Category Archives: NHS

Aftermath of the cyber attack – will ministers learn the wrong lessons?

By Tony Collins

At least 16 NHS trusts out of 47 that were hit by the ransomware attack continue to face problems, according to BBC research.

And, as some patients continued to have their cancer treatments postponed, Tory, Labour and Lib-dem politicians told of their plans to spend more money on NHS IT.

But will any new money promised by government focus on basic weaknesses – such as the lack of interoperability and the structural complexities that made the health service vulnerable to cyber attack?

Last year when the health secretary Jeremy Hunt announced £4bn for NHS IT, his focus was on new technologies such as smartphone apps to order repeat prescriptions rather than any urgent need to upgrade MRI, CT and other medical devices that rely on Windows XP.

Similarly the government-commissioned Wachter review “Making IT Work: Harnessing the Power of HealthInformation Technology to Improve Care in England made no mention of Windows XP or any operating system – perhaps because ministers were much more likely to welcome a review of NHS IT that focused on innovation and new technologies.

Cancer treatments postponed

The Government’s position is that the NHS was not specifically targeted in the cyber attack and that the Tories are putting £2bn into cyber security over the next year.

Theresa May said yesterday,

“It was clear warnings were given to hospital trusts but this is not something that was focused on attacking the NHS. 150 countries are affected. Europol says there are 200,000 victims across the world. Cyber security is an issue we need to address.

“That’s why the government, when we came into government in 2010, put money into cyber security. It’s why we are putting £2bn into cyber security over the coming year.”

Similarly Jeremy Hunt, health secretary, told the BBC that the attack affected international sites that have “some of the most modern IT systems”.

But the BBC’s World at One gave an example of how the NHS’s IT problems were affecting the lives of patients.

It cited the case of Claire Hobday whose radiography appointment for breast cancer at Lincoln County Hospital was cancelled on Friday (12 May 2017) and she still doesn’t know when she’ll receive treatment. Hobday said,

“I turned up by hospital transport for my second radiotherapy session, and I, along with many other patients – at least 20 other people were waiting – and they said the computers weren’t working.

“I do have to say the staff were very good and very quickly let us all know that they were having trouble with the computers. They didn’t want to misinform us, so they were going to come and talk to us all individually and hoped they would be able to rectify it.

“Within half an hour or so they came out and said, ‘We’re really sorry but it’s not going to get sorted. We’ll send you all home and give you a call on Sunday’ which didn’t happen.

“But they did ring me this morning (15 May 2017) to say it’s not happening today and if transport turns up please don’t get in it, and it’s very unlikely it will happen tomorrow.

“It is just a bit upsetting that other authorities have managed to sort it but Lincolnshire don’t seem to have been able to do that.”

United Lincolnshire Hospitals Trust told World at One it will be back in touch with patients once the IT system is restored.

Roy Grimshaw was in the middle of an MRI scan – after dye was injected into his blood stream –  when the scan was stopped and he was asked to go back into the waiting room in his gown, with tubes attached to him, while staff investigated a computer problem. After half an hour he was told the NHS couldn’t continue the scan.

Budgets “not an issue”?

GP practices continue to be affected. Keiran Sharrock, GP and medical director of Lincolnshire local medical committee, said yesterday (15 Mat 2017) that systems were switched off in “many” practices.

“We still have no access to medical records of our patients. We are asking patients to only contact the surgery if they have an urgent or emergency problem that needs dealing with today. We have had to cancel routine follow-up appointments for chronic illnesses or long-term conditions.”

Martha Kearney – BBC World at One presenter –  asked Sharrock about NHS Digital’s claim that trusts were sent details of a security patch that would have protected against the latest ransomware attack.

“I don’t think in general practice we received that information or warning. It would have been useful to have had it,” replied Sharrock.

Kearney – What about claims that budget is an aspect of this?

Sharrock: “Within general practice that doesn’t seem to be the reason this happened. Most general practices have people who can work on their IT and if we’d been given the patch and told it needed to be installed, most practices would have done that straight away.”

GCHQ

World at One also spoke to Ciaran Martin, Director General for Government and Industry Cyber Security.  He is a member of the GCHQ board and its senior information risk owner.  He used to be Constitution Director at the Cabinet Office and was lead negotiator for the Prime Minister in the run-up to the Edinburgh Agreement in 2012 on a referendum on independence for Scotland.

Kearney: Did your organisation issue any warnings to the health service?

Martin: “We issue warnings and advice on how to upgrade defences constantly. It’s generally public on our website and it’s made very widely available for all organisations. We are a national organisation protecting all critical sectors and indeed individuals and smaller organisations as well.”

Huge sums spent on paying ransoms?

Kearney asked Martin, “How much money are you able to estimate is being spent on ransoms as a result of these cyber attacks?” She added,

“I did hear one astonishing claim that in the first quarter of 2016 more money was spent in the USA on responding to ransomware than [was involved] in armed robberies for the whole of that year?”

Martin: “First let me make clear that we don’t condone the payment of ransoms and we strongly advise bodies not to pay and indeed in this case the Department of Health and the NHS have been very clear that affected bodies are not to pay ransoms. Across the globe there is, sadly, a market in ransomware. It is often the private sector in shapes and sizes that is targeted.”

Martha Kearney said the UK may be a target because it has a reputation for being willing to pay ransoms.

Martin, “We are no more or less a target for ransomware than anywhere else. It’s a global business; and it is a business. It is all about return on investment for the attacker.

“What’s important about that is that it’s all about upgrading defences because you can make the return on investment lower by making it harder to get in.”

If an attacker gets in the aim must be to make it harder to get anything useful, in which case the “margin on investment goes down”. He added,

“That’s absolutely vital to addressing this problem.”

Are governments at fault?

Martin,

“Vulnerabilities will always exist in software. Regardless of who finds the underlying software defect, it’s incumbent on the entire cyber security ecosystem – individual users, enterprises, governments or whoever – to work together to mitigate the harm.”

He added that there are “all sorts of vulnerabilities out there” including with open source software.

Windows XP

Computer Weekly reports – convincingly – that the government did not cancel an IT support contract for XP.

Officials decided to end a volume pricing deal with Microsoft which left NHS organisations to continue with XP support if they chose to do so. This was clearly communicated to affected departments.

Government technology specialists, reports Computer Weekly, did not want a volume pricing deal with Microsoft to be  “comfort blanket” for organisations that – for their own local reasons – were avoiding an upgrade from XP.

Computer Weekly also reported that civil servants at the Government Digital Service expressed concerns about the lack of technical standards in the NHS to the then health minister George Freeman.

Freeman was a Department of Health minister until July 2016. In their meeting with Freeman, GDS officials  emphasised the need for a central body to set technical standards across the NHS, with the authority to ensure trusts and other organisations followed best practice, and with the transparency to highlight those who chose not to.

A source told Computer Weekly that Jeremy Hunt was also briefed on the security risks that a lack of IT standards would create in a heavily-federated NHS but it was not considered a priority at that top political level.

“Hunt never grasped the problem,” said the source.

There are doubts, though, that Hunt could have forced trusts to implement national IT security standards even if he’d wanted to. NHS trusts are largely autonomous and GDS has no authority to mandate technical standards. It can only advise.

How our trust avoided being hit

A comment by an NHS IT lead on Digital Health’s website gives an insight into how his trust avoided being hit by the latest cyber attack.  He said his trust had a “focus on perimeter security” and then worked back to the desktop.

“This is then followed up by lots of IG security pop ups and finally upgrading (painfully) windows XP to windows 7…” He added,

“NHS Digital have to take a lead on this and enforce standards for us locally to be able to use.”

He also suggests that NHS Digital sign a Microsoft Enrollment for Windows Azure [EWA] agreement as it is costly arranging such a deal locally.

 “NHS Digital must for me, step in and provide another MS EWA as I am sure the disruption and political fall-out will cost more. Introduce an NHS MS EWA, introduce standards for software suppliers to comply with latest OS and then use CQC to rate organisations that do not upgrade.”

