Agenda item

Attending for this Item from Herefordshire and Worcestershire Health and Care NHS Trust (HWHCT) were:

Sue Harris, Director of Strategy and Partnerships

Lisa Yates, Interim Director of Digital/Chief Information Officer

Anna Evans, Senior Operational Lead – Carenotes Restoration

Members were briefly reminded of key points from the Agenda Report. In early August 2022, the supplier of a number of national IT systems was subject to an external cyber security attack, which disabled access to Carenotes, an electronic patient record system used by a number of NHS Trusts across the Country. In Worcestershire, HWHCT was the only Trust affected, however, Carenotes enabled digital input of patient records, clinical notes and the ability to plan, manage, record and analyse care across a range of settings.

There was a nationally directed response by the NHS and HWHCT adopted its business continuity processes, which involved manually recording patient information and other activities. When it was evident that Carenotes would be inaccessible for a prolonged period, an interim electronic system was developed, THEA, and although not a replacement for Carenotes, was in use from early September 2022.

Carenotes was rebuilt by the supplier and after comprehensive testing was received back by HWHCT in December 2022. From January 2023, the phased re-introduction of Carenotes to clinical teams commenced and over eight weeks, 158 clinical teams, with 4,166 individual user accounts, returned successfully to using Carenotes as their electronic patient record.

Restoration of essential clinical information was detailed, alongside recognition that the downtime led to some disruption to patient care and impacted HWHCT’s ability to access and share key information, including performance data. Full restoration to Carenotes was ongoing, however some services had a significant volume, such as the Starting Well Service which had 44,000 documents.

All patient activity continued and no specific cancellations occurred as a result of the downtime. The HWHCT website shared updates and alerted patients on what they could expect during an appointment due to electronic records not being available. HWHCT was extremely grateful to staff, who were already under system pressure, to work flexibly.

Members were invited to ask questions and the following points were raised:

·       For clarity, not all NHS systems were impacted and each Trust would have a number of systems. The supplier of Carenotes was ‘Advanced’ and every organisation who had their systems would have been impacted. Nationally, around 1,000 organisations had been affected

·       When asked why it took several months to restore the system, it was explained that the supplier had to rebuild the system. Information from the supplier had been limited as their priority was to restore or rebuild systems, however a risk assessment had been undertaken and each organisation had been given a rebuild slot. HWHCT was classified as low risk compared to some Trusts which may have had several systems from the supplier or less robust business continuity processes

·       HWHCT had recognised that cyber security attacks were a risk and had agreed to invest in better back-up systems

·       The Committee was reassured that no data had been compromised and the NHS mobile phone application had not been affected. Carenotes was a managed system and no data was stored in the supplier’s data centre, rather HWHCT data was stored in its own data centre or in cloud storage and security controls were in place

·       The cost to Worcestershire was likely to be upwards of £1m. It was agreed to provide HOSC with the full cost to HWHCT and the monies recouped from the supplier, once known

·       Information from the interim system, THEA, was in the process of being transferred to Carenotes. Furthermore, there were a total of 7 systems in HWHCT which helped with business continuity

·       In relation to the disruption to patient care, clinics did run however as clinicians were working to fixed information, there was less flow. It was not thought that waiting lists had been extended as activity in clinical services was the same as usual

·       Services affected included community hospital inpatients and specialist outpatient appointments. For clarity, Neighbourhood Teams did not use Carenotes

·       In relation to performance monitoring, HWHCT had taken a pragmatic approach and acknowledged that not every single indicator would be accurate, however importance was given to nationally driven key performance indicators, for example relating to mental health

·       Carenotes had been fully functioning since the end of February and HWHCT was in the process of restoring information to it, however, had agreed that work on restoration would cease on 30 June. Overall, HWHCT believed it was in a healthy position.