NHS computer systems hacked!?

The NCSC, the guideline body to the NHS consult, is entirely Cloud/SaaS/IaaS hosted, even it that technically forms PaaS too.

Excellent. Are they providing the funding to migrate to it? While the cloud is great as it forces you to properly realise and cost solutions on going, the knock on effect of this is, it costs money! The NHS does not have enough funding, does not fund IT sufficiently and the case for taking money directly out of healthcare and in to IT is always a tough sell unless it has clear benefits to providing healthcare.
 
They have taken strict guidance from the NCSC to follow their mandate of aggressive patching. I was on the NHS England deployment committee for the W10 proposal.



Eh? This is 2018. Who still has on premise servers? The deal includes a move to Azure and O365

Pretty much everyone uses hybrid, very few are 100% cloud
 
Today my colleague emailed everybody on our Health Records system to look out for a set of Medical Records and idiots pressing REPLY TO ALL nearly took our email system down.
It got so bad that staff were ringing her up to have a go at her but she stuck to her guns saying the issue is with the idiots replying to everybody instead of just her.
In the end IT had to send an email to everybody to stop replying to the email and to only reply if they knew anything about the records.
 
Eh? This is 2018. Who still has on premise servers? The deal includes a move to Azure and O365

On premise servers have some major advantages over cloud servers. We are a web hosting company and have a lot of systems in the cloud, but cloud servers just don't have the bandwidth and availability that on premise servers have, lose your internet connection and you lose access to critical systems.
 
Today my colleague emailed everybody on our Health Records system to look out for a set of Medical Records and idiots pressing REPLY TO ALL nearly took our email system down.
It got so bad that staff were ringing her up to have a go at her but she stuck to her guns saying the issue is with the idiots replying to everybody instead of just her.
In the end IT had to send an email to everybody to stop replying to the email and to only reply if they knew anything about the records.

well at least the mailing list didn't end up getting subscribed to porn hub, gay dating sites, UKIP etc.. :D

this started at a UK university when someone spoofed the Provost's email and sent a simple one word e-mail saying "bello!" to "all-students"

https://www.buzzfeed.com/patricksmith/bellogate?utm_term=.vm2XN2ZZWj#.cwXBv0wwxQ

the resulting reply all e-mails quickly got out of control, with the various subscriptions and general silliness

even had a spoof e-mail from the service desk:

qywv5K4.png

Really your IT department shouldn't allow access to these sorts of mailing lists for all users precisely because of this problem with people replying all etc... perhaps your colleague could have made use of BCC too tbh...
 
Last edited:
Really your IT department shouldn't allow access to these sorts of mailing lists for all users precisely because of this problem with people replying all etc... perhaps your colleague could have made use of BCC too tbh...

The Health Records Notes system is called Filefast which everybody has to use to track notes in & out. Within that software you are able to ask everybody if they have come across a set of notes if they are missing. It has been a very long time (4 years!) since I've seen such a request and it has caught everybody off guard. I told my colleague that if she ever uses it again to put ONLY REPLY IF YOU KNOW WHERE THE NOTES ARE AND DO NOT REPLY TO ALL.
The funny thing is I was asked to get involved, used my experience to find the tracking of 3 sets of notes and worked out that volume 3 were on a Ward and been tracked wrong :)
That is also another major problem that has never been sorted, you can have volume two of Hospital Notes and people track them as number 1.
 
On premise servers have some major advantages over cloud servers. We are a web hosting company and have a lot of systems in the cloud, but cloud servers just don't have the bandwidth and availability that on premise servers have, lose your internet connection and you lose access to critical systems.

If you lose internet access, your on premise servers won't be hosting any content outside of your location so I'm not sure I see what you're getting at. Sure, you can admin in to a server on prem even if your internet to your premises is down. With the cloud, you just go and work from home, or Costa. The cloud service is unlikely to have gone down.
 
If you lose internet access, your on premise servers won't be hosting any content outside of your location so I'm not sure I see what you're getting at. Sure, you can admin in to a server on prem even if your internet to your premises is down. With the cloud, you just go and work from home, or Costa. The cloud service is unlikely to have gone down.

We are a web development company, we have a number of SQL/web servers which are used for development purposes that are on premise as well as file servers that are used by virtually all the teams, if they were in the cloud and we had internet connectivity problems (which does happen on occasion) we would essentially lose the ability to do any work whatsoever. Not to mention how slow file transfers from the cloud would be over a 100Mb internet connection compared to a 10Gb LAN connection...

Your idea that the 120 staff should leave the office to go and work from home is absurd, aside from not having the equipment needed to do this sort of work at home, it creates huge communication problems.
 
If you lose internet access, your on premise servers won't be hosting any content outside of your location so I'm not sure I see what you're getting at. Sure, you can admin in to a server on prem even if your internet to your premises is down. With the cloud, you just go and work from home, or Costa. The cloud service is unlikely to have gone down.

How does that help a nurse trying to upload eobs from the bedside?
 
How does that help a nurse trying to upload eobs from the bedside?

Cloud doesn’t work well for the NHS, you need vast amounts of data available (MRI/CT scans etc) which is challenging over the internet as well as extremely robust (well nothing is robust in the NHS) systems for lab requesting/results and patient data.

Losing your internet connection and losing access to imaging/lab systems is risky business. Having said that on-site is nowhere near as robust as it should be in the NHS because everything is done on the cheap.
 
MRI and CT have been able to be transferred when needed online for years to other trusts. I think we were doing it locally pretty quickly after the very first digital images started to be used. our local radiologists do their on call from home these days

Lab stuff and records work very well cloud based in primary care, and again has advantage that you can work offsite. I’ve done telephone surgeries from home when I was physically out of action after knee surgery.
 
MRI and CT have been able to be transferred when needed online for years to other trusts. I think we were doing it locally pretty quickly after the very first digital images started to be used. our local radiologists do their on call from home these days

Lab stuff and records work very well cloud based in primary care, and again has advantage that you can work offsite. I’ve done telephone surgeries from home when I was physically out of action after knee surgery.

Transferring a small volume of scans offsite is fine, having multiple clinical teams having all having access simultaneously whilst uploading all the new imaging in a day is a different issue. Actually looking at how big a file is though they’re a lot smaller than I thought, it’s likely doable from a bandwidth point of view, but reliability is still an issue (looking at the amount of times we’ve lost power, let alone internet connectivity in my time).

Lab stuff may work fine in primary care when it’s not time critical, but that wouldn’t float in secondary care.
 
Last edited:
I wouldn't say they are the most important systems either*. I'd put these above it in importance: phones (100% uptime essential), eprescribing (guaranteed needs to be running on ward round times (inflexible)), eobs (patient safety critically impacted), PAS and bed management. The loss of these systems will truely cripple an acute trust.

The question is not really can cloud be done reliably, it is, can cloud be done in a cost effective way for the NHS while meeting the needs of it.


Edit: *Not saying that an extended outage wouldn't be just as bad!
 
You go back to pieces of paper and phone calls for the extremely rare time it doesn’t work.

Have you tried that? It’s extremely risky and played its part in the Bawa-Garba case. I’d rather not risk my freedom and career trying to hold up an X-ray to the ceiling light because we can’t find a light box.

Also extremely rare outages would be great, not the case however, and that’s with on site servers. We’ve had multiple internet outages over recent years in the trusts I’ve worked in. We’ve had phone outages for protracted periods and we were using walkie talkies for a whole weekend.

Plus trusts had to cut their net access due to the Wannacrypt.

I’m no IT expert and my opinion is irrelevant but shoving everything in the cloud is not always the best option.
 
Last edited:
Back
Top Bottom