Another comment on the Digital Health website says that even those organisations that could afford the deployment costs of moving from XP to Windows 7 were left with the “professional” version, which “Microsoft has mercilessly withdrawn core management features from (e.g. group policy features)”.

The comment said,

“There are a lot of mercenary enterprises taking advantage of the NHS’s inability to mandate and coordinate the required policies on suppliers which would at least give the under-funded and under-appreciated IT functions the ability to provide the service they so desperately want to.”

A third comment said that security and configuration management in the NHS is “pretty poor”. He added, “I don’t know why some hospitals continue to invest in home-brew email systems when there is a national solution ready and paid for.

“In this recent attack most the organisations hit seem to use local email systems.”

He also criticised NHS organisations that:

  • Do not properly segment their networks
  • Allow workstations to openly and freely connect to each other in a trusted zone.
  • Do not have a proper patch / update management regime
  • Do not firewall legacy systems
  • Don’t have basic ACLs [access control lists)

Three lessons?

  • Give GDS the ability to mandate no matter how many Sir Humphreys would be upset at every challenge to their authority. Government would work better if consensus and complacency at the top of the civil service were regarded as vices, while constructive, effective and forceful criticism was regarded as a virtue.
  • Give the NHS money to spend on the basic essentials rather than nice-to-haves such as a paperless NHS, trust-wide wi-fi, smartphone apps, telehealth and new websites. The essentials include interoperability – so that, at the least, all trusts can send test results and other medical information electronically to GPs –  and the upgrading of medical devices that rely on old operating systems.
  •  Plan for making the NHS less dependent on monolithic Microsoft support charges.

On the first day of the attacks, Microsoft released an updated patch for older Windows systems “given the potential impact to customers and their businesses”.

Patches are available for: Windows Server 2003 SP2 x64Windows Server 2003 SP2 x86, Windows XP SP2 x64Windows XP SP3 x86Windows XP Embedded SP3 x86Windows 8 x86, and Windows 8 x64.

Reuters reported last night that the share prices of cyber security companies “surged as investors bet on governments and corporations spending to upgrade their defences”.

Network company Cisco Systems also closed up (2.3%), perhaps because of a belief that it would benefit from more network spending driven by security needs.

Security company Avast said the countries worst affected by WannaCry – also known as Wannacypt – were Russia, Taiwan, Ukraine and India.

Comment

In a small room on the periphery of an IT conference on board a cruise ship , nearly all of the senior security people talked openly about how their board directors had paid ransoms to release their systems after denial of service attacks.

Some of the companies – most of them household names – had paid ransoms more than once.

Until then, I’d thought that some software suppliers tended to exaggerate IT security threats to help market their solutions and services.

But I was surprised at the high percentage of large companies in that small room that had paid ransoms. I no longer doubted that the threats – and the damage – were real and pervasive.

The discussions were not “off-the-record” but I didn’t report their comments at the time because that would doubtless have had job, and possibly even career ramifications, if I had quoted the security specialists by name.

Clearly ransomware is, as the GCHQ expert Kieran Martin put it, a global business but, as ransoms are paid secretly – there’s not a whisper in corporate annual accounts – the threat has not been taken seriously enough in some parts of the NHS.

The government’s main defence is that the NHS was not targeted specifically and that many private organisations were also affected.

But the NHS has responsibility for lives.

There may be a silver lining if a new government focuses NHS IT priorities on the basics – particularly the structural defects that make the health service an easy target for attackers.

What the NHS doesn’t need is a new set of politicians and senior civil servants who can’t help massaging their egos and trying to immortalise their legacy by announcing a patchwork of technological marvels that are fun to work on, and spend money on, but which gloss over the fact that much of the NHS is, with some notable exceptions, technologically backward.

Microsoft stockpiled patches – The Register

UK government, NHS and Windows XP support – what really happened – Computer Weekly

NHS letter on patches to counter cyber attack

Multiple sites hit by ransomware attack – Digital Health (31 comments)

Lessons from the WannaCrypt – Wannacry – cyber attack according to Microsoft

 

Advertisements

After a major IT failure, how did Barts NHS trust manage its image?

By Tony Collins

It sounded serious. Under the headline

“Cancer patients in limbo as five hospitals suffer ‘major’ IT crash”

the Daily Telegraph said,

“Hundreds of cancer patients have been denied treatment at one of England’s biggest hospital trusts due to a major IT failure that ground basic services to a halt.

“Doctors at five large London hospitals have reported 11 days of “chaos” after the systems used to prescribe chemotherapy doses and share x-ray and MRI images broke down on April 20.

“Barts Health NHS Trust said at least 136 operations had been cancelled due to the crash, as well as “hundreds” of cancer treatment sessions.

“The computer failure also means frantic staff have been unable to process blood tests for all but the most critical cases…

“A doctor at the Royal London Hospital told the Daily Telegraph: ‘We have been forced to leave sick patients on the ward while we go down 16 floors to catch a glance at an x-ray image, then come back and make treatment decisions based on a hazy recollection of it…

“An email sent by managers to staff last week said the crisis had forced cancer teams to rebuild patient records ‘from scratch’.

A medic at Whipps Cross hospital was quoted as saying that a lot of people were stuck in hospital needlessly which increased the likelihood of infection.

The trust runs Mile End Hospital, Newham University Hospital, The Royal London Hospital, St Bartholomew’s Hospital and Whipps Cross University Hospital as well as other NHS sites.

The Barts trust website says it delivers “high quality compassionate care to the 2.5 million people of east London and beyond”.

It has a turnover of £1.25 bn and a workforce of 15,000, making it the largest NHS trust in the country.

According to Health Service Journal, an internal email from Barts’ chief clinical information officer Tim Peachy said the IT failure was primarily a result of an “unexpected failure of a small number of physical disks on which data is stored”.

At one point the trust was manually processing blood test results and X-rays, and arranging for porters at its hospitals to hand deliver paperwork to clinicians.

Barts’ reputation 

In the light of the failure and disclosures in Health Service Journal, Barts confirmed the IT problems in statements to the media. It also contacted patients who were affected by the problems. A Barts statement this week said,

“A major computer equipment failure on Thursday 20 April resulted in a number of IT applications being unavailable to staff.

“‘Unfortunately, it has been necessary to cancel 136 operations, representing about 2.5% of our usual weekly in-patient activity. Several hundred chemotherapy appointments have been cancelled, however we have now recovered the chemotherapy prescribing database.

“Clinical teams have completed a patient-by-patient review to ensure that the appropriate course of action is taken for each of them, endeavouring to keep the disruption to an absolute minimum.

“We apologise to those affected and will reschedule their appointment for as soon as we are able.

“A number of applications have been affected to varying degrees. We have made significant progress in many areas including pathology (blood testing), with image viewing now also restored across the Trust. There are still some other areas where it will take time before we are on track again.”

It added,

“We continue to work urgently to maintain the operational resilience of our services, using tried and tested contingency plans to keep our patients safe.”

Despite the seriousness of the problems, the effect on patients and the uncertainties that media coverage might have created in the minds of those intending to go to Barts’ hospitals, the trust made no mention of the difficulties on its website – where it has a “latest news” section –  or on Twitter.

Barts uses Twitter for good news announcements, comments and congratulations, sometimes with dozens of daily tweets.

But why no mention of the IT problems?

On this point, a Barts spokeswoman said,

“We do not rely on social media to update patients. As a proportionately small number of people will be impacted on by the IT situation we are communicating directly to those affected including at outpatients clinics and via phone, letter as well as through communications with our healthcare partners including GPs.”

Comment

In its media statements Barts has been more open than some NHS organisations.

The usual NHS cycle after a major IT-related failure is a statement saying teething problems have been resolved, or are being resolved, followed by a succession of similar statements over the next few days, weeks or months when it becomes clear the problems haven’t been resolved.

