are managing long-term conditions, suggesting it’s not just minor ailments that Livi takes off a GP practice’s caseload.

“We’ve got some examples where a number of practices would have closed down if we hadn’t been able to provide that remote service,” says Stocks.

“Some of the remote services that we’ve done have also enabled practices to stay open whilst they find a more long-term solution to fit their population and the requirement there.

"It’s definitely about making sure that we can provide that resilience to general practice, which it probably doesn’t have at the moment.”

Stocks admits there’s some resistance to virtual appointments, especially among the older demographics. However, it seems almost inevitable that remote access to healthcare professionals will become the norm.

In the past year alone, Livi has seen growth of 90%, now handling in excess of 300,000 appointments every month. “There are a number of instances where that where we’re starting to see digital-first primary care centers start to pop up,” says Stocks.

“I think GPs are probably only the first step. I think what we will probably start to see – and we’re exploring this more as well – is what can other healthcare professionals also start to put on the platform?”

Ask anyone in Britain and they’ll tell you the National Health Service (NHS) is in an unprecedented crisis. Leaving aside any political debate over what got us here, the raw data paints an unquestionably bleak picture for the centrally-funded single-payer system. 

More than seven million people are now on waiting lists for treatment, up from 4.5 million at the start of the COVID-19 pandemic and from 2.5 million in 2010. The percentage of potential cancer patients seeing a consultant within a fortnight of referral has fallen to 80%, well below the 93% target. This is just a flavor of the predicament the health service is in, despite the phenomenal efforts of doctors, nurses and others.

Can technology help pull it out of freefall? Not by itself, as the NHS’s problems are too severe; they’re too complicated for silver-bullet solutions. Previous efforts to digitally transform the NHS, too, have fallen flat.

But a combination of new technologies might alleviate some of the strain. Drones delivering blood, virtual wards, and video appointments with GPs are examples of innovations that might lift Britain’s healthcare system out of crisis. 

We’ve spoken to professionals, who’ve been implementing technological solutions to some of the NHS’s biggest problems, to find out why there’s still hope of resuscitating the ailing single-payer health service.

• Part one: Making blood deliveries by drone
• Part two: Hybrid healthcare and virtual wards
• Part three: Doctors on-demand

Opening virtual wards

One of the biggest problems the NHS currently faces is a shortage of beds. That’s not necessarily because of an influx of patients coming in – especially when COVID-19 waves die down – but the difficulty of getting some out of beds and into appropriate aftercare settings. Hospitals are reluctant to send vulnerable patients home if there’s nobody there to care for them, and the shortages in the social care sector are only exacerbating the problem. 

But there’s a potential technological solution: virtual wards. Using a variety of remote monitoring technologies, hospitals are piloting virtual wards, in which patients are allowed to return home but continue to be supervised by NHS staff.

“That remote monitoring tech can be a range of different solutions depending on what the person was in the hospital for,” says John Vesey, health and care sector lead at WM5G, an organization that helps bring the benefits of 5G to the West Midlands, a large area in the middle of England. “We’ve seen blood pressure cuffs or pulse oximeters,” he says.

“There are different devices that you can either have directly connected back to a hospital or the individual is picking up the phone and telling them the obs [observations] that are then entered in. From our perspective, we’re obviously trying to encourage it to be as automated transfer of data as possible.”

Everything you need to know about Doris

That desire to keep things as simple as possible is exemplified by another device used in virtual ward trials in the West Midlands, called Doris – or the ‘Data-Oriented Response Intervention System’. If you think that the initialism came before the product name, you’d be absolutely right. “We call it Doris because Doris was the name of my lunch lady at school,” says Neal Forse, CTO of the IoT Solutions Group, who invented Doris and a range of other Internet of Things (IoT) products used across a range of industries.

Doris is a small atmospheric sensor given to patients who’ve been discharged from hospital but are being cared for in virtual wards. It’s designed to help discreetly monitor the well-being of vulnerable, independent patients – for example, elderly people who live alone, have no family support, and provide their own sustenance. It’s also designed to be as simple as possible. Installation takes nothing more than ripping out a small plastic tab to activate the installed battery, which can last for up to five years. 

“There’s no mains power, no Wi-Fi passwords to set, no SIMs to insert,” says Forse. “There’s nothing for the user to do.”

The device measures nothing more than the ambient environmental atmosphere in the person’s kitchen – the room they’re most likely to visit periodically to fix meals at certain times of the day. There are no microphones that might raise privacy concerns, nor motion sensors that could be triggered by pets. The device can sit out of sight behind a box of Cornflakes, silently going about its business. “We measure the atmospheric conditions of the kitchen, and we aggregate that to the cloud, where we run an AWS instance in London,” says Forse. “On that cloud instance, there’s an artificial intelligence (AI) that extracts human activity per unit of time from the atmospheric patterns that it picks up. Once we know the human activity at certain points in time for that individual, we build a digital twin of behavior for that individual. If their activity deteriorates in any material way then we can raise alerts.”

The data is transmitted from Doris to the AWS instance via Low Power Wide Area Networks (LPWAN). Specifically, Doris uses two carrier-grade protocols from Vodafone and O2 called Narrowband IoT (NB-IoT) and LTE CatM. Both are now ratified as part of the 5G standard and, unlike the consumer-grade 5G network you might access from a smartphone, they have near-universal coverage. “In the UK we’ve got 99% coverage by population and 96% by geography when you use both networks together,” says Forse.

Using technology to save lives

Forse says Doris has already helped save six lives and that the devices are now being rolled out in their thousands. He says they’re much more effective than solutions such as panic alarms. “There’s a British Medical Journal (BMJ) white paper that says the push-button emergency buttons, that are given out like sweeties to the vulnerable independent people, are 92% ineffective for reasons that are obvious when you think about it,” he says.

“They’re not always around your neck when you fall over, or they’re not charged, they forget to put them on charge, or they don’t want to be an inconvenience. One poor lady sat on a sofa for two days not being able to move. She soiled herself and everything, but she didn’t want to be a nag or a problem to anyone, so she didn’t press the button. But we detected through our device that she’d been inactive and it invoked an intervention which helped her out.”

It’s stories like these that convince Jayne Rooke, also a health and care sector lead at WM5G, that the virtual wards they’ve been piloting in recent years could be a huge boost for the NHS. “Both the staff involved in that care and also the patients that have gone through it think it’s phenomenal,” she says.

She believes the virtual wards are ideal for frail or respiratory patients who don’t need to be in hospital, but need a degree of aftercare. “The fact that they can remain in their own homes and actually still get that amazing wraparound care, whilst being in a much more comfortable environment, has made the difference. We’ve just completed a piece of work with a local organization and the staff are amazing and working under tremendous pressure, but what they get out of it is knowing they’re doing the right thing for the patients.”

Ask anyone in Britain and they’ll tell you the National Health Service (NHS) is in an unprecedented crisis. Leaving aside any political debate over what got us here, the raw data paints an unquestionably bleak picture for the centrally-funded single-payer system. 

More than seven million people are now on waiting lists for treatment, up from 4.5 million at the start of the COVID-19 pandemic and from 2.5 million in 2010. The percentage of potential cancer patients seeing a consultant within a fortnight of referral has fallen to 80%, well below the 93% target. This is just a flavor of the predicament the health service is in, despite the phenomenal efforts of doctors, nurses and others.

Can technology help pull it out of freefall? Not by itself, as the NHS’s problems are too severe; they’re too complicated for silver-bullet solutions. Previous efforts to digitally transform the NHS, too, have fallen flat.

But a combination of new technologies might alleviate some of the strain. Drones delivering blood, virtual wards, and video appointments with GPs are examples of innovations that might lift Britain’s healthcare system out of crisis. 

We’ve spoken to professionals, who’ve been implementing technological solutions to some of the NHS’s biggest problems, to find out why there’s still hope of resuscitating the ailing single-payer health service.

• Part one: Making blood deliveries by drone
• Part two: 5G-powered healthcare and virtual wards
• Part three: Doctors on-demand

Meeting a four-hour delivery window

Not only do years-long waits for operations harm patients, but so do much shorter delays for lifesaving treatment. Getting blood supplies to patients in urgent need of transfusion, for example, is a logistical nightmare, not least with the amount of traffic on inner-city roads which even a bike can struggle to cut its way through. If blood isn’t delivered within a four-hour window, it’s unusable. With supplies already at critically low levels in the UK, nobody wants to see any precious donations go to waste.

The answer could be to transport blood where there’s no traffic at all: in the skies. Alex Landowski is the founder of Medical Logistics, a company that’s used to couriering medical supplies via the road network. He’s been involved in a three-month pilot scheme that's seen drones fly between two NHS hospitals 15 miles apart in the middle of England.

The trial has involved two types of drones: one small model capable of carrying a single unit of blood, and one much larger model that’s the size of a small car. It has four engines, an emergency parachute, and it’s capable of carrying a standard-sized transfusion box. It’s more of an unmanned aircraft than the type of drone you’d order off Amazon. 

The trial started running dummy payloads, then medical supplies before finally transporting blood. And it was a huge success. “We saved around 40% of time compared to transporting the same goods on the road,” says Landowski, who had courier vans performing the exact same journey at the same time of day to provide a comparison. “We’ve been flying a drone at 400ft above ground level, day and night, and in 12 meters-per-second wind gusts.”

The trial comprised 130 flights, traveling almost 2,000km, and included 30 hours of flying time where the drone was beyond visual line of sight – the first time that’s ever been allowed in the UK. 

Expanding the fleet of delivery drones

When asked whether he’d met any public resistance to flying car-sized drones overhead in busy areas, Landowski admitts it’s a psychological barrier they’re going to have to come to terms with eventually. He said the bigger drone was “less dangerous to fly in bad weather conditions because it’s more sturdy and heavier”.

“It’s sort of like airplanes,” he adds. “If people have seen a big Boeing 747, they feel like if that fails, that’s it. But if you’ve got this two-engine Cessna flying, people say, "yeah, it’s alright, if it fails, it fails". So it’s a similar kind of psychological thing. We have to be careful, and take it step by step, but it’s here, right? It’s much safer than driving your cars around.”

And talking of cars, it’s much better for the environment too. The drone produces 90% fewer CO2 emissions than an electric van, and 99.8% fewer than a diesel van. That’s not to mention money. Even on a fairly limited scale of ten flights per day, Landowski says he can get the costs down to a few dollars per flight – much cheaper than paying couriers to transport blood by road.

Landowski says he expects the first commercial rollout of medical drone deliveries will be sealed with private hospitals before the end of this year or the start of next, before filtering down.

“It can be done for private [hospitals] as well as the NHS. In time, it’s going to be that much easier – the more infrastructure there is, the cheaper it becomes. This is our bet for the future. 

"In a year, maybe two, I’ll start getting some returns on the investments, while improving healthcare and making history. So it’s kind of fun.”

It’s been more than a decade since the UK government abandoned plans to create a new NHS IT system, costing taxpayers billions of pounds. The scheme had been designed to deliver electronic records, digital scanning, and integrated IT systems across hospitals and community care.

For many in both the public and private sectors, that contracting saga lives long in the memory and its failure has now returned front of mind with government plans to create the new NHS Federated Data Platform (FDP).

What is the Federated Data Platform (FDP)?

The government hopes the FDP will allow NHS organizations to gather operational data from across the huge organization’s disparate systems and consolidate it in one place.

Writing on gov.uk last year, National Data Guardian Dr Nicola Byrne explained how the “value of our data will only be realized if it can be organized in such a way that the NHS is able to use it well to improve treatments, services and ultimately our health and care”.

“The programme’s work to support better health and care for all through the better use of our data is too important an ambition to fail,” she added.

However, with the platform value set at £480 million and multiple bidders expected, this new scheme doesn’t come without controversy. Fears over privacy, and concerns about data security, are all driving debate. 

