NHS cyberattack causing ‘total chaos’ in hospitals could take a year to recover

Loss of patient records following outage leads to wrong drug doses

British organisations have been warned to bolster their digital defences due to ‘malicious’ cyber incidents in Ukraine

(PA Media)

It could take more than a year for hospitals to recover patient record systems following the recent NHS cyberattack, The Independent has learned.

Hospitals impacted are likely to need two weeks to recover for every day the situation goes unresolved, according to NHS sources.

Following the 5 August attack on software supplier Advanced, NHS 111 and mental health and community services across the country suffered an outage to several systems used by the NHS including one called Carenotes which is used to store patient records.

It has been 22 days since the outage and Carenotes is yet to be restored. Staff at a Birmingham hospital were told on 17 August that restoration could take a further five weeks.

Under current estimates it is likely to take two weeks for every day, The Independent has been told, to upload patient notes again once Carenotes is back online meaning full recovery could be over a year.

Patients’ safety fears have been raised over mental health and community trust workers being unable to access their records, after Carenotes went down.

The Independent has been told incidents are occurring already where patients have not been given the correct medication dosage because staff are unable to access their records.

One source said: “It’s total chaos… there have been incidents with drugs being given at the wrong dose to people who couldn’t check the dose.

“It’s a danger to staff as well. You don’t know who is at risk when you’re going out. You can’t write reports for the court such as Mental Health Act reports.”

Staff at Birmingham Children’s Hospital, which runs children’s mental health services, were told last week that the issue may take five weeks to resolve.

The Independent understands some nursing homes have also been impacted, as well as social care services.

One clinician in the east of England told The Independent: “Politicians and NHS England need to understand that mental health trusts are working with complex and high-risk patients, who have an increased risk of mortality.

“Staff work in different shifts, and the main form of communication is electronic health records. If it is not available, important risk indicators are simply not available for decision-making. These include previous psychiatric and medical history, medication side effects and interactions. The trusts are trying to implement alternatives, but it’s not possible to replicate everything.”

Trust sources said some hospitals are creating workarounds and uploading new and current patient notes into separate systems.

One director in the southwest said alongside issues with the patient records, there could also be a problem once systems are back on with reporting against NHS performance standards.

According to reports in the Health Service Journal GPs in south London were told by South London and Maudsley FT a new “temporary digital solution” had been launched but the outage “increased the risk to people who use our services”.

An NHS spokesperson said: “The use of electronic records is a small but important aspect of diagnosing and treating patients. Advanced is working to resolve their software problems, and robust contingency plans are in place across local health systems. Since Monday, NHS 111 service providers have been coming back online and it is vital that the public continue to use services in the usual way including 111 online and 999 in an emergency.”