This is what happened with e-Referral Service and Capita’s problems handling GP support services.

That hasn’t happened at Barts. But despite its openness with the media, it’s odd  the trust has published many congratulatory tweets in the past two weeks without a mention of any IT-related problems. They are not even alluded to.

It’s also odd that on its website the Barts “Latest News” section has no mention of the difficulties. But the website does have various good news announcements, including a reference to a positive Care Quality Commission report in April 2007.

Trusts do not have to account to patients, Parliament or anybody for IT-related problems. They are under no obligation to apologise to patients whose stays in hospital are unnecessarily prolonged, or whose appointments, operations and blood tests are cancelled or delayed because of IT-related difficulties.

Back-up systems? 

They also have no obligation to give the public any reason for the failure or explain why there was no back-up system that ensured patients were unaffected.

But amid so many positive announcements, statements and comments to the public on its website and on Twitter, should Barts have left out the other side of the story?

The NHS is an organisation that’s attuned to promulgating good news. It’s rare for a trust board paper and or a trust website to have anything but a good news feel to it.

But telling the public one side of the story does not encourage the public to believe officialdom when it says: “Trust us. We know what we’re talking about.”

Thank you to Zara Pradyer for letting me know about the Daily Telegraph article.

 

Capita said to owe thousands to pharmacies

By Tony Collins

Capita owes some pharmacy owners thousands of pounds, according to Chemist+Druggist.

One pharmacist Salim Jetha of Lewis Grove Pharmacy in Lewisham told Chemist+Druggist he had emailed Capita in February but it “bounced back because the inbox was full”. He said that if emails are unanswered and there is no phone number to ring “what are you supposed to do?”

Under its Primary Care Support Services contract with NHS England, Capita is due, among other obligations, to reimburse some of the costs of pharmacy trainees. The trainees are termed “pre-registration” pharmacists because they have not yet passed a General Pharmaceutical Council assessment.

Pharmacy owners can apply for an annual grant from NHS England for up to £18,440 for every pre-registration trainee taken on.

Capita took on responsibility for delivering NHS England’s primary care support services in September 2015, including overseeing the pharmacy training grants.

In response to the article, Capita spokesperson said it is aware of “some isolated issues” and that all claims that meet “the required checks” have been backdated, as will any further claims.

The spokesperson said that one of the “key improvements” under Capita has been the introduction of a centralised process for dealing with primary care.

The old system was localised, meaning grant claims “came in from various sources on an ad hoc and irregular basis”.

Chemist+Druggist article

Jeremy Hunt is prepared to end Capita’s NHS contract if necessary

 

MPs to debate Capita NHS contract today

By Tony Collins

In the House of Commons today MPs will debate the Capita Primary Care Support Services contract.

It has been secured by Coventry North West MP Geoffrey Robinson, who wants GPs to be compensated for the failures arising from the outsourcing contract.

The debate comes a day after the BBC reported that “more than 9,000 patients’ records in Norfolk, Suffolk and Essex have gone missing” since Capita took on the task of transferring files.

As part of its contract Capita took on the job of transferring patients’ records, when people move from one GP to another.

A BBC survey of 78 GP practices showed that 9,009 records had been missing for more than two months.

Capita told the BBC it did not “recognise these claims”.

An NHS England spokesman said, “We know there have been serious issues with services delivered by Capita which have had an unacceptable impact on practices. We are ensuring Capita takes urgent steps to improve services.”

Patients “at risk”

Paul Conroy, a practice manager in Essex, has started a House of Commons petition on the delays, which has been signed by more than 3,000 people. It calls for an inquiry into the Capita contract and the impact it has had on GP practices.

“GPs rely on that full medical history in order to make key clinical decisions on patient care,” he said.

“If they can’t get hold of that physical record there could be vital information there could be vital information that puts a patient at risk.”

James Dillon, director of Practice Index – an organisation bringing together practice managers – told the BBC,

“GP practices are getting more and more frustrated by the missing patient records.

“Not only is this debacle putting the health of their patients at risk, it is putting added pressure on already stretched practices.”

In a statement, Capita said it had taken on the “challenging initiative” to streamline GP support services and there had been “teething problems”.

“[But] medical records are now being delivered securely up to three times faster than under the previous system,” it said.

“We do not recognise these claims regarding thousands of files being missing whatsoever.

“We request and move on average 100,000 files a week from multiple sites including GP surgeries and also third party run storage facilities which are contracted and managed by NHS England.”

GP magazine Pulse quoted MP Geoffrey Robinson as saying that the secretary of state should intervene directly “as this is extremely dangerous”. Robinson said that some medical records are not being delivered at all, or delivered late or delivered to the wrong practices.

Dr Richard Vautrey, deputy chairman of the British Medical Association’s GP Committee said that the problems arising from the outsourcing contract “are directly impacting on the ability of many GPs to provide safe, effective care to their patients in the area”.

He said, “They are in some cases being left without the essential information they need to know about a new patient and the tools to treat them.”

In August 2016, NHS England published the results of a User Satisfaction Survey of primary care support services over the previous six months. Only 21% of GPs were satisfied with the outsourced service, giving it an average overall score of 2.91 out of 10.

Lunacy?

An anonymous GP told Pulse how the problems are affecting him. He refers to the “performers list” that assures the public that GPs are suitably qualified, have up to date training, have appropriate English language skills and have passed other relevant checks such as with the Disclosure and Barring Service and the NHS Litigation Authority.

Said the GP,

“I moved 12 months ago and still haven’t been able to transfer performers list. I am 6 months late for my appraisal and unemployable except for my current salaried job as a result.

” It would have been easier to emigrate. The department responsible for the performers list at Capita is uncontactable except via a national email that isn’t responded to and a phone line that isn’t able to put you through to anyone.

“… As it is it’s virtually impossible to move region if you a UK GP. I am basically a slave bonded to a geographical region, forbidden to move house and work anywhere else other than short periods. Totally at the mercy of a faceless uninterested bureaucracy incapable of helping. Lunacy and utterly depressing. Why the hell did I become a GP? I curse the day.”

“I urgently need my medical records”

A patient who wrote to Campaign4Change said,

“My medical records were requested at the beginning of June 2016 when I changed to another health centre about 2 miles away.

“[I] phoned Capita today and was told there was no record of this request and to get my solicitor to contact them. Then they put the phone down. I don’t have and cannot afford a solicitor.

“I urgently need my medical records with my new doctor and am feeling helpless and extremely stressed by this.”

Pulse magazine reported yesterday (7 November 2016) the results of a snapshot survey of 281 GP practices carried out by the BMA’s GP Committee. It found:

  • 31% of practices had received incorrect patient records;
  • 28% failed to receive or have records collected from them on the date agreed with Capita;
  • 58% reported that new patient registrations were not processed within the required three days.
  • 81% of urgent requests for records were not actioned within three weeks.

GP practices also noted a reduction in the number of incorrect payments and fewer delays in registrations of the “performers list”.

Comment

It would be a pity if MPs today, in criticising Capita, lost sight of the bigger picture: how such outsourcing deals are considered and awarded.

The root of the problem is that before the contract is awarded officials concentrate their attention on the minutiae of the benefits: exactly how much will be saved, and how this will be achieved.

Pervading the pre-contract literature and discussions are the projected savings. This is understandable but wrong.

It’s understandable because it’s the projected savings that justify the sometimes-exciting time and effort that go into the pre-contract negotiations and discussions.

Large amounts of money are at stake. For officials, the pre-contract work can be a euphoric time – certainly more interesting than the day-to-day routine.

But what happens to negotiation and discussion of risk?

Risk is a table or two at the back of the reports. It’s a dry, uninspiring vaguely technical and points-scoring analysis of the likelihood of adverse events and the seriousness of the consequences materialising.

Sometimes the most serious risks are highlighted in red. But there’s always a juxtaposed “mitigation” strategy that appears to reassure. Indeed it appears to cancel out any reason for concern.