Iain O’Neil, a former NHS director, and now managing partner of health and social care at TPXimpact, believes we will only “truly unlock the potential of NHS data” once the fundamentals are right; this includes data standards, interoperability, and getting data where and when it’s needed most.

He suggests funnelling all NHS patient data into one private firm could be a risk, explaining: “The FDP will work best if it supports an ecosystem of suppliers tackling the difficult challenges the health and care system faces.” 

And looking ahead five to ten years, he adds: “Clinical decisions based on data gathered from the 67 million people plugged into the NHS Service should be ubiquitous, enabling learning and better decision making.”

A revolution for managing and storing data

A major challenge for the FDP will be to gain frontline buy-in from receptionists, clinicians, nurses, and all working with data within the NHS. Unless the culture inside the organization fully adopts it, it won’t achieve its aims, experts argue.

But Alex Case, who previously worked in Downing Street overseeing cross-Whitehall Brexit delivery, believes the platform could “revolutionize the way we store, manage, and utilize healthcare data in the UK” – although he agrees this is only one part of the story. 

“There needs to be a recognition of the need to coordinate and orchestrate a 'patient journey' across the different components of an integrated care system, because that’s the point of taking a consolidated view of the data,” Case, who is now public sector industry principal at Pegasystems, explains.

Many argue implementing cutting-edge technology and infrastructure in partnership with the private sector could allow for a more coordinated healthcare system. Case, however, adds: “It’s crucial the NHS ensures data is collected and shared in a responsible and transparent manner, with robust safeguards in place to protect patient confidentiality. Additionally, there is a need for clear guidelines around data ownership and access to prevent any potential misuse or abuse.”

He argues the platform should be feature-rich, rather than simply focused on data integration, if patients are to be placed on “the right pathway to get the right treatment, at the right time”, while also accounting for NHS workloads, backlogs, and prioritization.

“The government and their technology partners have the responsibility to work together to ensure we deliver the highest standards of ethics and governance so that we can address the healthcare needs across the nation better and more reliably than before,” Case warns.

Experts agree the FDP should lead to better decision-making, given it will break down silos, including CEO of Apheris, Robin Röhm. “By providing access to distributed data sources, stored in different sources and locations, the data analytics platform can then be utilized for a multitude of operational purposes from care coordination to improving medicine supply chains.

“Data is most valuable when it is extensive and detailed. As the current handling of data within the NHS involves sensitive data being stored on many separate systems, this often leads to poor access and visibility of data by stakeholders.

“Federated data ecosystems are the most pressing response to the problem of working across organizational and geographical boundaries as personal data never leaves its secure environment.”

Avoiding the threat of vendor lock-in

The need to keep information in the FDP from being personally identifiable is a major issue for campaigners and patient-led organisations. The security risks are real; for example, according to Palo Alto Networks’ Unit 42 team, healthcare was the third most-targeted sector in the UK, with 9% of all attacks targeting healthcare organisations.

Amanda Brock, CEO at not-for-profit OpenUK, suggests some form of NHS systems standardisation could help manage every aspect of the user journey from appointment booking to service delivery, while updating patient records along the way to be more efficient. But she warns its success depends on its implementation; the NHS must own the platform and it’s built on open source software in a “collaborative and transparent way”. 

She adds public sector platforms frequently “pay lip service to the legal definition of open source using an OSI-approved licence and sharing the source”, but this is “not enough to avoid lock-in”, she states.

“The scale of this project means there are few people that have the skills to lead it successfully,” Brock further explains, “but the risk with appointing a single vendor is of course lock-in. The NHS has spent years fighting against this. 

“We need to find a balance between the current status quo of myriad disjointed platforms and apps, and one single vendor that owns everything in perpetuity and profits off that patient data at our expense.” 

Risking privacy is a price worth paying

The FDP will lead to better patient care, as it makes a person’s complete medical history far more accessible, adds Waseem Ali, formerly CDO at Lloyd’s of London and current CEO of data and analytics consultants Rockborne. 

This is because of its “treatment-first, paperwork-later” approach. Ali’s years of experience with healthcare data, however, shows the use of integrated records has always been an issue, especially amid privacy concerns.

“It’s understandable for people to be hesitant about their data being shared,” he concedes. “However, most people are already sharing more information with Amazon or Facebook, sometimes without even realizing it. 

“So, if you are happy for Amazon to know your consumer preferences and shopping habits, then why aren’t you happy to share your healthcare information with the NHS so that you can receive the optimum level of care?”

Ali talks of the potential benefits that would exist if “healthcare professionals knew everything about a patient”. “This information could be harnessed to pre-empt the types of services they may need, which would be a gold mine for preventative care,” he adds. 

“Yes, there will always be the argument about data privacy, but the number of lives that could be improved, or even saved, is hard to out-argue.”

NHS ambulance services in the south of England have been impacted by a security incident at a third-party service provider, with systems knocked offline and staff unable to access records. 

South Western Ambulance Service Foundation Trust (SWASFT) and the South Central Ambulance Service Trust (SCAS), have both reported that staff have been forced to rely on paper records following the incident. 

The source of the disruption has been traced to an attack on Ortivus, a Swedish third-party software provider for the trusts. 

Both ambulance services use the firm’s MobiMed software, which provides real-time information sharing for paramedics “throughout the pre-hospital care chain”. 

The software is used by more than 12,000 paramedics across Europe and the UK, including hundreds of ambulances across the two trusts. 

Last week on 18 July , the Swedish company confirmed it had fallen victim to a cyber attack that targeted its data center environment. 

The firm revealed that electronic patient records were unavailable and that users would be forced to use manual systems “until further notice”. 

Ortivus insisted at the time that no patients had been “directly affected” by the incident, adding that “no other systems have been attacked and no customers outside of those in the hosted data center have been affected”. 

In a follow-up statement on 21 July, the firm said that it was “ready to re-initiate” MobiMed electronic patient records for customers that were affected by the attack. 

Ortivus noted that it was awaiting “final approval by NHS authorities before the ambulance trusts can reconnect”.

“Ortivus can announce that the MobiMed ePR system that was hit by the previously reported cyber attack is ready to be re-initiated for the affected customers as an interim live environment has been constructed using new equipment,” the firm said. 

“Before the system can be brought into operation it has to be approved and verified by an independent actor to ensure that the system meets certain criteria indicated by NHS England and the Ambulance Trusts.”

Exact details on the scale of the attack, or those responsible, are yet to be confirmed by Ortivus. Similarly, whether patient data has been directly exposed as a result of the attack is yet to be confirmed. 

An NHS spokesperson told ITPro it was aware of the incident and that it was working with the affected trusts. 

“We are aware of an incident affecting a small number of ambulance services. Our Cyber Security Operations Centre is working with affected organizations to investigate, alongside law enforcement colleagues, and supporting suppliers as they work to reconnect the system.”

Lucrative targets in healthcare

This attack marks the second major cyber-related disruption for NHS services in the space of a month. 

In early July, the Barts Health NHS Trust was struck by a cyber attack believed to have been carried out by the BlackCat ransomware group. 

The trust was cited on the group’s dark web victim blog in the wake of the incident with claims that several terabytes of sensitive data had been compromised. 

This included “confidential documents” such as financial details and copies of passports and driving licenses, the group claimed. 

Spencer Starkey, VP of EMEA at SonicWall, said the incident serves as a stark reminder that healthcare organizations are viewed as prime targets for highly sophisticated and aggressive hacker groups. 

“The recent heinous attack on the UK NHS ambulance service is one of many reminders of the threat the healthcare industry currently faces,” he said. 

“Cyber criminals are actively targeting the most critical aspects of our society. In this digital era, the abundance of servers and processing power has created an ideal environment for cyber criminals seeking systems to exploit for their own gain.”

Despite the increased targeting of healthcare organizations globally, research from ENISA has shown that many still employ lackluster defenses to counter growing threats. 

Its analysis of the healthcare industry in the EU found that only 27% of organizations have a dedicated ransomware defense program. 

Similarly, nearly half (40%) told the cyber security agency that they have “no security awareness program for non-IT staff”, which could be exacerbating risks. 

Security experts have raised concerns about the risks posed to NHS patient data in the wake of the University of Manchester cyber attack. 

A report from the Independent claimed that data belonging to more than one million NHS patients may have been compromised in the June attack. 

Data accessed by threat actors during the incident is believed to pertain to trauma patients and people treated for injuries sustained in terror attacks. 

The data sets, gathered for research purposes by the university, included NHS numbers and the ‘first three letters’ of patients’ postcodes, according to leaked documents seen by the publication. 

The university has since informed NHS England of the data breach, but a notice to the healthcare provider warned that it is still unclear whether affected patients' names have been compromised.  

This prompted the university to issue a warning that there is potential for “NHS data to be made available in the public domain”. 

Similarly, university officials warned that some affected patients may not even know they are on the database as they were not required to provide consent. 

Deryck Mitchelson, field CISO at Check Point and former CISO at NHS National Services Scotland, said the incident should serve as a stark warning over the potential risks of data sharing between private organizations and public services. 

“The questions we need to be asking is why has the university, as a private commercial organization, had access to personal identifiable information from the NHS,” he said. 

“How many other universities have this type of data stored on their own servers?”

Mitchelson said the university must provide clarity on a number of key lingering questions, such as whether the data was obfuscated or de-identified, whether these data sets were segmented from others, and what safeguards the university had in place for the use of research data. 

“Where patient information is being used for research, there should be as much openness and transparency about that use as possible,” he said. 

“All of this opens up far more concerning conversations around data sharing between public and private organizations which needs to be addressed.”

ITPro has approached the University of Manchester for comment on the matter.

University of Manchester attack: What happened?

In early June, the university revealed it had experienced a “cyber incident” and confirmed that some systems had been accessed by an unauthorized third party.  

In the wake of the breach, staff were advised not to download files from university systems in an attempt to back them up.

University officials said that data had “likely been copied” during the breach and the institution was working with authorities to identify the source of the issue. Last week, the university confirmed that data had been stolen. 

The incident was initially believed to be linked to a breach at payroll provider Zellis in the wake of the MOVEit cyber attack. However, the university refuted these claims. 

To date, the university says it is yet to establish the identity of the threat actor or actors behind the attack. 

In recent weeks, students and staff members at the university have complained that they have received emails from the culprits threatening to sell or leak their personal data unless a ransom is not paid. 

NHS IT issues cost doctors millions of hours of work every year, according to a new study from the British Medical Association (BMA).

The Building the Future report, which draws on feedback from 1,300 BMA members, found that tech issues and ageing IT infrastructure hampers their ability to carry out their roles effectively.

Nearly one-third (29.8%) of doctors told the association that software used in daily operations is “’rarely’ or ‘not at all’ sufficient. Meanwhile, just 4% said that software suits their needs and is appropriate to their role.

Similarly, the study found that only 11% of medical practitioners reported ‘completely’ having the necessary equipment to perform their role.

Lack of interoperability

The interoperability of IT software and hardware was identified as a “significant barrier” to digital transformation across the health service, with 76% of respondents highlighting this particular issue.

Just over two-thirds (68%) of doctors said they were ‘not very confident’ or ‘not confident at all’ that seamless data sharing across the service could be achieved within the next decade.

This lack of interoperability means that patients report a “disjointed experience” in navigating certain aspects of the health service, with many being forced to report the same information to multiple different clinicians.

This has had a marked impact on the “quality, timeliness and safety” of the care patients receive, the report warned.

One respondent said that working across different IT systems limits their ability to access records, which poses a “significant risk” to patients and impacts clinical outcomes.

Sub-par hardware is increasing workloads

Responding to the BMA’s January 2022 Viewpoint Survey, nearly 71% of doctors reported that current IT systems and infrastructure in their workplace ‘somewhat’ or ‘significantly’ increased their workload.

