Whitehall and Microsoft negotiate NHS Windows XP hacker survival plan

[Arthur]

1.086 million NHS PCs running XP = £130,434,682 of taxpayers money!!!

 

Source: The Register

 

Whitehall is negotiating a deal with Microsoft to prevent thousands of NHS computers from falling victim to hackers targeting Windows XP from April.

 

The government and Microsoft are in talks to offer extended security support to NHS PCs running Windows XP that miss an 8 April deadline to ditch the OS.

 

The Department of Health has exclusively told The Register it’s in talks with Microsoft to develop a migration plan to move PCs off of Windows XP.

 

A major plank of that deal will see Microsoft offer what the DoH terms “extended support”* – at a cost.

 

Extended support is not a cheap option and means the taxpayer will foot the bill for the NHS’s failure to hit the April deadline to move.

 

Under extended support Microsoft will deploy dedicated engineers to paying customers, who keep releasing fresh security patches after the April cut off.

 

Fees for this special protection start at $200 per desktop for the first year, going up to $400 in the second and $800 in the third year.

 

Only 1 million PCs to worry about... and that's JUST the NHS

The NHS in England alone has 1.086 million PCs and laptops running Windows XP at trusts, GPs and other health groups. The National Health Service in Scotland will be contending with 3,603.

 

A high price has been fixed deliberately by the software giant as an incentive for customers not to dawdle in finally getting off of Windows XP.

 

Extended support has only been made available by Microsoft to its largest customers who ask for it, who expect to be running Windows XP after 8 April.

[free780]

I know nhs IT as useful as a chocolate teapot. Its only been since 2008 when xp sp3 came out since they've known. I also heard in some areas they are still running office 97.

[FN-GM]

They have loads loads and loads of time to get this sorted. urgghhh!!

[XiJ]

It's only highly confidential medical information at risk. What's the worry?

[Arthur]

It's only highly confidential medical information at risk.

A situation that could have been avoided with forward planning.

[synaesthesia]

Typical backward idiots. The NHS IT system is absolutely diabolical and everyone involved in it's top levels should be ashamed of themselves, flogged and sacked.

[SovietRussia]

Well they spent 750 million creating a centralised medical records system, stopped making it as it went over budget. Does the NHS even have a in-house IT department? Or is it outsourced to the highest corporate bidder. Most likely the latter. What they need is some organisation and planning!

[localzuk]

My experience of NHS IT teams is up in Bristol. They had a PC in our school for the onsite NHS nurse to use. To say they were not very helpful when it broke down for the nurse in question is an understatement.

 

Thing is, like everyone else, the NHS has known for years that Windows XP was coming to the end of its life. So, why did they *still* fail to act? Of course there were going to be some systems that were more difficult than others but all of them? Really?

[Quackers]

I do find it odd they have not been trying to push out Windows 7 over the last 4 years. Im guessing they don't have the same licence discounts we get in education too. But i think things like this highlight why Microsoft need to have a separate business and consumer branch when it comes to the operating system like we had in the 90s with NT aimed at business and 9x aimed at consumer. Look at what Microsoft is doing (or at least was under balmer) and turning the OS into yearly refreshes with there colour waves, its just too fast for the non consumer world. They don't really care what the OS is , they want the specific application/job to work. Once they have removed XP and replaced it with 7/8 the same application will be being used, just this large cost in the middle Microsoft need a very long term support business oriented OS which maybe has 1 service pack every year, some sort of stability for these systems with all this data in.

[sparkeh]

My experience of NHS IT teams is up in Bristol. They had a PC in our school for the onsite NHS nurse to use. To say they were not very helpful when it broke down for the nurse in question is an understatement.

Similar here. For a while we had an NHS person stationed here. She had an NHS laptop which was supposed to be able to connected to her office via vlan. It went back and forth to the their IT dept to try and get it working. I told them repeatedly that they just needed to enter our proxy details in the vlan software but they repeatedly refused to listen and kept fiddling about with other settings.

 

Eventually I got hold of someone who made the correct change and it worked. Hurrah! She was moved the next week

 

If upgrade costs are an issue, perhaps they should move to Linux?

Edited February 14, 2014 by sparkeh

[FN-GM]

Microsoft need a very long term support business oriented OS which maybe has 1 service pack every year, some sort of stability for these systems with all this data in.

 

Is 13 years not enough?

[Vasriel]

Last time I visted my gp, I looked over onto their pc whilst he was using it and it was still running IE 6 :thumbdown:

[Arthur]

 

2,000 NHS patients’ records are lost every day with more than two million serious data breaches logged since the start of 2011 « The Daily Mail

 

The NHS is losing the files of almost 2,000 patients every day.

 

More than two million serious data breaches have been logged since the start of 2011, official figures show.

 

Medical records have been mistakenly sold on eBay, dumped in landfill sites, dropped in the street and even left in grocery stores. Staff are also sending sensitive information to the wrong places or publishing it on websites.

 

The figures are especially worrying because next month the NHS starts harvesting personal data from confidential medical files. It will be stored on a national computer database and used to analyse trends and improve care.