Risk is mentioned at the back of the internal pre-contract because it’s a cultural anathema. It’s the equivalent of visits by Building Regulations inspectors at a theme park under construction.

Who wants to talk about risk when a contract worth hundreds of millions of pounds is about to be awarded?

A bold official may dare to point out the horror stories arising from previous outsourcing contracts. That hapless individual will then be perceived by the outsourcing advisory group to have a cloud over his or her head. Not one of us.

And the horror stories will be dismissed by the officer group as the media getting it wrong as usual. The horror stories, it will be explained, were in fact successes.

Even when big public sector outsourcing deals end in a legal action between the main parties, officials and the supplier will later talk – without explanation or detail or audited accounts –  of the contract’s savings and overall success.

We’re seeing this on the Southwest One outsourcing/joint venture contract.

No doubt some will claim the GP contract support contract is a success. They’ll describe problems as teething. Marginalise them. And later, when it comes to the awarding of future contracts, supporters of the GP outsourcing contract will be believed over the critics.

And so the cycle of pre-contract outsourcing euphoria and post-contract rows over failure will be repeated indefinitely.

It would be of more use if MPs today debated the role of NHS England in the award of the GP support contract.

Blaming Capita will do little good. The supplier will face some minor financial penalties and will continue to receive what it is contractually due.

Countless National Audit Office reports show how contracts between the public and private sectors, when it comes to the crunch, strongly protect the supplier’s interests. The public sector doesn’t usually have a leg to stand on.

A focus today on Capita would be a missed opportunity to do some lasting good.

NHS England letter on Capita contract – September 2016

Capita NHS contract under scrutiny after “teething” problems – June 2016

GPs decry Capita’s privatised services as shambles – The Guardian

Did NHS England consider us in the Capita take-over?

NHS England vows to hold Capita to account

Capita mistakenly flags up to 15% of GP practice patients for removal  

Capita primary care support service performance “unacceptable”

 

 

 

“Teething” problems on Capita’s NHS contract turn more serious

By Tony Collins

capitaA senior official at NHS England has said that problems on a contract to outsource GP support services to Capita have “put patients at risk”, according to GPs magazine Pulse.

In June 2016 NHS England said problems on Capita’s £330m seven-year contract to provide primary care support services to GPs were “teething”.

The contract started in September 2015.

Directors at NHS England’s September board meeting said that problems with Primary Care Support England had ‘escalated’ this summer and that the problems were ‘creating some risks for patients’.

Karen Wheeler, NHS England’s national director for transformation and corporate operations, is reported by Pulse to have told the board,

“I just want to recognise that obviously this has impacts for users, which include of course primary care contractors – GPs, ophthalmic and dental practitioners – and recognise that that’s difficult for all those users, and indeed creating some risks for patients as well.

“So we are doing everything we can to make sure that we escalate, and address the risks particularly for patients, and we will be communicating with practitioners how we are planning on, with Capita, to try to improve services as quickly as possible.”

Problems include undelivered patient notes, which has led to GP practices chasing records. There have also been delays in GP payments and clinical supplies.

Angry GPs

NHS England’s chairman Professor Malcom Grant has angered some GPs by praising NHS England’s directors, and their teams, for the “huge amount of work” they have put in “trying to ensure people aren’t harmed by this at all.”

Pulse quotes Professor Grant as saying,  “As you know the board takes this extremely gravely. When we say unacceptable, we mean unacceptable. I think we need to pay tribute to you [Karen Wheeler] and the team for the huge amount of work that has gone into trying to ensure that people aren’t harmed by this at all.”

A Capita spokesperson told Pulse: ‘Across all PCSE [Primary Care Support England] services our focus is to ensure that GPs and primary care providers are supported so they can concentrate on patient care.

“We fully recognise that the administrative services we provide play a key role in supporting primary care providers and ensure that urgent work is always treated as a priority.

“We have openly apologised for the level and varied quality of service we have provided across a number of PCSE services. As NHS England acknowledges, we are working very closely with them, supported by their subject matter experts, to implement step changes to improve current services.”

Responses to the article on Pulse’s website criticised NHS England’s chairman for praising his officials when it was NHS England that had made the decision in the first place to outsource GP support services.

One comment: “Apologies aren’t worth anything currently. We are struggling at [GP] practice level and NHSE [NHS England] don’t give a damn.”

Another said, “So ‘hubs’ and combining ‘back office’ functions not always the cost saving, efficiency panacea then… Let’s hope we learn the lessons and value our ‘back office functions’ more highly.”

An anonymous NHS manager said the decision to outsource to Capita had been taken “behind closed doors, without any meaningful staff consultation and with zero knowledge of what primary care support services actually do”.

The manager added,  “NHS England is part of the problem. It’s about time they were held to account.”

Capita’s share price is currently less than half its 52-week high, for a range of reasons.

NHS “Wachter” digital review is delayed – but does it matter?

By Tony Collins

The Wachter review of NHS technology was due to be published in June but has been delayed. Would it matter if it were delayed indefinitely?

A “Yes Minister” programme about a new hospital in North London said it all, perhaps. An enthusiastic NHS official shows the minister round a hospital staffed with 500 administrators. It has the latest technology on the wards.

“It’s one of the best run hospitals in the country,” the NHS official tells the minister, adding that it’s up for the Florence Nightingale award for the standards of hygiene.

“But it has no patients,” says the minister.

Another health official tells the minister,

“First of all, you have to sort out the smooth running of the hospital. Having patients around would be no help at all.” They would just be in the way, adds Sir Humphrey.

In the Wachter’s review’s terms of reference (“Making IT work: harnessing the power of health IT to improve care in England“)  there is a final bullet point that refers, obliquely, to a need to consider patients. Could the Wachter terms of reference have been written by a satirist who wanted to show how it was possible to have a review of NHS IT for the benefit of suppliers, clinical administrators and officialdom but not patients?

The Wachter team will, according to the government,

• Review and articulate the factors impacting the successful adoption of health information systems in secondary and tertiary care in England, drawing relevant comparisons with the US experience;

• Provide a set of recommendations drawing on the key challenges, priorities and opportunities for the health and social care system in England. These recommendations will cover both the high levels features of implementations and the best ways in which to engage clinicians in the adoption and use of such systems.

In making recommendations, the board will consider the following points:

• The experiences of clinicians and Trust leadership teams in the planning, implementation and adoption of digital systems and standards;

• The current capacity and capability of Trusts in understanding and commissioning of health IT systems and workflow/process changes.

• The current experiences of a number of Trusts using different systems and at different points in the adoption lifecycle;

• The impact and potential of digital systems on clinical workflows and on the relationship between patients and their clinicians and carers.

Yes, there’s the mention of “patients” in the final bullet point.

Existing systems?

nhsSome major IT companies have, for decades, lobbied – often successfully – for much more public investment in NHS technology. Arguably that is not the priority, which is to get existing systems to talk to each other – which would be for the direct benefit of patients whose records do not follow them wherever they are looked at or treated within the NHS.

Unless care and treatment is at a single hospital, the chances of medical records following a patient around different sites, even within the same locality, are slim.

Should a joining up of existing systems be the main single objective for NHS IT? One hospital consultant told me several years ago – and his comment is as relevant today –

“My daughter was under treatment from several consultants and I could never get a joined-up picture. I had to maintain a paper record myself just to get a joined-up picture of what was going on with her treatment.”

Typically one patient will have multiple sets of paper records. Within one hospital, different specialities will keep their own notes. Fall over and break your leg and you have a set of orthopaedic notes; have a baby and you will have a totally different set of notes. Those two sets are rarely joined up.

One clinician told me, “I have never heard a coroner say that a patient died because too much information was shared.”

And a technology specialist who has multiple health problems told me,

“I have different doctors in different places not knowing what each other is doing to me.”

As part of wider research into medical records, I asked a hospital consultant in a large city with three major hospitals whether records were shared at least locally.