This latest survey found that more than half (58%) of doctors reported losing between one and three hours per week due to inefficient equipment, which is causing a significant hit to productivity each year and exacerbating backlogs.

“The BMA estimates that this means more than 13.5 million working hours are lost yearly in England alone due to delays as a result of inadequate or malfunctioning IT systems and equipment,” the report claimed.

“This is the equivalent to almost 8,000 full time doctors, or nearly £1 billion,” it added.

Poor connectivity and broadband speeds

Connectivity and access to high-speed broadband were also identified as key barriers for healthcare practitioners working on the frontline of the NHS.

The onset of the coronavirus pandemic highlighted the need for improved connectivity at a time of increased remote patient care and consultations. However, poor connectivity was revealed to be “one of the biggest barriers” to carrying out remote consultations.

A separate survey conducted by the BMA in 2020, 11% of doctors said poor connectivity was ‘significantly’ or ‘slightly limiting’ their ability to perform their role and provide remote consultations.

Calls for increased investment

The BMA has now called for increased investment in digital solutions and has recommended a stronger focus on bringing the health service’s IT infrastructure up to modern, efficient standards.

“Digital solutions have the potential to transform healthcare in the UK, but many doctors have told us about the IT challenges they face in their day-to-day working lives,” the BMA said.

“High quality patient information, fully functioning technology, and interoperable systems can improve patient care, access, experience, increase productivity and transform the working lives of healthcare staff,” the association added.

The BMA outlined replacing or upgrading outdated and defective hardware and software as a priority moving forward. In addition, it called for improvements to broadband capabilities in healthcare facilities across the UK to increase connectivity.

Other key recommendations include:

• Improving interoperability to facilitate data sharing across health care systems, particularly the primary-secondary care interface, and develop robust standards for interoperability by the appropriate UK health service regulatory bodies
• Ensuring robust cyber security measures are in place nationally and locally to protect health information systems and mitigate against widespread disruption to patient care
• Closely involve users of digital systems on the design and implementation of digital programmes and strategies

Embedding digital skills in medication education and training curriculums was also identified as a key recommended focus for the NHS.

This, the report said, would enable doctors to continue up-skilling themselves “over the course of their careers” through a combination of in-house training and continuing professional development.

Budget Cuts

The BMA report raises questions over how the NHS can seek to enhance and modernise IT infrastructure amidst a period of budgetary restraints and cutbacks.

According to the association, current assessment methods for IT funding are “challenging” while funding streams are often “complex”.

In addition, the report noted that recent government investment in digital transformation in the English NHS has “not been sufficient to deliver national ambitions and historical investment in IT has been inconsistent”.

Research conducted by the National Audit Office (NAO) in 2020 found that NHS trusts in England spend less on IT and technology than the recommended level.

The report revealed that less than 2% of trusts’ expenditure is on technology, compared with a recommended 5%.

NHS trusts told the NAO that funding was a major barrier, “since they face many demands for local resources".

“This suggests that additional central funding alongside expanded local funding is desperately needed to reach digitisation and transformation ambitions,” the BMA stated. “But trusts may not have the luxury of flexibility with their spending and may have to prioritise direct patient care over infrastructure upgrades.”

Nvidia has partnered with ten National Health Service (NHS) Trusts to roll out its AI platform across UK hospitals.

The AI Deployment Engine (AIDE) platform will provide AI-enabled disease detection tools to healthcare professionals to help them diagnose and treat cancers, dementia, strokes, and other conditions.

It’s currently being deployed at Guy’s and St Thomas’s, King’s College Hospital, East Kent Hospital University, and University College London Hospitals NHS Foundation Trusts, where it will serve 5 million patients a year.

A total of 11 NHS hospitals are expected to be using the platform by the end of 2023, raising the number of patients served to 18 million.

The new platform will help clinicians have more information about their patients, aiming to make the data about their health more accessible and interoperable, and meet the ultimate goal of improving patient care.

Nvidia's AI platform is built on MONAI, an open source medical imaging AI framework co-developed by Nvidia and the AI Centre for Value Based Healthcare, a group of hospitals, universities, and partners.

The chip giant said that MONAI helps reduce the complexity of medical workflows and aids developers in building and deploying AI applications.

Using the framework has enabled clinics to more easily interpret medical exams and discover more information about patients. In the UK, MONAI is currently used by Guy’s and St Thomas’ Hospital and King’s College Hospital due to its ability to streamline AI model building.

“Deployment of this infrastructure for clinical AI tools is a hugely exciting step in integrating AI into healthcare services,” said James Teo, professor of neurology and data science at King’s College Hospital NHS. “These platforms will provide a scalable way for clinicians to deploy healthcare AI tools to support decision-making to improve the speed and precision of patient care. This is the start of a digital transformation journey with strong, safe and open foundations.”

“Across the healthcare ecosystem, researchers, hospitals, and startups are realising the power of incorporating a streamlined AI pipeline into their work,” said Haris Shuaib, AI transformation lead at the AI Centre. “The open-source MONAI ecosystem is standardising hundreds of AI algorithms for maximum interoperability and impact, enabling their deployment in just a few weeks instead of three-to-six months.”

Currently, the AI Centre has developed algorithms to improvise COVID-19 diagnosis, brain tumours, breast cancer, dementia risk, and stroke detection.

AIDE is able to connect AI algorithms, that have been approved, to a patient’s medical record, and the data never leaves the hospital trust, according to Nvidia. Once analysed, the data is sent back to the electronic healthcare record.

Nvidia also revealed that AIDE's will be open sourced and is set to be published to GitHub on 7 December 2022.

The NHS' automation efforts, used to clear the COVID-19-related patient backlog, are being hampered in part by sub-optimal 'depth of understanding’, one NHS Trust head of emerging technology has said.

Each Trust is saving the hours of between one and ten full-time equivalent (FTE) staff, on average, each year with robotic process automation (RPA), according to Tremaine Richard-Noel, head of emerging technology at Northampton General Hospital NHS Trust. However, more staff training is needed to build robust RPA solutions in each organisation.

The NHS’ RPA tools are deployed across every single one of its sub-organisations in some capacity and are currently seen as “one of the biggest solutions” it has to tackle the six-million-patient backlog.

"If you consider the fact that the NHS has got 1.7 million staff, at the minute - this might sound odd - there's quite a lot of impact but, on the grand scheme of things, there's a lot more to do," said Richard-Noel to IT Pro at UiPath’s Forward 5 conference.

There are numerous challenges facing the UK’s healthcare service and deploying RPA across each NHS organisation, of which each is entirely different, is “not very easy”, he added.

The primary difficulty in deploying the tools is educating the IT experts in each Trust, since there is no centralised list of systems and RPA has to be deployed in each organisation individually.

“It's not like you deploy it once, you have to deploy in every place and there isn't a centralised list of systems in the NHS, so there are challenges in educating quickly,” he said.

There is no shortage of experts within the NHS who are willing to train to use and deploy RPA in each organisation - “they’re really keen,” said Richard-Noel. Around 50 individuals are trained each month through workshops and other upskilling programmes.

The upskilling programmes currently in place aim to improve the existing FTE figures and increase each Trust’s expertise to a point where they can build their own software robots and maintain the automations - although completing nationwide baseline training is a “huge undertaking”.

Cyber security considerations are also slowing the rate of robot development within the NHS, albeit not with the same significance as the lack of training across each Trust.

Some of the software robots being developed by the NHS are built for basic, non-sensitive data entry, and these can be deployed relatively quickly.

Other robot builds require the safe management of patient data and some projects rely on overseas developers, raising the need for NHS organisations to gain a greater understanding of these new risks.

The only risk when managing the safe transfer of patient data, for example, with software robots is if a bot was built badly from the outset, said Richard-Noel. However, the high degree of governance within an organisation like the NHS prevents unsecured bots from ever being deployed, he added.

How is RPA being used across the NHS already?

The healthcare industry is one of the areas in which use cases for RPA are often touted. For example, previous research has shown that clinicians in the US are spending around 43% of their jobs doing data entry and not face-to-face with patients.

Richard-Noel said there is an endless list of ways RPA is being used in the NHS but one of the most notable is with automated appointment scheduling.

He called the specific initiative ‘automation-initiated follow-up’ which is used by some NHS Trusts to deploy RPA software in a way that reads blood tests, for example, and automatically book a follow-up appointment if the result reveals a cause for concern.

Before the use of RPA, NHS IT systems would book a follow-up appointment by default, even if the results were unproblematic. It’s one way in which the NHS is using RPA to gradually mitigate the patient backlog.

Some NHS Trusts are also using RPA to process the significant number of referrals for people being transferred from primary to secondary care - around 20 million a year, Richard-Noel said.

The processing of these referrals can be done autonomously using RPA, he said, moving away from the days of needing them to be printed off.

The NHS’ use of RPA has accelerated in the past five years thanks to it being part of a national directive from the healthcare service to each of its subsidiaries, but “there is evidence of it being used for about ten years” in total, said Richard-Noel.

The NHS has also been funding dedicated centres of excellence (CoE) for specific technologies.

“A centre of excellence develops common solutions, promotes best practice, and acquires new skills that are then spread throughout the enterprise to increase the likelihood of adopting new ways of working to realise value and allow teams to become self-sufficient,” read the NHS’ cloud CoE website.

A software supplier to the UK’s National Health Service (NHS) has reportedly been the victim of a cyber attack leaving many services disrupted.

Emergency prescription services, ambulance dispatching systems, and the non-emergency 111 line, among others, are thought to be affected.

The attack has been confirmed by software supplier Advanced. The company told IT Pro that the incident was first spotted on Thursday morning and resulted in a loss of service.

Only a small proportion of the supplier’s servers were affected, its CEO Simon Short said, and all health and care environments were isolated as a precaution.

“Early intervention from our Incident Response Team contained this issue to a small number of servers representing an extremely small percentage of our Health & Care infrastructure,” said Short. “The protection of services and data is paramount in the actions we have and are taking.

“We continue to work with the NHS and health and care bodies as well as our technology and security partners focused on recovery of all systems over the weekend and during the early part of next week. In the meantime, those NHS impacted services will continue to operate using contingency.”

Short told Sky News that the affected servers comprised only 2% of its health and care infrastructure.

Advanced told IT Pro that an update on the incident is expected later today and has not yet responded to follow-up questioning.

The National Crime Agency (NCA) and National Cyber Security Centre (NCSC) are both involved in the investigations.

“The NCA is aware of a cyber incident affecting the company Advanced and is working with partners to better understand its impact,” it told IT Pro but declined to comment any further.

The disruption experienced across the NHS has been described differently by different arms of the organisation. A spokesperson speaking to the BBC said the disruption was “minimal”, however, the Welsh Ambulance Service described it as a “major outage of a computer system”.

An increasing number of experts have been vocal in their beliefs that the cyber attack could be ransomware in nature. The Telegraph first reported that there were indications that ransomware was involved but no official confirmation of these beliefs has been made yet.

“While no details have been released about the root cause of the 111 service outage, all signs would seem to indicate ransomware to be the cause,” said Javvad Malik, lead security awareness advocate at KnowBe4 to IT Pro.

Other experts have said that the threat actors behind the attacks are likely to be from Russia, given the UK's support for Ukraine during the ongoing war between the two eastern European countries, although the identities of the attackers have not been confirmed yet by officials.

It is currently unclear who is behind the attack or how they gained access to Advanced’s systems. An analysis of the major ransomware groups’ blogs shows none have claimed responsibility for the attack at present.

Ransomware groups have recently pivoted to a double extortion model. Victims typically have data stolen before the ransomware program infects and locks users out of their systems.

A negotiation period is usually afforded to victims, during which time the cyber attackers will attempt to convince the victim to pay a ransom to restore access to their systems and to prevent the leakage of the data that was stolen.

