Thread by @robdykedotcom

This awesome write up from @datadictum for @TheRegister deserves reading

The tech is just as broken as everything else in the NHS

theregister.com/2023/01/30/hos…

@SteveBarclay take note!

@datadictum @TheRegister @SteveBarclay Just reading the report of the review published by GSST:

'Learning and accountability – This review has been about understanding fully and learning all lessons from the events that took place.

The Trust must be accountable for acting upon those lessons without fear or favour.'

@datadictum @TheRegister @SteveBarclay Anyone know whom was the then CTO at GSST?

The division of responsibilities for management of the data centres and their environments was complex and confusing, with multiple third-parties responsible for different elements of maintenance, monitoring and management.

"With the benefit of hindsight, we can conclude that this risk was insufficiently controlled, scored and escalated."

SAVE US FROM RISK MANAGEMENT!

What RAID level is this?

'Each array was built using 20-22 disks. The tolerable disk failure within an array is a maximum of two
disks.'

No write gain RAID6?

GSST asked their neighbors what risks they had

- All featured cyber security as the primary IT risk.

- None had a risk recorded specifically associated with a loss of air conditioning or extreme temperatures.

GSST can't say they were not warned by @UKHSA @UKHSA_London @NHSEngland

summer preparedness plan gave a responsibility to ‘Check resilience of IT systems to ensure they can cope at higher temperatures’.

EOL kit doesn't like to get too hot

"Other data centres in London also experienced issues on this date, with both Google and Oracle reporting outages"

Sure

Tho Google and Oracle don't run 371 legacy applications for critical line of business functions

Does anyone in NHS land know MoSCoW Method?

I ask as I notice that all recommendations are SHOULD

"The Trust risk management team should evaluate whether the current risk management framework is effectively managing and appropriately escalating
risks which are low in probability but catastrophic in impact"

The review asked: Did Any Actual or Potential Harm Come to Patients by Omission or Commission of Care?

@GSTTnhs tell us that no deaths or instances of severe harm relating to the outage have been identified to date

▪ To date, 20 instances of low harm have been identified by @GSTTnhs which are all short-term delays in care or minor medication/transcribing errors due to the IT outage.

@GSTTnhs The concurrent, but unrelated #cyberattack on @advanced which took out #CareNotes and #NHS111 #Adastra systems added further complexity to the recovery

Which reminds me to start asking affected Trusts (and central Orgs) for reports on the impact of that outage

@GSTTnhs @advanced Well, YES

9.13 Six weeks is clearly far too long for a major hospital to be without access to core clinical IT systems.