“You must be joking. We have three acute hospitals. Three community intermediate teams are in the community. Their records are not joined. There is one private hospital provider. If you get admitted to [one] hospital and then get admitted to [another] the next week your electronic records cannot be seen by the first hospital.  Then if you get admitted to the third hospital the week after, again not under any circumstances will your record be able to be viewed.”

Blood tests have to be repeated, as are x-rays; but despite these sorts of stories of a disjointed NHS, senior health officials, in the countless NHS IT reviews there have been over 30 years, will, it seems, still put the simplest ideas last.

It would not cost much – some estimate less than £100m – to provide secure access to existing medical records from wherever they need to be accessed.

No need for a massive investment in new technology. No need for a central patient database, or a central health record. Information can stay at its present location.  Just bring local information together on local servers and provide secure access.

A locum GP said on the Pulse website recently,

“If you are a member of the Armed Forces, your MO can get access to your (EMIS-based) medical record from anywhere in the world. There is no technical reason why the NHS cannot do this. If need be, the patient could be given a password to permit a GP to see another Surgery’s record.”

New appointments

To avoid having patients clog up super-efficient hospitals, Sir Humphrey would have the Wachter review respond to concerns about a lack of joined up care in the NHS by announcing a set of committees and suggesting the Department of Health and NHS England appoint a new set of senior technologists.

Which is just what has happened.

Last week NHS England announced  “key appointments to help transform how the NHS uses technology and information”. [One of the NHS appointments is that of a Director of Digital Experience, which is not a fictional title, incidentally. Ironically it seems to be the most patient-facing of the new jobs.]

Said the announcement,

“The creation of these roles reflects recommendations in the forthcoming review on the future of NHS information systems by Dr Bob Wachter.

“Rather than appoint a single chief information and technology officer, consistent with the Wachter review the NHS is appointing a senior medical leader as NHS Chief Clinical Information Officer supported by an experienced health IT professional as NHS Chief Information Officer.

“The first NHS Chief Clinical Information Officer will be Professor Keith McNeil, a former transplant specialist who has also held many senior roles in healthcare management around the world, including Chief Executive Officer at Addenbrooke’s Hospital, Cambridge University Hospitals NHS Foundation Trust and Chief Executive Officer at the Royal Brisbane and Women’s Hospital in Australia.

“The new NHS Chief Information Officer will be Will Smart, currently Chief Information Officer at the Royal Free London NHS Foundation Trust. Mr Smart has had an extensive career in IT across the NHS and in the private sector.

“The NHS CCIO and NHS CIO post-holders will act on behalf of the whole NHS to provide strategic leadership, also chairing the National Information Board, and acting as commissioning ‘client’ for the relevant programmes being delivered by NHS Digital (previously known as the Health and Social Care Information Centre).

“The roles will be based at NHS England and will report to Matthew Swindells, National Director: Operations and Information, but the post-holders will also be accountable to NHS Improvement, with responsibility for its technology work with NHS providers.

“In addition, Juliet Bauer has been appointed as Director of Digital Experience at NHS England. She will oversee the transformation of the NHS Choices website and the development and adoption of digital technology for patient ‘supported self-management’, including for people living with long term conditions such as diabetes or asthma. Ms Bauer has led delivery of similar technology programmes in many sectors, including leading the move to take Times Newspapers online…”

Surely a first step, instead of arranging new appointments and committees, and finding ways of spending money on new technology, would be to put in place data sharing agreements between hospitals?

A former trust chief executive told me,

“In primary care, GPs will say the record is theirs. Hospital teams will say it is our information and patient representative groups will say it is about patients and it is their nformation. In maternity services there are patient-held records because it is deemed good practice that mums-to-be should be fully knowledgeable and fully participating in what is happening to them.

“Then you get into complications of Data Protection Act. Some people get very sensitive about sharing information across boundaries: social workers and local authority workers. If you are into long-term continuous care you need primary care, hospital care and social care. Without those being connected you may do half a job or even less than that potentially. There are risks you run if you don’t know the full information.”

He added that the Summary Care Record – a central database of every patient’s allergies, medication and any adverse reactions to drugs, was a “waste of time”.

“You need someone selecting information to go into it [the Summary Care Record]so it is liable to omissions and errors. You need an electronic patient record that has everything available but is searchable. You get quickly to what you want to know. That is important for that particular clinical decision.”

Is it the job of civil servants to make the simple sound complicated?

Years ago, a health minister invited me for an informal meeting at the House of Commons to show me, in confidence, a one-page civil service briefing paper on why it was not possible to use the internet for making patient information accessible anywhere.

The minister was incredulous and wanted my view. The civil service paper said that nobody owned the internet so it couldn’t be used for the transfer of patient records.  If something went wrong, nobody could be blamed.

That banks around the world use the internet to provide secure access to individual bank accounts was not mentioned in the paper, nor the existence of the CHAPS network which, by July 2011, had processed one quadrillion (£1,000,000,000,000,000) pounds.

Did the briefing paper show that the civil service was frightened by the apparent simplicity of sharing patient information on a secure internet connection? If nothing else, the paper showed how health service officials will tend, instinctively, to shun the cheapest solutions. Which may help to explain how the (failed) £10n National Programe for IT came into being in 2002.

Jargon

Radiation_warning_symbolNobody will be surprised if the Wachter review team’s report is laden with  jargon about “delays between technology being introduced and a corresponding rise in output”. It may talk of how new technology could reduce the length of stay by 0.1528 of a bed day per patient, saving a typical hospital £1.8m annually or 7,648 bed days.

It may refer to visions, envisioning fundamental change, establishing best practice as the norm, and a need for adaptive change.

Would it not be better if the review team spoke plainly of the need for a patient with a fractured leg not having to carry a CD of his x-ray images to different NHS sites in a carrier bag?

Some may await the Wachter report with a weary apprehension that its delay – even indefinitely – will make not a jot of difference. Perhaps Professor Wachter will surprise them. We live in hope.

Wachter review terms of reference.

Review of IT in the NHS

https://ukcampaign4change.com/2016/02/09/another-npfit-it-scandal-in-the-making/

Hunt announces Wachter review

What can we learn from the US “hospitalist” model?

Avon and Somerset Police to end outsourcing deal after years of proclaiming its success

avon and somerset police logoBy Tony Collins

Avon and Somerset Police has been consistent in its good news statements on the force’s “innovative” outsourcing deal with IBM-owned Southwest One.

These announcements and similar FOI responses have a clear message: that savings from the deal are more than expected.

But the statements have differed in tone and substance from those of Somerset County Council which ended up in a legal action with Southwest One.

Somerset’s losses on its Southwest One deal could leave the casual observer wondering why and how Avon and Somerset Police had made a success of its deal with Southwest One, whereas the county council has had a disastrous experience.

Now the BBC reports that Avon and Somerset will not be renewing its contract with Southwest One when the deal expires in 2018.

Southwest One is 75% owned by IBM and carries out administrative, IT and human resources tasks for the force.

Avon and Somerset Police’s “new” chief constable Andy Marsh – who took up the post in February 2016 – confirmed he has “given notice” that the Southwest On contract will not be renewed.

Andy Marsh, chief constable, Avon and Somerset.

Andy Marsh, chief constable, Avon and Somerset.

Instead he said he wants to work with neighbouring police and fire services. Marsh said,

“We will be finding a new way of providing those services. It is my intention to collaborate with other forces. I do believe I can save some money and I want to protect frontline numbers.”

Marsh came to Avon and Somerset with a reputation for making value for money a priority.

These are some of the statements made by Avon and Somerset Police on the progress of the Southwest One contract before Marsh joined the force:

  • “I am delighted with the level of procurement savings Southwest One is delivering for us, particularly as it is our local communities who will benefit most as front-line services are protected. “
  • “Using Southwest One’s innovative approach, we have been able to exceed our expected savings level.”
  • “I am looking forward to building on our close working relationship with Southwest One to deliver even greater savings in the future.”