If a victim refuses to pay during a given timeframe, the data is usually posted online which presents legal, regulatory, and reputational risks to victims and their businesses.

The advice generally given to ransomware victims is never to pay the criminals. There is no guarantee they will restore access once the payment is made and to pay them is a direct act of funding crime.

Some organisations running critical services are forced to pay, however, given the operational necessity that their services continue, such as Colonial Pipeline’s incident last year.

The Department of Health and Social Care (DHSC) has announced plans for even more integration of NHS services within the NHS app as part of a so-called digital revolution.

90% of NHS trusts will be expected to have electronic health records by December 2023, and 100% by March 2025. This will allow a more centralised point of access for users of the NHS App.

By March 2023 the aim is for anyone to be able to receive NHS messages such as notices that prescriptions are available, register with a GP practice, access their child’s health records and access hospital correspondence all within the app.

The plans follow on from and make multiple references to the recent Data Saves Lives policy paper, in which a range of commitments to ensuring better patient connectivity are set out.

Currently, around half of all adults have the NHS App installed, and the DHSC is aiming to increase this to 75% by 2024. In September of that year, patients will also be able to complete pre-assessment checks for hospital from home, and it is hoped that this will help free up the time of NHS workers.

The changes come after decision-makers in the sector advised the DHSC that guidance to this point has been lacking in clarity and a cohesive vision for change, with the policy document setting out to remedy those concerns.

A budget of £2 billion has been assigned to the project, with work already underway to digitise the NHS. An additional £150 million has been earmarked specifically for digitising social care.

“This plan builds on our data strategy to revolutionise digital health and care, which will enable patients to manage hospital appointments from the NHS App and take more control of their own care at home, picking up problems sooner and seeking help earlier,” said Health and Social Care Secretary Sajid Javid.

“Ensuring more personalisation and better join up of the system will benefit patients, free up clinician time, and help us to bust the COVID backlogs.”

The Secretary of State for Health and Social Care announced today that NHS Digital and NHSX are set to be bundled into one organisation within NHS England and Improvement (NHSE/I).

The move is part of developments in the NHS' wider digital transformation strategy and will see both digital arms of the healthcare body placed under the same roof for the first time.

NHS Digital and NHSX will form part of the new Transformation Directorate within NHS England alongside Improvement, and Innovation, Research, and Life Sciences, effectively retiring both brands as they are currently known.

The Transformation Directorate will be tasked with leading the digital transformation of the NHS at national and integrated care systems levels, with the move expected to reduce the NHS' lengthy waiting list backlogs and better support its post-pandemic recovery.

"To ensure our record NHS investment makes a lasting impact, I am bringing workforce planning and digital transformation into the heart of the NHS," said Sajid Javid, Secretary of State for Health and Social Care. "These reforms will support our recovery from COVID-19 and help us tackle waiting lists to give patients excellent care in years to come.

"I would like to pay tribute to all our colleagues at Health Education England, NHS Digital, and NHSX for the enormous progress they have made, which we will continue to drive forward with their help."

NHSX will evolve and take on a strategic function within the Transformation Directorate, but not all staff will move to the strategy team, an internal letter given to NHSE/I staff revealed yesterday which was first seen by Digital Health.

The letter was written by NHSE/I CEO Amanda Pritchard and said some NHSX staff will move to other departments within the Transformation Directorate such as the transformation teams of the CIO's function.

NHS Digital is the branch of the health service that oversees the IT needs of all healthcare providers in the UK, supplying technology where needed while also overseeing all the data across the organisation and consulting on cyber security matters.

It has been heavily criticised in recent years for several missteps including most recently its plans to share NHS patient data with private companies. NHS Digital was criticised for the move which led to a huge backlash and more than 100,000 opt-outs in May, prompting it to halt the divisive data strategy entirely.

The department has also come under fire for repeated failed attempts at digital transformation, branded at the time as "expensive and deeply unsuccessful" in a report from the National Audit Office.

NHSX was created in 2019 by then-health secretary Matt Hancock to bring together tech leaders and healthcare experts to develop policies and innovations that accelerated the NHS' digital transformation ambitions. It has been heavily criticised in recent years for failing to deliver an effective contact tracing app during the pandemic.

Announcing the structural change, the government credited the two departments for their contributions to the NHS during the COVID-19 pandemic. The pair developed solutions that allowed patients to be monitored at home through virtual wards and also developed the NHS COVID Pass via the NHS app.

The NHS has partnered with AI startup Faculty to improve its forecasting and predictive capabilities to improve patient care.

The new partnership, which saw Faculty appointed as a partner following a tender process, will reportedly help the NHS to build on its success using AI so far and address new areas where AI forecasting tools can improve service delivery and patient care, such as understanding and predicting A&E demand and winter pressures.

Faculty has been working with the NHS during the COVID-19 pandemic and developed the Early Warning System (EWS). This AI tool is purportedly based on Bayesian hierarchical modelling, using aggregate data to warn hospitals about potential spikes in cases so they can divert staff, beds and vital equipment to where it’s needed.

Currently, there are around 1,000 users of the forecasts across the NHS, who use the outputs for their own analysis or to help inform the prioritisation of safe care delivery for patients on a daily basis, according to Faculty.

“The response to the pandemic has demonstrated the importance and impact of using data and machine learning techniques to make predictions about the future and inform more effective decision-making, wrote the company.

“The techniques applied in the EWS allow forecasts to use specific information from that trust, as well as incorporating a broader set of contextual information that impacts the forecast, such as what’s happening in COVID-19 admissions in other local hospital trusts.”

Faculty has faced controversy in the past when it comes to government contracts. Last year, the startup, which had worked on the Vote Leave campaign, won a contract to analyse social media data, utility bills and credit score ratings, according to the Guardian. However, the full details were unknown as the published version of the contract was partly redacted.

After facing pressure from Open Democracy and Foxglove in June last year, the UK government released contracts governing its deals with a number of companies including Faculty. It emerged the Dominic Cummings-linked firm was being paid over £1 million to provide AI services for the NHS, with Open Democracy claiming that the terms of the deal were changed after initial demands for transparency were made under a FOI request.

Furthermore, cabinet minister Lord Agnew owed £90,000 of shares in the company when it was awarded a £2.3m contract from the NHSX to help run the NHS Covid-19 Data Store, according to Digital Health. A report by the National Audit Office (NAO) revealed the conflict of interest, although the organisation found "no evidence he was involved in awarding or managing the procurements". It also notes he relinquished his shares on 23 August 2020.

At the start of the month, NHS Digital signed a deal with Scandit, an augmented reality solutions provider, to digitise the UK’s Covid testing process. The company was going to provide the NHS with a data capture service in the form of barcode scanning technology to make it easier to track and identify tested samples.

NHS Digital has signed a deal with augmented reality (AR) solutions provider Scandit in an effort to digitise the UK’s Covid testing process.

The Swiss software company will provide the NHS with a data capture service, which will be available for free to any hospital or NHS organisation involved in Covid test tracking, PPE tracking, or patient care, until 30th November 2021.

Specifically, the company will be deploying barcode scanning technology which will make it easier and faster for healthcare workers and volunteers to track and identify the tested samples. Test site staff members will be able to identify patients from a safe distance, avoiding the risk of contagion, by scanning a barcode on a booking form with the help of a smartphone.

After the samples are taken, they will be stored in a vial with a barcode attached to it, allowing staff to quickly scan it in order to ensure the test sample matches the booking ID and minimise mistakes.

The announcement of the deal comes days after the government proposed twice-weekly rapid Covid-testing which would be made available to everyone in England starting 9 April.

Rapid testing has so far been available to those considered to be most at risk, such as persons over 60 and with underlying health conditions, as well as people who are unable to work from home and frontline NHS staff. However, the government is now encouraging everyone to take regular tests, in order to prevent outbreaks as well as return to “a more normal way of life”.

Health secretary Matt Hancock said that, due to one in three Covid carriers being asymptomatic, “regular rapid testing is going to be fundamental in helping us quickly spot positive cases and squash any outbreaks”.

“The vaccine programme has been a shot in the arm for the whole country, but reclaiming our lost freedoms and getting back to normal hinges on us all getting tested regularly,” he added.

Due to the more regular Covid testing pitched by the government, the NHS is facing a significant increase in workload over the coming weeks. The process is to be facilitated with the help of Scandit-supplied technology, at no extra cost.

Commenting on the deal, Scandit CEO Samuel Mueller said that the Swiss software company’s tech “ensures that tests can be tracked quickly and easily”.

“It also integrates easily with smartphones, meaning that the NHS has been able to scale the number of testing sites and make it easy to deploy home-testing effectively. There is no acceptable margin of error. Our clinical-quality barcode scanning technology delivers a highly accurate read rate whether the scan is happening through a car window at a drive-in mobile test site or by someone who is self-testing at home,” he added.

Mueller said that Scandit has been “helping NHS Digital digitise their nationwide testing process since the start of the pandemic”.

“We have taken steps to support the NHS at every step of the way to integrate our technology into the complex NHS IT infrastructure seamlessly. We look forward to continuing this partnership and helping the NHS make it possible to deliver quick Covid-19 tests for every UK resident that needs it,” Mueller added.

The UK government has made a "major U-turn" after facing a lawsuit from Open Democracy over a £23 million NHS data contract awarded to controversial US firm Palantir.

Open Democracy claimed that the government "finally caved" in the face of the lawsuit even though the case was withdrawn, in a blog post on Tuesday, adding that the NHS has now committed to not extending Palantir’s contract beyond COVID without consulting the public.

It has also agreed to engage the public, via patient juries, about whether firms like Palantir are appropriate for a long-term role in the NHS at all.

“It’s a major U-turn at a critical moment. The NHS, with its unique trove of structured health data, is powerfully attractive to tech corporations. Palantir and other US tech firms clearly stand to profit from managing or accessing this asset, estimated to be worth £10bn a year,” wrote Mary Fitzgerald, Open Democracy’s editor in chief and Cori Crider, founding director of FoxGlove.

“The NHS datastore is the largest pool of private health data in NHS history, and that raises questions too important to be settled in secret deals. Should it survive the pandemic? On what terms? Should Palantir manage it, or are there more trustworthy alternatives?”

Open Democracy stated its mission is not complete. It is still seeking full transparency on the Palantir deal, wants to know what data is being fed into Palantir’s datastore, and is also keen to ensure that the public consultation the government has promised is far-reaching, not just a “box-ticking exercise”.

Fitzgerald and Crider also wrote: “We also need to fully understand and debate Matt Hancock’s long-term plans for our NHS. Our case was launched amid a major proposed shake-up of laws governing the NHS and its patient data.

"Proposals in the government’s recent white paper for health and social care would centralise NHS control under Matt Hancock, and could prepare the ground for larger slices of the NHS – including its £10bn/year health data assets – to be contracted to private tech firms.”

However, in a statement provided to IT Pro, an NHS spokesperson disputed Open Democracy's claims and said the group "have had to drop their court case unilaterally as it was apparent even to them that the NHS has always acted in accordance with its legal responsibilities.

"They, therefore, stood no chance of succeeding in their completely spurious claim. It would be more honest if they actually came clean with their crowdfunders that far from 'winning' this case they had no choice but to drop it when they realised they hadn’t a leg to stand on," the spokesperson added.

Palantir was awarded an “emergency” contract in March 2020 by the NHS to supposedly assist in handling the COVID pandemic. However, openDemocracy accused the government of “quietly” giving the company a contract extension in December and a bigger role in handling NHS data. The extension was for two years and affected other areas beyond COVID, such as Brexit and more, according to the organisation.

Open Democracy stipulates that the government has a duty to consult the public and users of the NHS before signing major NHS contracts with big tech, which led to the organisation launching the legal challenge in February.

