Proper Planning Prevents…

Friday 12th May 2017, International Nurses Day. Hugely heart-warming Twitter feeds full of #FlorenceNightingale and #NurseHeroes. But as the day wore on the celebratory stories were gradually overtaken by more worrying reports, with trust after trust being hit by the impact of the worldwide Wanna Decryptor ransomware attack. #CyberAttack began to trend.  

As the weekend progressed the new heroes on social media became the IT teams rolling out the patches, the porters forming human chains to replace the computer-reliant crash call systems, the runners taking handwritten notes around hospitals, and the communications teams getting messages out to local communities. In a few places, Chief Executives took to Twitter to thank their Gold, Silver and Bronze commanders and their emergency planning teams. 

For this was, by anyone’s definition, a major incident. Many commentators have already discussed the NHS’ preparedness (or otherwise) for a cyber security incident, but there are lessons which can and should be taken from these events for major incident planning more generally.

For this was, by anyone’s definition, a major incident. Many commentators have already discussed the NHS’ preparedness (or otherwise) for a cyber security incident, but there are lessons which can and should be taken from these events for major incident planning more generally. We discussed the experience with a number of hospital Chief Executives at our New Cavendish Group.

Without exception, these Chief Executives described a ‘Dunkirk spirit’ in their hospitals. “The staff response was phenomenal.” From all the coverage we have seen, that spirit rose to the occasion equally strongly in community and primary care settings.

But the Chief Executives were rather less consistent when talking about the response they received from above. There was some positive feedback here too: “The regular progress checks were helpful and informative.” “GE were quick to help”. But we also heard examples of “huge confusion” on the part of people making calls to trusts from different national bodies and from local Clinical Commissioning Groups. There were reporting requirements which failed to distinguish between mission-critical IT systems and PCs or systems which could safely be isolated and recovered over a longer period of time. Requirements for hourly reporting through day and night, even on non-critical systems. An email asking for confirmation that the Chief Executive had read the previous email, when it was already known their system was switched off.  

So what does this experience tell us about our state of readiness for a major incident? The NHS prepares regularly and well for those incidents we hope will never happen on our patch or our watch, but which are inevitable – the train crash, the gas explosion, the major fire. The response of the London Ambulance Service, Guys & St Thomas’ Hospital and other parts of the London health and care system to the recent terrorist attack in Westminster appeared exemplary.

We know that the highest priority on the government risk register when it was last published in 2015 was pandemic flu. The risk register is normally published every two years, and in the next edition we can expect to see anti-microbial resistance moving rapidly up the agenda. Unlike a train crash or explosion, the occurrence of either of these would be by their nature prolonged, and impact a wide area. Local emergency planning teams and public health professionals will be well aware of them. But IT professionals were very well aware of the risk of a significant cybersecurity incident – that knowledge in itself was not enough to prevent a significant impact on the NHS last week.