FOI campaigner David Orr says of the police’s decision not to renew its contract with Southwest One,

“This controversial contract with IBM for Southwest One was signed in 2007 with the County Council, the Police and Taunton Deane Borough Council.

“We were promised £180m of cash savings, an iconic building in Taunton at Firepool, as well as new jobs and a boost to the economy. None of that ever materialised. “

Comment

If Avon and Somerset Police is happy with its outsourcing deal with Southwest One, why is it not renewing or extending the contract?

It’s clear the “new” chief constable Andy Marsh believes he can save money by finding a new way of delivering services, including IT. This sounds sensible given that the client organisation will at some point have to contribute to the supplier’s profits, usually in the later years of the contract.

Savings by ending outsourcing

Public authorities, particularly councils, when they announce the end of an outsourcing contract, will often say they plan to make substantial savings by doing something different in future – Somerset County Council and Liverpool Council among them.

Liverpool Council announced it would save £30m over three years  by ending its outsourcing deal.

Dexter Whitfield of the European Services Strategy Unit which monitors the success or otherwise of major outsourcing deals, is quoted in a House of Commons briefing paper last month entitled “Local government – alternative models of service delivery” as saying,

“Councils have spent £14.2bn on 65 strategic public-private partnership contracts, but there is scant evidence of full costs and savings”.

According to Whitfield, this is due to “the lack of transparent financial audits of contracts, secretive joint council-contractor governance arrangements, poor monitoring, undisclosed procurement costs, a lack of rigorous scrutiny and political fear of admitting failure”.

If it’s so obvious that outsourcing suppliers will eventually try to make up later for any losses in the early stages of a contract – suppliers are not registered charities – why are such deals signed in the first place?

Do officials and councillors not realise that  their successors will probably seek to save money by jettisoning the same outsourcing deal?

The problem, perhaps, is that those who preside over the early years of an outsourcing contract are unlikely to be around in the later years. For them, there is no effective accountability.

Hence the enthusiastic public announcements of savings and new investments in IT and other facilities in the early stages of an outsourcing  contract.

It’s likely things will go quiet in the later years of the contract when the supplier may be trying to recoup losses incurred in the early years.

Then, suddenly, the public authority will announce it is ending its outsourcing deal. Outsiders are left wondering why.

Good news?

Given Avon and Somerset’s determination to end its relationship with Southwest One, can we trust all the good news statements by the force’s officials in past years?

With facts in any outsourcing deal so hard to come by, even for FOI campaigners, selective statements by public servants or ruling councillors about how successful their deal is, and how many tens of millions of pounds they are saving, are best taken with a pinch of salt.

Especially if the announcements were at an early stage of the contract and things have now gone quiet.

Thank you to David Orr for alerting me to the BBC story and providing links to much of the material that went into this post.

From hubris to the High Court (almost) – the story of Southwest One.

Too easy for councils to make up savings figures for outsourcing deals?

Another NPfIT IT scandal in the making?

By Tony Collins

Jeremy Hunt may have forgotten what he told the FT 2013, as reported in the paper on 2 June 2o13.

Referring to the failed National Programme for IT [NPfIT] in the NHS he said at that time,

“It was a huge disaster . . . It was a project that was so huge in its conception but it got more and more specified and over-specified and in the end became impossible to deliver, but we musn’t let that blind us to the opportunities of technology and I think one of my jobs as health secretary is to say, look, we must learn from that and move on but we must not be scared of technology as a result.”

He added, “I’m not signing any big contracts from behind [my] desk; I am encouraging hospitals and clinical commissioning groups and GP practices to make their own investments in technology at the grassroots level.”

Now the Department of Health (and perhaps some large IT suppliers) have encouraged Hunt to find £4bn for spending on technology that is (again) of questionable immediate need.

Says Computing, “A significant part of the paperless NHS plans will involve enabling patients to book services and order prescriptions online, as well as giving them the choice of speaking to their doctor online or via a video link.”

The £4bn, if that’s what it will cost, is much less than the cost of the NPfIT. But are millions to be wasted again?

[NPfIT was originally due to cost £2.3bn over three years from 2003 but is expected to cost £9.8bn over 21 years, to 2024.]

Yesterday (8 February 2016) the Department of Health announced a “review of information technology in the NHS”. Announcing it Hunt said.

“Improving the standard of care patients receive even further means embracing technology and moving towards a fully digital and paperless NHS.

NHS staff do incredible work every day and we must give them and patients the most up-to-date technology – this review will tell us where we need to go further.”

The NPfIT was supposed to give the NHS up-to-date technology – but is that what’s needed?

A more immediate need is for any new millions of central funding (for the cost would be in the tens of millions, not billions) to be spent on the seemingly mundane objective of getting existing systems to talk to each other, so that patients can be treated in different parts of the NHS and have their electronic records go with them.

This doesn’t need a new national programme for IT. Some technologists working in the NHS say it would cost no more than £150m, a small sum by NHS IT standards, to allow patient data to reside where it is but be accessed by secure links anywhere, much as secure links work on the web.

But the review’s terms of reference make only a passing reference to the need for interoperability.

Instead the review will have terms of reference that are arguably vague – just as the objectives for the NPfIT were.

The Department of Health has asked the review board, when making recommendations, to consider the following points:

  • The experiences of clinicians and Trust leadership teams in the planning, implementation and adoption of digital systems and standards;
  • The current capacity and capability of Trusts in understanding and commissioning of health IT systems and workflow/process changes.
  • The current experiences of a number of Trusts using different systems and at different points in the adoption lifecycle;
  • The impact and potential of digital systems on clinical workflows and on the relationship between patients and their clinicians and carers.

The head of the review board Professor Wachter will report his recommendations to the secretary of state for health and the National Information Board in June 2016.

Members of the National Advisory Group on health IT in England (the review board) are:

  • Robert Wachter, MD, (Chair) Professor and Interim Chairman, Department of Medicine,University of California, San Francisco
  • Julia Adler-Milstein, PhD, Associate Professor, Schools of Information and of Public Health, University of Michigan
  • David Brailer, MD, PhD, CEO, Health Evolution Partners (current); First U.S. National Coordinator for Health IT (2004-6)
  • Sir David Dalton, CEO, Salford Royal NHS Foundation Trust, UK
  • Dave deBronkart, Patient Advocate, known as “e-Patient Dave”
  • Mary Dixon-Woods, MSc, DPhil, Professor of Medical Sociology, University of Leicester, UK
  • Rollin (Terry) Fairbanks, MD, MS, Director, National Center for Human Factors in Healthcare; Emergency Physician, MedStar Health (U.S.)
  • John Halamka, MD, MS, Chief Information Officer, Beth Israel Deaconess Medical Center; Professor, Harvard Medical School
  • Crispin Hebron, Learning Disability Consultant Nurse, NHS Gloucestershire
  • Tim Kelsey, Advisor to UK Government on Health IT
  • Richard Lilford, PhD, MB, Director, Centre for Applied Health Research and Delivery, University of Warwick, UK
  • Christian Nohr, MSc, PhD, Professor, Aalborg University (Denmark)
  • Aziz Sheikh, MD, MSc, Professor of Primary Care Research and Development, University of Edinburgh
  • Christine Sinsky, MD, Vice-President of Professional Satisfaction, AMA; Primary care internist, Dubuque, Iowa
  • Ann Slee, MSc, MRPharmS, ePrescribing Lead for Integrated Digital Care Record and Digital Medicines Strategy, NHS England
  • Lynda Thomas, CEO, MacMillan Cancer Support, UK
  • Wai Keong Wong, MD, PhD, Consultant Haematologist, University College London Hospitals; Inaugural chair, CCIO Leaders Network Advisory Panel
  • Harpreet Sood, MBBS, MPH, Senior Fellow to the Chair and CEO, NHS England and GP Trainee

Comment

Perhaps egged on by one or two major suppliers in behind-the-scenes lobbying, Hunt has apparently found billions to spend on improving NHS IT.