This article originally stated that Open Democracy had won a lawsuit against the NHS. This was incorrect and the article has been updated to reflect this.

Health secretary Matt Hancock has outlined his vision for the digital future of the NHS that operates across a "consistent data platform".

Speaking at the Digital Health Rewired virtual festival, Hancock announced he wants to explore whether a data platform can be created that separates the data layer from the application layer.

This would mean "providers can offer the application software, but the data will be stored separately and securely in the cloud and then we have a consistent data platform across the NHS".

He said it should be made easier to write applications or create services that interact with data from different NHS organisations.

Hancock also said that Shared Care Records will be put in place by September this year, where every local system will have at least a basic version implemented.

“This will mean patients only need to give their details once, and they’ll be captured in a local record that can be safely seen by those who are caring for them,” he said.

There was also an emphasis on the need to “connect the system so data flows appropriately and freely, and we get the intrinsic benefits that high quality data and interoperability can provide.”

He admitted that bringing together the data that usually would have only existed in silos was fundamental to the NHS’s COVID response. He also recognised the need to fill gaps in interoperability where they exist, “ especially the link to social care and responsibilities of the NHS.”

He said that in many ways every day of the last year has “been a session of digital transformation because of this shared experience of fighting the virus, and the vital role technology has played in response.”

The secretary did admit that half of the clinicians questioned in a BMA survey said they had been hampered by issues like internet speed and infrastructure when trying to access online services, and he underlined the need to “get the infrastructure in place.”

It was also revealed that another 32 NHS trusts will be joining the Digital Aspirant programme, which will help boost their digital infrastructure through funding.

“Seven trusts will get up to £6 million over the next 3 years, and the rest will get seed funding to start creating their plans,” he outlined.

Earlier this week it emerged that the digital transformation of the NHS needed “further work” and that the technological innovations implemented during the pandemic need to be improved before being “locked-in.”

In November last year, the health department was blasted for its track record of failed NHS digital projects, with a parliamentary committee warning that there was a need for it to “move on” from its decades-long legacy of “failed attempts” at digital transformation.

Major technological innovations implemented in the NHS during the COVID-19 pandemic need “further work" before they are "locked-in", a new report suggests.

The new technologies implemented by the NHS aim to reduce face-to-face contact and manage demand, such as video consultations, remote monitoring at home, and online appointment bookings.

A Health Foundation report, based on YouGov surveys of more than 4,000 UK adults and over 1,000 NHS staff, examined how new technologies were being received - and found there's still work to be done.

The research found that around three fifths of NHS users increased their use of technology to access care during the first phase of the pandemic and 83% of these viewed their experience positively.

However, when asked to compare this new technology to traditional care models, 42% said they made for worse quality of care. Because of this, the Health Foundation states that the technology implemented during the pandemic must be developed and improved more before the government locks in the new innovations.

Meanwhile, NHS staff stated that one of the top challenges for capitalising on recent technological progress was ensuring adequate IT and equipment and making sure technologies are safe and work for all types of patients.

Furthermore, the report found that while 49% of the public and 61% of staff thought the NHS should be looking to use technology-enabled approaches more in the future, a significant proportion of both public (36%) and NHS staff surveyed (31%) were unconvinced about the long-term use of these approaches.

Tim Horton, the Health Foundation’s assistant director of Improvement, said: “Given the immense pressure the NHS has been under, it is impressive that so many patients and staff reported positive experiences as new technologies were rolled out.

“However, the fast pace at which they were introduced means that important steps – such as evaluation and co-design with patients – will necessarily have been shortcut. As we emerge from the shadow of the pandemic, the NHS must evaluate and improve these approaches before locking them in for the future.”

The report highlights that the government is looking at “locking in” the recent changes made and wants to preserve them for the long term.

“The NHS has not yet ‘sealed the deal’ with the public on the future use of technology and further work is needed to address concerns and build trust in new technologies,” Horton added.

“While the speed of innovation has been hugely impressive, rushing to make these changes permanent without understanding more about their impact would risk holding back promising technologies from fulfilling their potential to improve care for every patient.

“Action is needed by the NHS and government, who have a critical opportunity to secure a positive health care technology legacy from COVID-19.”

In November last year, the health department was criticised for “track record of failed NHS digital projects.” A report published by the Public Accounts Committee called for the Department of Health and Social Care and the NHS to move on from its decades-long legacy of “failed attempts” at digital transformation.

Data can be a huge enabler of transformation and efficiency for every sector, and healthcare is no different. However, there can be some significant challenges in implementing a complete data strategy when it comes to health and medicine, particularly within the framework of the NHS.

This is why the Bradford Institute for Health Research established the Connected Yorkshire programme, in an effort to create a data-sharing platform to speed up research and improve community health throughout the region. This week, we're joined by Connected Yorkshire programme manager Kuldeep Sohal to find out more about Connected Yorkshire's work, the challenges involved with managing data at scale, and how a robust data strategy can help supercharge health and social care.

Footnotes

• What is data and big data mining? An easy guide
• What is big data analytics?
• What is the Information Commissioner’s Office (ICO)?
• What is GDPR? Everything you need to know, from requirements to fines
• Seven steps to GDPR compliance
• How to become a data scientist
• Organisations have been blind to GDPR “business opportunity”
• NHS to inject more robots into healthcare with UWE Bristol partnership
• Microsoft offers free cyber security protection to healthcare staff
• How technology is changing health care
• Microsoft launches public cloud service for health care
• Birmingham NHS trust passes medical data to Telefonica without patient consent

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Welcome to the IT Pro Panel Profile, where we talk to the CIOs, experts and IT leaders that make up the IT Pro Panel, and discover their top tech, pet peeves and IT inspirations.

Public sector IT is a difficult field to work in, particularly when it comes to the occasionally beleaguered and often underfunded NHS. Resources are often stretched, while demands for modernisation and maintenance in a large NHS trust can be significant.

Nevertheless, it is this challenging environment in which Craig York has been operating for nearly two decades. Now the chief technology officer of Milton Keynes University Hospital NHS Foundation Trust, he first started as a technical services manager, and has now worked his way up to leading the trust’s digital strategy.

Craig York

Chief Technology Officer - Milton Keynes University Hospital NHS Foundation Trust

Describe your role in 20 words or fewer.

I’m primarily responsible for digital strategy, planning, development and policy within Milton Keynes University Hospital NHS Foundation Trust.

What was your first computer?

I started with the classic ZX Spectrum. Not the +2 or +3 with integrated tape or disk drive, both of which I’d later get, but the original one that you connected your own tape machine to, played the tape and waited for the game to load. I remember sitting and typing commands into it, and being fascinated by being able to draw shapes with a few lines of code.

What do you like most about working in IT?

I love getting the opportunity to improve the lives of our staff and patients by supporting them with technology. It’s very rewarding.

If you could magically get rid of one piece of technology forever, what would it be, and why?

I’d like to get rid of TV. Kids spend too much of their time watching it, and in my experience they’re just as happy to spend that time reading when they’re encouraged to.

What future tech innovations are you most excited about?

AI; I see massive potential benefits to patients and productivity gains for clinicians and organisations. Imaging given an initial diagnosis in minutes or seconds. Errors can be as high as 5% and I believe that AI and machine learning can improve this.

Who’s your biggest inspiration in the world of tech?

I grew up in the time of Bill Gates andSteve Jobs and if you know Apple, it’s really Steve Wozniak that created things, but the visionary that helped change the world and the devices we use was Jobs. It demonstrated the power of one visionary who believed in something so much.

If you're a senior IT decision-maker and you'd like to apply to be part of the IT Pro Panel, please click here to enter your details.

NHS staff reported being inundated with 43,108 malicious emails during since the coronavirus crisis took shape this year, with half of these phishing attacks landing in inboxes during March alone.

A staggering 21,188 malicious emails targeted NHS workers during March and were reported to spamreports@nhs.net, according to Freedom of Information (FOI) data obtained from NHS Digital by the Parliament Street think tank.

This flood of attempting phishing attacks came during arguably the most precarious time for the NHS during the coronavirus crisis, with the number of phishing attempts dropping off in the following months.

Staff reported 8,085 malicious emails during April, followed by 5,883 reports in May and 6,468 in June. During the first two weeks of July, the latest period for which data is available, staff reported 1,484 to the NHS spam reporting inbox.

"This is an unprecedented time for the NHS, including the cyber security and IT teams who are continuing to work hard in all NHS organisations to keep patient data and systems secure to support the delivery of safe patient care," said chief information security officer at NHS Digital, Neil Bennett.

“As part of NHS Digital’s cyber security operations, we collaborate with all areas of the system to ensure they are aware of potential threats. This includes highlighting the need for staff to report suspicious emails by raising awareness through our Keep I.T. Confidential campaign. We have also published additional advice and guidance for NHS staff around cyber security while remote working.

“We see staff reporting suspicious emails to us as a good thing and the rise in reporting shows that NHS staff are taking seriously their responsibilities to keep information safe.”

The scale of attacks has rendered some modest success for cyber criminals, with NHS Digital confirming in June that 113 NHSmail inboxes were compromised between the weekend of 30 May to 1 June.

There was no evidence to suggest patient data was compromised, and NHS Digital suggested the compromise was part of a wider credential-harvesting phishing campaign targeting a broad range of UK organisations.

The influx of phishing emails chimes with data reported by organisations like the National Cyber Security Centre (NCSC), which received more than a million reports of email scans in just two months.

The likes of Google have also warned against a spike in phishing, with findings in April suggesting that approximately £2 million had been lost to coronavirus-related fraud in the UK alone.

The UN has similarly warned against a 350% surge in phishing websites since the start of 2020, with criminals exploiting the disruption and economic hardships caused by COVID-19.

“The wealth of personal and financial data stored in NHS inboxes is a goldmine to potential hackers, who will use email scams to trick doctors, nurses, and frontline workers inadvertently handing over private information,” said Barracuda Networks’ SVP International, Chris Ross, comment on the news.

“After the WannaCry attack of 2017, the NHS did a great job in eradicating many of its cyber defence weaknesses, however, it’s important that they maintain this resilience and constantly keep up with the developing cyber threat facing them.”

Amazon and Microsoft are some of the US tech firms involved in the NHS-led project to better allocate hospital resources during the coronavirus pandemic.

The data usually collected by the NHS’ 111 telephone service is now set to be combined with additional sources which will be able to predict the need to distribute ventilators, hospital beds, and medical staff across the UK.

Tech companies such as Amazon, Microsoft, Palantir and Faculty AI are reported to be aiding the NHS in developing a visual dashboard showcasing the data already collected by the NHS and its partners. The information includes the use of ventilators (by location and type), the number of hospital staff on sick leave, patient occupancy levels, A&E capacity, as well as the length of the hospital stay for patients who tested positive for COVID-19.

The visual dashboard would make it easier for decision-makers to keep track of the spread of the virus, identify hotspots, manage resources, and even divert patients to the hospitals that are most equipped to take care of them.

"Every hospital is going to be thinking: Have we got enough ventilators? Well, we need to keep ours because who knows what's going to happen - and that might not be the optimal allocation of ventilators," a source in one of the tech companies involved told the BBC.

"Without a holistic understanding of how many we've got, where they are, who can use them, who is trained, where do we actually have patients who need them most urgently, we risk not making the optimal decisions."

According to the BBC, Amazon is providing the cloud computing resources required via AWS, while Microsoft Azure has built "gigantic" data storage capacities. Palantir’s Foundry software is said to combine the data sources together.

The involvement of the companies in the initiative comes after they took part in a digital summit at 10 Downing Street, earlier this month, where Boris Johnson called for support from the tech sector in battling the COVID-19 pandemic. The prime minister has since also tested positive for the virus.

NHS Trusts have been granted a six-month delay to completing crucial cyber security resilience checks while resources are rechanneled into handling the coronavirus outbreak.

