Comment Re:What did they expect (Score 2) 28
I was speaking to the CIO at a different NHS trust and this topic came up in conversation. He claimed that the hack so far appeared "purely opportunistic, unsophisticated and easily preventable".
Part of the issue is likely that IT is severely under resourced in the NHS. Many NHS organisations are still organised on the assumption of IT as a cost centre, rather than a core business process. The result is that IT doesn't get representation at executive level - so rather than a CTO or CIO explaining matters to the board and having some control over finance, IT may be treated as part of another department such as finance, or even buildings/facilities. Many sites are severely under-resourced in staff numbers, staff skill, as well as hardware resource.
As an example, one major hospital was recently upgrading their campus network earlier this year. Large parts of the campus were still fast ethernet, with gigabit backbone, and this was a source of much frustration due to poor performance for teams video calls, VoIP telephony, medical imaging studies in the multi GB range, as well as increasing use of electronic records. However, they hit a snag; many of the installed PCs, phones, and other appliances were so old that there was some sort of compatability issue with the new Gbit ethernet, and the network roll-out had to be halted until new PCs, etc. could be procured, resulting in a huge delay and massive cost overrun.
At the same time, software tools such as electronic medical records, electronic prescribing and medicines records, medical imaging, etc. are often not treated as IT procurements, and are procured and managed by individual clinical departments. For example, medical imaging software (picture archiving and communication system - PACS) is typically purchased by radiology departments, but it actually requires substantial infrastructure, due to the large quantities of data and need for high data integrity and availability - think multi-PB, tiered, redundant, storage with high availability clustering at both application and storage level, and SAN replication. Because the skills to administer such a system are often not available locally, these systems tend to be procured in a manner akin to SaaS, but with the hardware hosted on-site. This also means that architecture features often end up being specified by the vendor, which can lead to some aspects being deficient. For example, I recently visited one multi-hospital trust, and they had a roughly 1PB storage array for their images. It was "backed up in real-time to a different SAN in a different rack using replication".
NHS is also very good at trying to get away with paying the bare minimum for staff. You basically can't hire someone on a salary which encourages the better applicants. I recently saw an advert for one NHS hospital looking for a software developer to take charge of their in-house electronic medical record. The existing maintainer had left and the system was now live and unsupported. Essentially, they were looking for a lead developer with experience developing safety critical software, understanding the various regulations (e.g. medical device regulations), experience with interfacing via HL7 and various other frameworks. The salary being offered was £26k.
That said management are starting to see the light. I've seen several adverts this year for NHS board level CIO or CDIO (chief digital and information officer) in attempt to get people with detailed understanding of IT into senior positions, and move IT closer towards a core competency which needs to be managed as such. How quickly or how much effect it may have is yet to be seen.
Part of the issue is likely that IT is severely under resourced in the NHS. Many NHS organisations are still organised on the assumption of IT as a cost centre, rather than a core business process. The result is that IT doesn't get representation at executive level - so rather than a CTO or CIO explaining matters to the board and having some control over finance, IT may be treated as part of another department such as finance, or even buildings/facilities. Many sites are severely under-resourced in staff numbers, staff skill, as well as hardware resource.
As an example, one major hospital was recently upgrading their campus network earlier this year. Large parts of the campus were still fast ethernet, with gigabit backbone, and this was a source of much frustration due to poor performance for teams video calls, VoIP telephony, medical imaging studies in the multi GB range, as well as increasing use of electronic records. However, they hit a snag; many of the installed PCs, phones, and other appliances were so old that there was some sort of compatability issue with the new Gbit ethernet, and the network roll-out had to be halted until new PCs, etc. could be procured, resulting in a huge delay and massive cost overrun.
At the same time, software tools such as electronic medical records, electronic prescribing and medicines records, medical imaging, etc. are often not treated as IT procurements, and are procured and managed by individual clinical departments. For example, medical imaging software (picture archiving and communication system - PACS) is typically purchased by radiology departments, but it actually requires substantial infrastructure, due to the large quantities of data and need for high data integrity and availability - think multi-PB, tiered, redundant, storage with high availability clustering at both application and storage level, and SAN replication. Because the skills to administer such a system are often not available locally, these systems tend to be procured in a manner akin to SaaS, but with the hardware hosted on-site. This also means that architecture features often end up being specified by the vendor, which can lead to some aspects being deficient. For example, I recently visited one multi-hospital trust, and they had a roughly 1PB storage array for their images. It was "backed up in real-time to a different SAN in a different rack using replication".
NHS is also very good at trying to get away with paying the bare minimum for staff. You basically can't hire someone on a salary which encourages the better applicants. I recently saw an advert for one NHS hospital looking for a software developer to take charge of their in-house electronic medical record. The existing maintainer had left and the system was now live and unsupported. Essentially, they were looking for a lead developer with experience developing safety critical software, understanding the various regulations (e.g. medical device regulations), experience with interfacing via HL7 and various other frameworks. The salary being offered was £26k.
That said management are starting to see the light. I've seen several adverts this year for NHS board level CIO or CDIO (chief digital and information officer) in attempt to get people with detailed understanding of IT into senior positions, and move IT closer towards a core competency which needs to be managed as such. How quickly or how much effect it may have is yet to be seen.