Nobody doubts that NHS IT needs improving.  But nearly all GPs have impressive systems, as do many hospitals.  But the systems don’t talk to each other.

The missing word  from the review board’s terms of reference is interoperability. True, it’s difficult to achieve. And it’s not politically aggrandizing to find money for making existing systems interoperable.

But at present you can have a blood test at the GP, then a separate blood test at the local hospital and the full results won’t go on your electronic record because the GP and hospital are on different systems with no interoperability between them.

If you’re treated at a specialist hospital for one ailment, and at a different hospital 10 to 20 (or say 100) miles away for something else, it may take weeks for your electronic record to reflect your latest treatment.

Separate NHS sites don’t always know what each other is doing to a patient, unless information is faxed or posted between them.

The fax is still one of the NHS’s main modes of cross-county communication. The DoH wants to be rid of the fax machine but it’s indispensable to the smooth running of the NHS, largely because new and existing systems don’t talk to each other.

The trouble with interoperability – apart from the ugliness of the word – is that it is an unattractive concept to some of the major suppliers, and to DoH executives, because it’s cheap, not leading edge and may involve agreements on data sharing.

Getting agreements on anything is not the DoH’s forte. [Unless it’s an agreement to spend more money on new technology, for the sake of having up-to-date technology.]

Last year I broke my ankle in Sussex and went to stay in the West Midlands at a house with a large ground floor and no need to use stairs. There was no communication between my local GP and the NHS in the West Midlands other than  by phone, post or fax, and even then only a summary of healthcare information went on my electronic record.

I had to carry my x-rays on a CD. Then doctors at my local orthopaedic department in Sussex found it difficult to see the PACS images because the hospital’s PCs didn’t have CD players.

A government employee told me this week of a hospital that gave medication to a patient in the hope she would not have an adverse reaction. The hospital did not have access to the patient’s GP records, and the patient was unsure of the name of the medication she’d previously had an allergic reaction to.

Much of the feedback I have had from those who have enjoyed NHS services is that their care and treatment has been impeded by their electronic records not moving with them across different NHS sites.

Mark Leaning, visiting professor, at University College, London, in a paper for health software supplier EMIS, says the NHS is “not doing very well when it comes to delivering a truly connected health system in 2016. That’s bad for patient outcomes.”

That GPs and their local hospital often cannot communicate electronically  is a disgrace given the billions various governments have spent on NHS IT.  It is on interoperability that any new DoH IT money needs to be spent.

Instead,  it seems huge sums will be wasted on the pie-in-the-sky objective of a paperless NHS by 2020. The review board document released today refers to the “ambition of a paper- free health and care system by 2020”.

What’s the point of a paperless NHS if a kaleidoscope of new or existing systems don’t properly communicate?

Congratulations, incidentally, to GP software suppliers TPP and EMIS. They last year announced direct interoperability between their core clinical systems.

Their SystmOne and EMIS Web systems hold the primary care medical records for most of the UK population.

And this month EMIS announced that it has become the first UK clinical systems provider to implement new open standards for interoperability in the NHS.

It says this will enable clinicians using its systems to securely share data with any third party supplier whose systems comply with a published set of open application programme interfaces.

The Department of Health and ministers need to stop announcing things that will never happen such as a paperless NHS and instead focus their attention – and any new IT money – on initiatives that are not subconsciously aimed at either political or commercial gain.

It would be ideal if they, before announcing any new IT initiative, weighed up diligently whether it is any more important, and any more of a priority, than getting existing systems to talk to each other.

Review of information technology in the NHS

EMIS implements open standards

 

Yet another NHS IT mess?

By Tony Collins

Last week the National Audit Office reported on the failure of the GP Extraction Service. Health officials  had signed off and paid for a contract even though the system was unfit for use.

The officials worked for organisations that have become part of the Health and Social Care Information Centre.

An unapologetic HSCIC issued a statement on its website in response to the Audit Office report. It said, in essence, that the problems with the GP Extraction Service were not the fault of the HSCIC but rather its predecessor organisations (ignoring the fact that many of the officials and contractors from those defunct organisations moved to the HSCIC).

Now it transpires that the HSCIC may have a new IT-related mess on its hands, this time one that is entirely of its own making – the e-Referral Service.

Last month the HSCIC went live with its e-Referral service without testing the system properly. It says it tested for thousands of hours but still the system went live with 9 pages of known problems.

Problems are continuing. Each time in their routine bulletins officials suggest that an upgrade will solve e-Referral’s problems. But each remedial upgrade is followed by another that does not appear to solve the problems.

The system went live on 15 June, replacing Choose and Book which was part of an earlier NHS IT disaster the £10bn National Programme for IT.

Problems more than teething?

Nobody expects a major new IT system to work perfectly first time but regular outages of the NHS e-Referral Service may suggest that it has more than teething problems.

It’s a common factor in IT-based project failures that those responsible have commissioned tests for many hours but with inadequately designed tests that did not always reflect real-world use of the system. They might also have underestimated loads on the available hardware and networks.

This means that after the system goes live it is brought down for regular hardware and software fixes that don’t solve the problems.  End-users lose faith in the system – as many GPs did with the Choose and Book system – and a misplaced optimism takes the place of realism in the thinking of managers who don’t want to admit the system may need a fundamental redesign.

On the day the e-Referral Service launched, a Monday, doctors had difficulties logging in. Software “fixes” that day made little difference. By the next day HSCIC’s optimism has set in. Its website said:

“The NHS e-Referral Service has been used by patients and professionals today to complete bookings and referrals comparable with the number on a typical Tuesday but we were continuing to see on-going performance and stability issues after yesterday’s fixes.

“We suspend access to the system at lunchtime today to implement another fix and this improved performance and stability in the afternoon.”

The “fix” also made little apparent difference. The next day, Wednesday 17 June, the entire system was “unavailable until further notice” said the HSCIC’s website.

By early evening all was apparently well. An HSCIC bulletin said:

“The NHS e-Referrals Service is now available again. We apologise for the disruption caused to users and thank everyone for their patience.”

In fact, by the next day, Thursday 18 June, all was not well. Said another bulletin:

“Yesterday’s outage enabled us to implement a number of improvements and hopefully this is reflected in your user experience today.

“This morning users reported that there were ongoing performance issues so work has now taken place to implement changes to the configuration to the NHS e-Referral Service hardware and we are currently monitoring closely to see if this resolved the issue.”

About 2 weeks later, on 30 June, HSCIC’s officials said there were ongoing problems, because of system performance in provider organisations that were processing referrals.

Was this HSCIC’s way of, again, blaming other organisations – as they did after the NAO report’s on the failure of the GP Extraction Service project? Said a statement on the HSCIC’s website on 30 June 2015:

“Since transition to the NHS e-Referral Service on Monday 15th June, we have unfortunately experienced a number of problems… Although most of the initial problems were related to poor performance of the system, some residual functional and performance issues persist and continue to affect some of our colleagues in their day-to-day working.

“Most of these on-going problems relate to the performance of the system in provider organisations that are processing referrals, though this does of course have a knock-on effect for referrers.

“Please be assured that the team are working to identify root causes and fixes for these issues.”

By last week – 2 July 2015 – HSCIC warned that it will require a “period of planned downtime on the NHS e-Referral Service tonight which is currently scheduled for between 21:00 and 23:00 for some essential maintenance to fix a high priority functional Incident.”

The fix worked – or did it? HSCIC told Government Computing: “An update was applied to the system overnight from Thursday (July 2) into Friday (July 3) which was successful.”

But …

Monday 6 July 2015 4.15pm. HSCIC e-Referral Service bulletin:

“We would like to apologise for the interruption to service between 13:15 and 13:54 today.  This was not a planned outage and we are investigating the root cause.  If any remedial activity is required we will give notice to all users. Once again please accept our sincere apologies for any inconvenience this caused.”