The health service's recently established digital transformation body NHSX has given organisations a reprieve to complete their annual cyber security checklists so it doesn’t interfere with the healthcare service's COVID-19 response plans.

Health and care organisations are expected to submit a data security and protection toolkit (DSPT) each year to ensure their systems and databases are hack-proof. It’s especially important given how frequent attacks against healthcare organisations have become.

DSPTs were originally meant to be completed by the end of the month, but organisations now have until 30 September 2020 to complete their DSPT checklists. They are, however, welcome to complete these beforehand, at which point they’ll be awarded ‘Standards Met’ status as normal.

This has given organisations the space to commit additional resources to clinical response to coronavirus, and away from completing the checklist, if need-be.

“It is critically important that the NHS and Social Care remains resilient to cyber attacks during this period of COVID-19 response,” NHSX has told health and care organisations.

“Whilst the DSPT submission deadline is being relaxed to account for COVID-19, the cyber security risk remains high. All organisations must continue to maintain their patching regimes.”

The cyber threat facing the NHS, and other organisations, has never been greater. Any attacks launched against Trusts over the next few months, in the mould of the infamous WannaCry attack of 2017 for instance, could result in significant patient harm with services and systems already stretched.

Hackers have already started exploiting the outbreak to further their malicious aims, according to Reuters, with attackers posing as the US Centre for Disease Control (CDC) in order to launch phishing attempts, for instance.

Two of the most widely-used trojans against healthcare organisations in 2019 were Emotet and TrickBot. All eyes will be on cyber attackers over the next few months, to determine whether or not they’ll continue to launch attacks against healthcare organisations struggling to grapple with the coronavirus outbreak.

NHS trusts in England will be forced to phase out pagers in hospitals by 2021, the Health Secretary Matt Hancock has announced.

Doctors and nurses will instead have to use mobile phones and apps to reduce costs.

The NHS uses around 130,000 pagers at an annual cost of 6.6 million. Most mobile phone companies have stopped supporting pagers and a single device can now cost up to 400, yet still, more than one in 10 of the world's pagers are used by the NHS.

In a statement, the Health secretary said that removing pagers would bring about several benefits. Pagers only offer one-way communication, leaving doctors unaware who is contacting them, the reasons why, or the level of urgency. The tech also does not support the sharing of information between staff on the move.

Hancock said that the NHS must "harness the huge potential of technology".

"The last thing they need are the frustrations of having to deal with outdated technology they deserve the very best equipment to help them do their jobs," he said.

Hancock added: "We have to get the basics right, like having computers that work and getting rid of archaic technology like pagers and fax machines. Email and mobile phones are a more secure, quicker and cheaper way to communicate which allow doctors and nurses to spend more time caring for patients rather than having to work round outdated kit."

Some trusts have already tried out alternative technologies. A pilot project at West Suffolk NHS Foundation Trust (WSFT) in 2017 saved junior doctors 48 minutes per shift and nurses 21 minutes on average. The project used Medic Bleep, a messaging and calling system similar to WhatsApp, with enhanced data protection.

NHS trusts will be allowed to keep some pagers for emergency situations, such as when Wi-Fi fails or when other forms of communication are unavailable, but the majority of them must be phased out over the next three years.

The Department of Health and Social Care has estimated that the WannaCry ransomware attack cost the NHS a total of 92 million, as part of an update into its ongoing investigation of the incident.

Until now the NHS has failed to provide an exact figure on the damage sustained during the ransomware attack in May 2017, and the DHSC admits that the figures presented on Thursday are a "broad estimate" covering the time during and immediately after the attack.

During the attack, in the period of 12 May to 18 May, it's estimated that around 19 million was lost in terms of patient care output, based on the findings that 1% of NHS services were disrupted over a one-week period. In addition to the lost services, it's believed a further 500,000 was spent on dealing with the immediate effects of the IT failure, including the hiring of additional consultants.

The biggest costs came in the June-July period immediately following WannaCry, which is estimated to have cost a further 72 million as the NHS worked to restore its services to full operation and to recover its data.

The WannaCry ransomware attack, which is thought to have affected over 200,000 computer systems across the world, disrupted the services of one-third of the UK's hospital trusts, and approximately 8% of GP clinics. It's believed that around 19,000 hospital appointments were cancelled as a result.

Afflicted systems locked out their users and held hospital data to ransom, demanding a payment in the form of the Bitcoin cryptocurrency. The ransomware also had self-propagating characteristics and was able to spread through a system automatically. The ease at which the ransomware spread has been blamed on an overreliance on outdated operating systems, including Microsoft's Windows XP.

The DHSC says this is the best estimate it can provide at this time, as there has yet to be a systematic collection of data on the costs of recovering IT systems. "At the time, the focus nationally was on responding to the incident and remediation rather than collecting data, which would make an accurate retrospective data collection challenging," the report states.

Unfortunately, this is unlikely to happen any time soon, as attempts to gather such data would place a "disproportionate financial burden on the system".

The estimated losses come as part of an update to an earlier report released in February. Since that time, the DHSC has signed a deal with Microsoft to ease its migration from legacy operating systems to the Windows 10 platform.

It's also pledged to invest an additional 150 million into the system over the next three years, which will be used to protect key services from the effects of cyber attacks. This also includes further investment into the NHS Digital's Cyber Security Operations Centre, founded in November last year, which works to monitor the security of health services at a national level and provide advice to individual NHS organisations.

This means that over 250 million will have been invested to improve the security of the NHS by 2021.

"When ransomware hits an organization, much is discussed about the cost in terms of rebuilding infrastructure, restoring digital records and getting systems back online," said Matt Lock, director of sales engineers at Varonis.

"In the case of the NHS, we may never truly know or be able to quantify the ultimate cost of the WannaCry attack because human lives may have been affected by a delayed ambulance or incorrect treatment."

As part of the report, the CIO for NHS health and care has put forward 22 recommendations, which have now been agreed upon and will be rolled out over the coming years. These include a provision that forces all NHS organisations to adhere to the Cyber Essentials Plus Standard, a framework established by the UK's National Cyber Security Centre (NCSC).

All NHS organisations have also been given until 31 March 2019 to submit a record of compliance to NHS Digital under the Data Security and Protection Toolkit, which acts as a national framework for the data security and protection in healthcare in the UK and incorporates the key legal requirements set out by the General Data Protection Regulations (GDPR).

Improving the NHS's technology will be one of new health secretary Matt Hancock's early priorities, as he pledged a fresh 487 million to initiate digital transformation projects across the health body.

Using his first speech as health secretary to define his early priorities - which also include the workforce and prevention - Hancock talked up the potential for technology to not only save time and money, but improve patient safety and outcomes.

More than 400 million will go towards new technology in hospitals aimed at boosting patient safety and making it easier to access health services from home, he announced before an audience at West Suffolk Hospital last Friday.

An additional 75 million will be made available to trusts to install new systems that increase efficiency and allow clinicians to spend more time with patients - with a target to reduce clinical errors by 50% versus the old paper systems.

"For too long, decisions on health and care have seemed to involve a trade-off - improving patient outcomes at the expense of placing ever more pressure on staff, while reducing the demands on staff has been seen to have an impact on patient care," he said.

"Technology and data innovation offers an opportunity to move past this binary approach."

Hancock highlighted the "instructive" use of Babylon's controversial NHS GP app, a free healthcare app for NHS patients, as an example for how technology can transform healthcare. He also cited the deployment of 'patient barcode' tracking system Scan4Safety in six hospitals as a system that he claims has already saved 8.7 million.

In partnership with Amazon, meanwhile, the NHS Choices service can deliver advice via voice-activated devices - particularly beneficial to visually-impaired users, who won't always have to book a GP appointment.

The new health secretary also stressed the importance of joining up data across the health and social care system, echoing NHS Digital's commitment to fund data-sharing projects.

The health service's digital arm last month invited organisations working with the NHS to apply for 1.5 million in funding that will support projects that ease the flow of data between clinical and social care bodies, and focus on using machine learning-powered tools to boost early intervention.

"Emphatically the way forward is not to curb the technology - it's to keep improving it and - only if we need to - change the rules so we can harness new technology in a way that works for everyone: patient and practitioner," Hancock added.

"Not only can the right use of technology save time and money, it can improve patient safety."

NHS Digital has announced a slew of smaller, separate initiatives over the course of the year geared towards transforming aspects of the health service.

For instance, last month it committed 720,000 to support local councils' digital innovation pilot projects to help social care recipients. This preceded an announcement that NHS Digital would seek private healthcare data to augment its own patient records - and improve the accuracy of the data the NHS holds.

Elsewhere, prime minister Theresa May earlier this year pledged millions of pounds to use AI to improve early diagnosis of cancer and chronic disease.

In a speech delivered earlier this year, May also called for the industry and charities to join the NHS in creating algorithms that can predict a patient's care requirements based on their medical records and lifestyle information.

The NHS is relying on legacy technologies, according to a study by the Royal College of Surgeons (RCS), with almost 9,000 fax machines still in use across the country.

The organisation asked 124 NHS trusts in England to take part in a poll about the technologies they're reliant upon to run their practices and 95 returned responses to its questions.

The Freedom of information Request revealed that in total, the NHS is using almost 9,000 of the outdated machines, many of which are used to send information to other departments and services in the community. 40% of trusts reported using more than 100 fax machines; Newcastle Upon Tyne own the most fax machines, with 603 in operation, Surrey and Sussex Healthcare NHS Trust is using 400 fax machines and Barts Health NHS Trust comes third, with 369 still in service.

Of the trusts that responded to RCS' request, only ten reported that they didn't have a single fax machine in use. This tallies with a similar piece of research into DeepMind Health from last year, which found the NHS to be the largest buyer of fax machines in the world.

"NHS hospital trusts remain stubbornly attached to using archaic fax machines for a significant proportion of their communications. This is ludicrous," Richard Kerr, chair of the RCS commission on the future of surgery.

He added that the organisation must stop relying on technology that the majority of private sector organisations scrapped decades ago, and pointed out the illogical nature of investing in advanced healthcare technologies like AI and robotics while so much of the NHS' communications infrastructure is based such obsolete technology.

"As digital technologies begin to play a much bigger role in how we deliver healthcare, it's absolutely imperative that we invest in better ways of sharing and communicating all of the patient information that is going to be generated."

The government's Public Accounts Committee has today released the findings of its report into the WannaCry ransomware which hit the NHS in May 2017, revealing that not one NHS trust is up to an acceptable standard of cyber security.

Following the WannaCry attack, the report said, the NHS has assessed the cyber security level of 200 trusts. Disappointingly, however, every single trust failed the cyber security assessment - in some cases because they had failed to apply critical patches to their systems, which is the main reason WannaCry was able to spread so widely in the first place.

"The Department and NHS Digital told us that trusts had not passed the test, not because they had not done anything on cyber security, but rather that the Cyber Essentials Plus standard against which they are assessed is a high bar," the report said. "However, some trusts had failed the assessment solely because they had not patched their systems - the main reason the NHS had been vulnerable to WannaCry.

"NHS England told us that it is also concerned that trusts that were not infected by WannaCry could become complacent over cyber security and not keep on top of their cyber security risks."

On top of this, NHS Digital told the committee that it still lacks key information on the cyber security posture of local healthcare facilities, such as the use of anti-virus software and IP addresses.

"Applying patches, downloading securing updates and keeping passwords hard to guess are simple practices that can go a long way, but it seems like this isn't happening among healthcare organisations currently," said David Emm, principal security researcher at Kaspersky Lab.

"Health data is attractive to criminals, and the interconnected medical devices that we are increasingly seeing present across healthcare institutes are susceptible to the same security risks as traditional IT devices."