Why was testing inadequate?

Did senior managers go live without testing how the system would work in the real world, or did they select as test end-users only IT enthusiasts?

Perhaps managers avoided challenging the test system too much in case it gave poor results that could force a redesign.

We probably won’t know what has gone wrong unless the National Audit Office investigates. Even then it could be a year or more before a report is published. A further complicating factor is that the HSCIC itself may not know yet what has gone wrong and may be receiving conflicting reports on the cause or causes of the problems.

An IT failure? – change the organisation’s name

What’s certain is that the NHS has a history of national IT project failures which cause organisational embarrassment that’s soon assuaged by changing the name of the organisation, though the officials and contractors just switch from one to the next.

NHS Connecting for Health, which was largely responsible for the NPfIT disaster, was blended into the Department of Health’s informatics function which was then blended into the HSCIC.

Similarly the NHS Information Centre which was largely responsible for the GP Extraction Service disaster was closed in 2013 and its staff and contractors blended into the HSCIC.

Now, with the e-Referral Service, the HSCIC at least has a potential IT project mess that can be legitimately regarded as its own.

When will a centrally-run national NHS IT-based turn out to be a success? … care.data?

New SRO

Meanwhile NHS England is looking for a senior responsible owner for e-Referral Service on a salary of up to £98,453.

Usually in central government, SROs do the job as an adjunct to their normal work. It’s unusual for the NHS to employ a full-time project SRO which the NAO will probably welcome as a positive step.

But the job description is vague. NHS England says that the SRO for NHS e-Referrals programme will help with a switch from paper to digital for 100% of referrals in England by March 2018.

“The SRO … will have responsibility for the strategic and operational development of the digital journey, fulfilment of the patient and clinical process and the performance of the service. Plans to achieve the strategy will be underpinned by the delivery of short to medium term objectives, currently commissioned from HSCIC and other third party suppliers.”

Key aspects of this role will be to:-

– Ensure the strategy is formulated, understood by all stakeholders and is delivered utilising all available resources efficiently and effectively.

– Ensure the development and management of plans.

– Ensure appropriate system and processes are in place to enable the uptake and on-going use of digital referrals by GP’s, hospitals, patients and commissioners.

– Proactively manage the key risks and issues associated with ensuring appropriate actions are taken to mitigate or respond.

– Monitor and establish accountability on the overall progress of the strategy to ensure completion within agreed timescales.

– Manage the budgetary implications of activity.

– Avoid the destabilisation of business as usual.

– Manage and actively promote the relationships with key stakeholders.

The job will be fixed-term until 31/03/2017 and interviews will be held in London on the 20th July 2015.

The big challenge will be to avoid the destabilisation of business as usual – a challenge beyond the ability of one person?

Government Computing. 

Another fine NHS IT mess

Why was e-Referral Service launched with 9 pages of known problems?

National e-Referral Service unavailable until further notice

 

Another fine NHS IT mess

By Tony Collins

Today the National Audit Office reports on the General Practice Extraction Service, an IT system that allows patient data to be extracted from all GP practices in England.

The report says that Department of Health officials – who were then working for the NHS Information Centre – signed off and paid for a contract even though the system was unfit for use. The original business case for the system grossly underestimated costs.

And the system was developed using the highest-risk approach for new IT – a combination of agile principles and traditional fixed-price contract.

Some of the officials involved appear to be those who worked for NHS Connecting for Health – the organisation responsible for what has become the UK’s biggest IT-related failure, the £10bn National Programme for IT (NPfIT).

As with the NPfIT it is unlikely anyone responsible for the latest failure will be held accountable or suffer any damage to their career.

The NAO says officials made mistakes in the original procurement. “Contract management contributed to losses of public funds, through asset write-offs and settlements with suppliers.” More public money is needed to improve or replace the system.

Labour MP Meg Hillier MP, the new chairman of the Public Accounts Committee, sums up today’s NAO’s report:

“Failed government IT projects have long been an expensive cliché and, sadly for the taxpayer and service user, this is no exception.

“The expected cost of the General Practice Extraction Service ballooned from £14m to £40m, with at least £5.5m wasted on write-offs and delay costs.

“GPES has managed to provide data for just one customer – NHS England – and the data was received 4 years later than originally planned.

“While taxpayers are left picking up the tab for this failure, customers who could benefit, such as research and clinical audit organisations, are waiting around for the system to deliver what they need to improve our health service.”

Some GPs who do not want patient data to be extracted from their systems – they believe it could compromise their bond of confidentiality with patients – may be pleased the extraction system has failed to work properly.

But their concern about patient confidentiality being compromised will not make the failure of the extraction service any more palatable.

The NAO says it only learned of the failure of the extraction system through its financial audit of the Health and Social Care Information Centre. It learned that the system was not working as expected and that HSCIC had agreed to pay additional charges through a settlement with one of the main suppliers, Atos IT Services UK Ltd.

An NHS Connecting for Health legacy?

Work on the GP Extraction Service project began in 2007, first by the NHS Information Centre, and then by the HSCIC.

The NHS Information Centre closed in 2013 and responsibility transferred to the HSCIC which combines the Department of Health’s informatics functions – previously known as NHS Connecting for Health or CFH – and the former NHS Information Centre.

What went wrong 

The original business case said the extraction service would start in 2009-10, but it took until April 2014 for HSCIC to provide the first data extract to a customer.

Meanwhile other potential users of the system have found alternative sources of patient data in the absence of the HSCIC system.

The NAO says that officials changed the procurement strategy and technical design for the GPES extraction systems during the project. “This contributed to GPES being unable to provide the planned number and range of data extracts.”

The NHS Information Centre contracted with Atos to develop a tool to manage data extraction. In March 2013, the Centre accepted delivery of this system from Atos.

But officials at the HSCIC who took over the system on 1 April 2013 found that it had fundamental design flaws and did not work. “The system test did not reflect the complexity of a ‘real life’ data extract and was not comprehensive enough to identify these problems”.

To work in a ‘real life’ situation, the GPES query system needed to communicate accurately with the four separate extraction systems and other systems relying on its data.  The test officials and Atos agreed was less complex. It did not examine extractions from multiple extraction systems at once.

Nor did the test assess the complete process of extracting and then passing GPES data to third-party systems.

Fixed price and agile – a bad combination

Officials began procuring the GPES query tool in April 2009, using a fixed-price contractual model with ‘agile’ parts. The supplier and officials would agree some of the detailed needs in workshops, after they signed the contract.

But the NAO says there was already evidence in central government at this time that the contractual approach – combining agile with a fixed price – was high risk.

The NAO’s report “Shared Services in the Research Councils”reviewed how research councils had created a shared service centre, where a similarly structured IT contract failed.

In the report, Fujitsu and the shared service centre told the NAO that: “the fixed-rate contract awarded by the project proved to be unsuitable when the customers’ requirements were still unclear.”

The court case of De Beers vs. Atos Origin highlighted a similar failure.

To make matters worse officials relied too heavily on contractors for development and procurement expertise.  And 10 project managers were responsible for GPES between 2008 and 2013.

Once health officials and Atos had signed the query tool contract, they found it difficult to agree the detailed requirements. This delayed development, with Atos needing to start development work while some requirements had yet to be agreed. Officials and Atos agreed to remove some minor components. Others were built but never used by HSCIC.

A Department of Health Gateway 4 review in December 2012 found that difficulties with deciding requirements were possibly exacerbated by development being offshore.

They raised concerns about the project management approach:

“The GPET-Q [query tool] delivery is being project managed using a traditional ‘waterfall’ methodology. Given the degree of bespoke development required and the difficulties with translation of requirements during the elaboration parts of R1, the Review Team considers that, with hindsight, it might have been beneficial to have adopted an Agile Project Management approach instead.”

General Practice Extraction Service – an investigation. NAO report. 

Latest healthcare IT disaster is a reminder of how vital government digital transformation is.