The report found that around 80 of England's 236 NHS trusts were affected by the ransomware, as well as more than 600 additional NHS organisations such as GP's practises. The incident - which was declared a major incident' by the NHS - resulted in the cancellation of almost 20,000 operations and hospital appointments.

Despite this, however, the DfH still has no estimate of how much money WannaCry cost the NHS, stating that its focus at the time was on caring for patients.

"We recognise that at the time of the attack the focus would have been on patient care rather than working out what WannaCry was costing the NHS," the report read. "However, an understanding of the financial impact on the NHS is also important to assess the seriousness of the attack and likely to be relevant to informing future investment decisions in cyber security."

Further facts about the NHS' troubling level of cyber security (both before and after WannaCry) were also revealed. For example, although the DfH, NHS England and NHS Improvement published a list of 22 recommendations for improving the NHS' cyber security back in February, plans to implement the recommendations have yet to be agreed upon, and the Department for Health still has no idea when it will happen or how much the process will cost.

One of the key issues faced by the NHS in keeping itself secure, the DfH told the committee, is that many local bodies are unable to apply updates and patches to IT systems without disrupting patient care, as many are interdependent on each other.

"Nearly one year on from the WannaCry cyber attack, it is clear that there is a need for constant vigilance within the NHS to ensure that patient data and vital systems are protected," said techUK's head of programme for Cyber and National Security, Talal Rajab.

"It is important to note that WannaCry was not just a wake-up call for the NHS, but for organisations across the public and private sector, to get their house in order and remain prepared in this era of heightened cyber tensions. Further sector-specific guidance can be found through the National Cyber Security Centre."

Some progress has been made, however; since WannaCry hit the NHS, the Department for Health has carved off nearly 200 million to invest in various improvements to cyber security up to 2020, including more support resources for vulnerable organisations, improvements to local infrastructure and addressing major security gaps in major trauma centres and ambulance trusts.

The committee set out a number of further recommendations for the Department for Health as part of the report, including that it should provide support and guidance for local healthcare organisations on how to efficiently patch systems with minimal disruption, as well as ensuring that staffing plans focus on IT and cyber security.

The report also recommended that all of the NHS' contracts IT and equipment vendors include guarantees for support and protection to guard against cyber attack.

Furthermore, the DfH is to provide the government by the end of June 2018 with an estimate for the cost of WannaCry to the NHS and a progress report on the implementation of the recommendations it made in February.

The NHS is inviting developers to submit their digital healthcare applications for inclusion in its Apps Library, in an effort to expand its capabilities as a one-stop-shop for patients.

The Apps Library offers a catalogue of approved, trusted tools to help NHS patients digitally manage their healthcare. The project is currently in public beta and NHS Digital has appointed mobile health app specialist Our Mobile Health to help expand the number of available apps, which currently sits at 46.

Our Mobile Health will assess the suitability of submitted digital healthcare apps, based on how well they meet the clinical, technical and safety standards set by the NHS. The company was selected for the role through the G-cloud 9 framework.

"This agreement with Our Mobile Health is part of our ongoing commitment to setting national standards and helping patients and citizens better manage their health," said NHS Digital programme director, Hazel Jones. "Patients can be confident that the apps they are using are safe and trusted. We are looking forward to working with Our Mobile Health in developing that process."

"In the future we hope to invite more third-party assessors to work with us on the assessment procedure and develop and speed up the system so that we can improve the array of apps featured on the Library. This is an exciting opportunity for the many developers out there that come from all sections of the market to put forward their apps for assessment."

"Digital technology is now a part of all our lives and in the NHS we want to harness the advantages of digital to improve services and empower patients to take control of their own health," said NHS England chief digital officer Juliet Bauer.

"Through this partnership with Our Mobile Health, the NHS Apps Library will grow, providing the public with even more NHS and recommended apps they can use to manage their health and well-being. Apps can provide a real insight into patients' conditions, enabling clinicians to deliver better, more relevant treatment and give patients more control over their care."

Image credit: Bigstock

In May 2017, a ransomware attack of unprecedented scale was unleashed on the world, with the NHS in England and, to a lesser extent, Scotland being hit the hardest of any organisation in the UK. Around 70,000 devices were infected, leading the attack to be known colloquially as the NHS hack.

How such an attack happened and how it was shut down offers valuable information to IT professionals on how to avoid falling victim to such an incident themselves in the future.

Day Zero: 12 May 2017

In the early morning of 12 May, reports started to emerge of the first computers infected by WannaCry. While some researchers, including those at Sophos concluded the first infections cropped up in Asia, it wasn't until Spanish telecoms giant Telfonica reported its systems had been compromised that it started to come to the attention of those with an interest in technology and security.

Within just a few hours the attack had snowballed, swallowing up an estimated 47 NHS Trusts in England and Scotland. Other high-profile victims included Deutsche Bahn, Renault, FedEx and the Russian Ministry of the interior.

The impact on the NHS was particularly potent, with approximately 70,000 devices including MRI scanners, blood storage refrigerators and operating theatre equipment, as well as computer terminals, being infected.

Some hospitals, including Barts in London, had to cancel routine planned operations, while others told patients only to come to A&E if it was a "life-threatening emergency".

In the end, it's thought that around 200,000 devices running Microsoft Windows were infected across 150 countries.

Aftermath and investigation

Somewhat miraculously, WannCry was stopped in its tracks the same day it started by a 22-year-old British cyber security researcher, Marcus Hutchins, who discovered a kill-switch' embedded in the ransomware's code.

This was a considerable stroke of luck for the world's IT systems, but for those that had already been affected, there was a lot of cleanup to be done, including disinfecting and restoring systems, patching (more on that in a minute) and so on.

For the NHS, this also included rescheduling all the routine appointments that had to be cancelled, leading to disruption that continued over the following few weeks.

It was also in the wake of the attack's subsidence that questions began to be raised about how such an infection was able to run rampant in the first place, given Microsoft had already issued a patch for the vulnerability exploited by WannaCry.

While the ransomware wasn't targeted, as the wide range of organisations affected demonstrates, it unwittingly took advantage of a critical weakness in many business systems "just patch" isn't always an option.

In large organisations in particular, there are often valid reasons systems can't be patched or updated. The most common among those is dependance on critical applications or hardware that aren't compatible with newer operating systems or some patches.

In this scenario, IT administrators face a choice: update the system, but potentially risk rendering inoperable a very expensive piece of hardware or the patient database software, or don't update it in order to keep the organisation running, but risk a crippling attack, as happened in May. Most take the potential risk of being hit by ransomware or another infection in the future over the certainty of breaking existing infrastructure.

Mitigation is better than a cure

Here's the obvious advice: patch your systems.

"WannaCry only hit organisation running older versions of Windows, so the obvious advice is to update those, which of course has a cost," says Bob Tarzey, analyst and director at Quocirca.

But, as stated above, that's not always possible.

"Another option is to better isolate older systems," Tarzey continues.

Jeff Pollard, principal analyst at Forrester, agrees: "We recommend a zero trust' approach to security strategy. Zero trust means trusting nothing people or systems until they prove they are trustworthy. Make sure environments are segmented so an automated worm [like WannaCry] can't infect every system."

This has the primary benefit of isolating the infection, which means not needing to throw the switches on all systems in order to stop it from spreading an approach that had to be taken by some NHS trusts, despite being disruptive in itself.

Pollard further advises organisations "understand the identity of users, systems, and workloads, and make sure that least privilege is in place".

There's also the question of having an educated and aware workforce. Although WannaCry wasn't spread via phishing emails, many ransomware infections and other malware attacks are, so drilling into users that they mustn't open links and attachments, particularly if they're unexpected, is vital. Other basic steps include having an enterprise-grade firewall in place, as well as business-focused anti-malware software running wherever it can (although, once again, in some embedded systems this might not be possible).

WannaCry was unusual in the way it attacked systems and the speed with which the infection spread, with the high-profile nature of the victims also being notable. What was surprising in May, however, may become par for the course in the future and this is an eventuality organisations must prepare for.

"Breaches and malware infections are inevitable. What matters is the ability to continue to operate, contain the issue, and bounce back from the problem and get back to business as usual," Pollard concludes.

Make sure your organisation is resiliant enough to bounce back from an attack like this...

Jeremy Hunt has called for the NHS to deliver digital services nationwide.

Speaking at the Health and Care Innovation Expo in Manchester yesterday, the health secretary said that by the end of 2018 every patient in England should be able to access their medical records and book an appointment with a GP through an app.

Hunt added that every patient should be able to carry out seven online activities including accessing NHS 111, the non-emergency number, finding out their healthcare record, booking a GP appointment, and ordering prescriptions.

Other activities include choosing whether to donate their organs after death, expressing their data sharing preferences and accessing support for managing a long-term condition.

Hunt said: "If the NHS is going to be the safest, highest quality healthcare system in the world we need to do technology better. So today I am setting seven challenges which, if we achieve them, will make the NHS a world-beater in the care of people with long term conditions."

The health secretary also announced the launch of the MyNHS open data challenge, a 100,000 fund for the most creative apps and digital tools to improve services.

Imelda Redmond, national director of Healthwatch England, said: "The vision set out by the secretary of state directly addresses what patients and the broader public have told Healthwatch they want from a modern NHS, and is a huge step forward in ensuring all of us get the sort of integrated service we have come to expect in many other areas of life."

In July it emerged that 46% of NHS directors are concerned about the government's separate 2020 target for the NHS to go digital. Almost half of the respondents to an OpenText survey said they lack the technology systems or skills necessary to complete the digital transformation in four years.

NHS trusts are spending 158,038 every day on 243 new hardware devices, according to data from Freedom of Information requests.

The data, compiled from 197 NHS trust responses to FoIs, shows that since the start of 2013 these trusts have got rid of 237,422 laptops and computers, equivalent to 144 per day. In this same period, the total money spent on new PCs was more than 260 million on 401,084 new PCs, at an average cost of 650.

Memory and storage firm Crucial conducted the FoIs, as well as a study of 2,000 healthcare professionals that found 42% of them blame IT for making their jobs more difficult, often spending too much time fixing others' IT issues as well as their own.

More than a quarter of the survey respondents were embarrassed to admit they lack technology skills, while 5% admitted not knowing how to send an email. One-fifth said they did not know how to scan their PC for viruses.

"The NHS is clearly investing in new hardware, spending 260 million since 2013 on new PCs, many of these presumably replacing the 237,422 PCs disposed of during the same period," said Jim Jardine, a director of DRAM product marketing for Crucial. "But despite this spend, it's clear that more training or IT support in using these new systems is needed to help give healthcare workers the means of being productive."

The news follows last week's announcement that the NHS will get 21 million to boost their cyber defences following the WannaCry ransomware attack. The money is to be spent on increasing cyber security measures at major hospitals and boosting NHS Digital's national monitoring and response capabilities.

Additionally, it prioritised migrating NHS systems from Windows XP, the Microsoft operating system that expired three years ago. A number of trusts were expecting to migrate from Windows XP by March 2015, but many were still running XP in December 2016, blaming government austerity measures and the impact of Brexit on IT prices.

NHS hospitals will receive 21 million to upgrade their cyber security measures following the WannaCry attacks that wreaked havoc on NHS IT systems earlier this summer.

The Department for Health (DfH) announced the funding yesterday as the government accepted all the recommendations set out by the National Data Guardian review and the Care Quality Commission review into data security standards, carried out before the ransomware debacle.

Health minister Lord O'Shaughnessy said in a statement: "The NHS has a long history of safeguarding confidential data, but with the growing threat of cyber attacks including the WannaCry ransomware attack in May, this government has acted to protect information across the NHS.

"Only by leading cultural change and backing organisations to drive up security standards across the health and social care system can we build the resilience the NHS needs in the face of a global threat."

The 21 million will be spent on increasing cyber security measures of major trauma hospitals, with the government calling this "an immediate priority", as well as boosting NHS Digital's national monitoring and response capabilities.

It also prioritised finding a way to finally migrate NHS systems from Windows XP, the Microsoft operating system that expired three years ago.

XP was at first identified as a prime attack vector for the WannaCry ransomware attacks in May due its lack of security updates, until Kaspersky Lab discovered that the in-support Windows 7 accounted for 97% of operating system among affected machines.

WannaCry locked NHS files, demanding a ransom be paid to unlock them again, causing chaos for 48 hospitals relying on this data for upcoming operations and appointments, many of which had to be cancelled.

The DfH also said NHS trusts will have to bring their policies in line with the National Data Guardian's recommendations - outlined in a report last year - that are designed to bolster healthcare data protection standards.

These include carrying out security training for staff, reviewing processes annually, and drawing up contingency plans for data security threats.

NHS Digital will support hospitals by carrying out on-site assessments and sharing best practice among UK trusts, as well as raising general awareness through broadcast ads and providing a hotline for dealing with cyber incidents.

The funding and stricter cyber security measures were part of a response to the CQC and National Data Guardian's reviews, which had warned of the likelihood of an impending cyber threat.

In the fallout after the WannaCry attacks, the Chartered Institute of IT blamed the security breaches on a lack of investment and accountability for IT security measures within the NHS.

Picture: Bigstock

Healthcare systems have a critical place in almost every country around the world, but they're increasingly becoming a lucrative target for hackers. Just last month, the National Health Service fell victim to the WannaCry global ransomware attack, which targeted computers and networks running Windows.

Around 40 hospital trusts in the UK were affected by the attack, with doctors and healthcare professionals unable to access vital computing resources and medical records unless they paid a Bitcoin ransom. As a result, they had to cancel operations and appointments, causing potentially life-threatening scenarios.

In a similar case, a hacker managed to compromise Atlanta-based Emory Healthcare's patient database and delete vital appointment data. They were also able to access patient information such as names, dates of birth, contact information and medical record numbers. Overall, around 80,000 patients were affected by the hack.

The risks are clearly great. Hospitals are also reliant on highly technological medical appliances - from sophisticated scanners to operation equipment - and the ramifications could be life-threatening if a cyber criminal were to compromise them. There's clearly a vital need for effective cyber security procedures.

Systems can't be updated easily

Despite making investment in new technologies, healthcare organisations are often a lucrative target for cyber criminals predominantly because they rely still rely on ageing infrastructure and overstretched budgets. They simply don't have the means to cope when a large scale occurs, and that's a concern to many.

John Bambenek, threat intelligence manager at Fidelis Cybersecurity, says one of the biggest issues here is that healthcare organisations use embedded operating systems that can't easily be patched due to patient safety regulations.

"As proven by the recent spate of hackers targeting the public sector, the healthcare system is far from immune when it comes to cyber attacks. Indeed, it is unfortunately a lucrative target," he says.

"The chief issue in healthcare is that some medical devices have embedded operating systems, largely Windows-based. While the operating systems are updated constantly with new patches, due to medical regulations in patient safety, the devices can't be patched as quickly. There is also a disparity between operating systems that are designed to last only years, compared to devices that have a lifetime of decades. Clearly, the technological and regulatory risks of this situation were never fully considered.

He adds that healthcare professionals are increasingly being exposed to ransomware attacks, where they're expected to pay a financial sum to regain control of critical data. "Most recently, this has materialised in ransomware attacks, where hackers demand bitcoin for control of the data to be passed back to its owner.

There is also the high probability, however, that organisations within the health industry have or will fall victim to other types of attack, such as DDoS or SQL injection attacks, not to mention the number of complementary tactics cyber criminals use; such as phishing and credential re-use," he tells IT Pro.

Legacy technology is dangerous

Paul Calatayud, chief technology officer at FireMon, also takes the view that legacy technology is causing major problems for hospitals. He believes that they need to begin investing in new intelligence tools so they can get a more accurate overview of their systems, even if budgets are tight.

"Hospital networks continue to be an easy target for attackers as these systems were often set up decades ago. To aid IT Security professionals, they need the intelligence tools that give them complete visibility into their security infrastructure and can ensure the right access is given to the right people," he says.

"This starts by employing proper management who can see the whole security infrastructure and make sound security decisions based on this information provided. Deploying proper firewall policy auditing is a quick and easy way to begin to identify these more outdated services. Using Secure File Transfer Protocol (SFTP) tied to active directory would greatly reduce the risks. The WannaCry attack highlighted how fragile hospital security is so you would hope new adequate security and risk management systems are being implemented to reduce the complexity levels within modern day hospital security."

Nik Whitfield, CEO of security intelligence solutions provider Panaseer, advises healthcare operators to invest in up-to-date technology and develop an understanding of cyber security practices.

"Healthcare organisations of all sizes are exposed to the risk of destructive malware. The key for executives is to develop and maintain cyber hygiene to manage their exposure to the impact of attacks. This includes understanding the risks of old IT systems and decisions not to upgrade technology," he says.

"They don't need to become experts in this kind of threat. Just like people don't need to know about every possible disease; we just need to eat well, stay hydrated, wash our hands and so on. Then, most of the time we'll be fine. We don't need to become experts in every disease. Similarly, every healthcare organisation needs to maintain a level of good cyber hygiene: they need to understand what assets they have, keep software up to date, patch regularly, and educate their employees. This can stop the vast majority of attacks."

Lucrative opportunity for hackers

Neil Bramley, B2B client solutions business unit director at Toshiba Northern Europe, says cyber criminals are targeting healthcare organisations because of the amount of personal data available. However, he also argues that mobile-oriented remote working can act as a gateway for hackers. "With significant amounts of highly sensitive Personally Identifiable Information (PII) at the heart of day-to-day operations, healthcare organisations will increasingly find themselves a preferred target of cyber criminals," he says.

"This is only heightened as healthcare professionals, enabled by mobile devices, begin to work on the move for example, visiting patients at their homes or across different clinical settings. While such devices provide mobility and increased productivity, they may also act as a potential gateway for attackers, and organisations must put in place a security infrastructure which ensures patient data remains robustly protected."

More areas at risk than others

Healthcare is a diverse field, and there are people out there who believe that some areas are at more risk than others. Martyn Williams, managing director of industrial software expert COPA-DATA UK, explains that the pharmaceutical sector is vulnerable to cyber attacks due to the fact that it's constantly looking for cheaper ways to produce medicine. The result? A lack of investment in new technology and systems.

"The patent model in the pharmaceutical industry forces manufacturers to seek out the cheapest possible ways to produce medication. This results in a decreasing of investment in new machinery, ingredients, optimisation measures and most importantly, software.

Bitsight, an organisation that measures how vulnerable companies and industries are to cyber-attacks, reported that cyber security attacks on the healthcare and pharmaceutical industries have worsened at a faster rate than other industry sectors," he tells us.

"With the average clean up' time for these sectors following a cyber-attack at just over five days, there is certainly some cause for concern. Similarly, a report by OCISIA, in collaboration with the UK information intelligence experts, BAE Systems Detica, estimated the cost of cybercrime to the UK economy to be around 27 billion annually. The same report named the pharmaceutical and biotech sectors amongst the hardest hit industries.

"In the eyes of a cyber criminal, the pharmaceutical industry provides a treasure trove of valuable information. Organisations within the sector from manufacturers to CROs and CMOs can hold highly sensitive material, from personal patient data to confidential research on drug development and testing. This makes the pharmaceutical industry an attractive target for cyber attacks."

If a healthcare system fails, then there's a chance that lives could be put at risk, and clearly that must be avoided at all costs. However, that's not stopping cyber criminals from compromising crucial medical systems. They see hospitals as easy targets, and this can only change through increased investment in effective cyber security and modern computing systems.

The legal justification used for sharing patient data from a London NHS hospital to Google-owned DeepMind wasn't valid, according to the National Data Guardian.

Health-data watchdog Dame Fiona Caldicott expressed her legal opinion of the controversial DeepMind data sharing deal in a letter to the head of the Royal Free NHS trust, after being asked for advice from the Information Commissioner, Elizabeth Denham.

The NHS trust teamed up with the deep-learning firm to trial a kidney app called Streams, which is designed to predict organ failure and avoid patient illness. As part of that, the trust shared 1.6 million patient records with the Google-owned British startup, a data-sharing move that was called "inexcusable" by academics who examined the deal.

Now, it appears our National Data Guardian agrees. Writing to Stephen Powis, medical director at the Royal Free NHS Trust, Caldicott particularly criticised the justification for the data sharing, saying it was implied that it was for patient care - but she noted that's not what the Streams trial was actually about.

"Taking into account what you have now clarified, it is my view and that of my panel that the purpose for the transfer of 1.6 million identifiable patient records to Google DeepMind was for the testing of the Streams application, and not for the provision of direct care to patients," Calidcott said in the letter, shared Hal Hodson, who initially revealed the data sharing agreement while a New Scientist reporter, and who also co-authored the aforementioned paper.

"Given that Streams was going through testing and therefore could not be relied upon for patient care, any role the application might have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer," she wrote. "My considered opinion therefore remains that it would not have been within the reasonable expectation of patients that their records would have been shared for this purpose."

Caldicott has shared that opinion with the Information Commissioner as part of the data watchdog's investigation.

Caldicott added that guidance would be "useful" to organisations looking to test such technologies with patient data, and stressed that her and her panel of experts "keenly appreciate the great benefits that new technologies such as Streams can offer to patients".

However, she stressed that misusing patient data could delay the use of such technologies. "As I know you also appreciate, wherever patient data is used, it is absolutely paramount that this is done in a transparent and secure manner, which helps to build public trust, otherwise the full benefits of such developments will not be realised, and indeed harm may be done."

DeepMind altered its data-sharing setup with the NHS after the initial round of complaints, and has since set up more trials.

The personal information of thousands of health workers in Wales has been stolen in a data breach affecting an IT supplier. NHS England and Scotland have also been affected to a lesser extent.

More than 1,000 staff in two NHS trusts, Velindre and Betsi Cadwaladr University Health Board, had their names, dates of birth, radiation doses and National Insurance numbers stolen. The breach primarily affects current and former staff working with with X-rays, such as radiographers, as well as cleaners and students.

The organisation in question, Landauer, provides ionising radiation monitoring services. Velindre NHS Trust said Landauer experienced a data breach on 6 October 2016, but that it didn't make contact with the trust, which manages the Radiation Protection Service on behalf of all Welsh health boards, until 17 January this year.

There was an even longer delay in telling affected staff, however, who were only contacted in "the last few weeks", according to BBC Good Morning Wales, which broke the story. The programme said managers in the health service will be investigating the reason for the delay.

Betsi Cadwaladr University Health Board said in a statement: "We have been informed by Velindre NHS Trust who manage the Radiation Protection Service on behalf of health boards in Wales that the third party provider of the service, Landauer, has experienced a data security attack on one of its UK servers which affects our staff.

"No patient information has been affected by this breach. We have contacted all the staff affected to reassure them that Landauer has acted swiftly to secure its servers and that, since the attack, it has undertaken significant measures in connection with its UK IT network to ensure that no further information can be compromised."

Velindre cancer services director, Andrea Hague, said: "Velindre NHS Trust has identified around 530 of its own staff affected by the breach and we have written to all those involved.

"Notification of the data breach was received by the Trust on 17 January this year, but it is understood that the actual incident happened in October 2016. The reasons behind this delay in notifying us of the breach are the subject of ongoing discussions with the host company."

The Welsh government, meanwhile, said it is aware of the incident "and will be expecting full details of the investigation and outcome" and the UK's data privacy watchdog, the Information Commissioner's Office, said it is aware of this incident and making enquiries.

IT Pro has contacted NHS England, NHS Scotland and Landauer for comment, but they had not responded at the time of publication.