 

The scale of the losses of medical records emerged in figures obtained from the Office of the Information Commissioner.

[Arthur]

The Irish government has outdone ours!

 

Irish Govt signs €3.3m deal with Microsoft to fix Windows XP security issues « Silicon Republic

 

The Irish Government’s Office of the CIO has signed a €3.3m memorandum of understanding (MoU) with Microsoft to handle security issues that could affect four critical State departments when support for Windows XP ends in April.

 

The 12-month deal will prevent key offices of the State falling prey to hackers on 8 April, when the software giant officially pulls the plug on support for its 12-year-old operating system.

 

“The Office of the Government CIO has signed a memorandum of understanding with Microsoft, whereby affected organisations can get access to priority security bug fixes for 12 months from April,” the spokesperson said.

 

The spokesperson said the final price was value for money for the taxpayer, following extensive negotiations, whereby the price of the fix was haggled down from an initial €14.2m to €3.3m.

[MatthewL]

I can give a bit of background to this having worked in the NHS for a number of years till I moved on last year.

 

Alot of the software used, mainly the software to allow the smartcards to work which allows you access to medical records etc was only designed to work with Windows XP and IE6, we didn't get an update on it to allow it to work on IE7 till IE8 came out. This was the problem, the software was finally rewritten to work in Windows 7 32bit 18 months ago roughly. We were egar to roll with Windows 7 as the new machines running Windows XP ran worse than with Windows 7 on as we could not use them to their full performance.

 

When it comes to GP's, effectively they are their own business but alot of their IT comes from what was Primary Care now CCG (clinical commissioning groups) and have to fund their own equipment and license costs and alot are unwilling to pay out because what they have works and often these groups, the CCG's are run by Dr's who head up an IT committee but don't listen to what they are told from the IT department and because it works why replace it kind of attitude.

 

We were a leading trust in regards to IT, one step ahead and miles ahead of most trusts in the UK, but the problems always came down to GP side of things really. Alot of people talk about the system failing, again this is because the GP may not allow the record to be shared (as a patient its your choice) hence why some records cannot be seen in the likes of A&E. They cannot see everything just extracts i.e. medication and brief medical conditions if you have any, overall it benefits you to have it shared incase you are taken ill they can see it all without having to probe etc. Between our GP's and Hospital we had a system that worked and it was all automated but this lead to another problems, more Dr's at the hospital wanting to be old school and use things like fax to transmit you data back to the GP surgery.

 

At the end of the day there may have been money wasted in areas high up but alot of NHS trusts cannot control that, its government health people but the other big problem is Dr's, they cause a lot of issues and and can get very nasty at times when you are trying to make things better for them they will quite happily have a paddy at you and kick off. As the younger Dr's come in they use the technology and help but it takes time and doesn't solve the bigger problem.

 

As regards to IT departments been very unhelpful, yeah it is true in most cases with the odd techie been helpful, we were treated like mud, workloads increased, wages cut, areas increased and staff cut, going from 1 county to 5 or 6 and in our case in one county 10 staff did the job of what 4 now do across all the counties so some very unhappy people, me been one of them hence why I left.

 

I did enjoy working in the NHS it was a good time but things change big time.

[FN-GM]

Alot of the software used, mainly the software to allow the smartcards to work which allows you access to medical records etc was only designed to work with Windows XP and IE6, we didn't get an update on it to allow it to work on IE7 till IE8 came out. This was the problem, the software was finally rewritten to work in Windows 7 32bit 18 months ago roughly. We were egar to roll with Windows 7 as the new machines running Windows XP ran worse than with Windows 7 on as we could not use them to their full performance.

 

I understand this, but the NHS should have selected a company that has better development cycle or have some kind of SLA with them. We wouldn't dream of selecting a company that had this kind of development cycle, these smart cards are a core part of the system.

[AngryTechnician]

... the other big problem is Dr's, they cause a lot of issues and and can get very nasty at times when you are trying to make things better for them they will quite happily have a paddy at you and kick off. As the younger Dr's come in they use the technology and help but it takes time and doesn't solve the bigger problem.

 

As regards to IT departments been very unhelpful, yeah it is true in most cases with the odd techie been helpful, we were treated like mud, workloads increased, wages cut, areas increased and staff cut...

 

Well, this all sounds VERY FAMILIAR, doesn't it chaps??

[MatthewL]

Oh forgot to add on the Linux front our development team thought we could run on Linux and even create our own basic distro but those up top didn't like the idea as it was totally different to windows even thought it could have saved us a fortune. We had the bulk of things working and a linux option for apps we could not get working, again the only thing that held us back was smartcard stuff!!

 

There was a few of us up for it in a proof of concept but never got to see it through.

[FN-GM]

Thats a shame, When i worked for a bank we used to have a custom Linux distro. Unfortunately it wasn't used widely enough really.

[webman]

It's not just the NHS itself either. Anecdotal evidence, but interesting still... One of my company's web-based healthcare SaaS products is accessed by various pharmacies. Some of those have IT systems that are either ran by private companies, or they're a chain and have their own IT. Our user stats regarding platforms are quite revealing:

 

2011:

XP: 88%

IE6: 44%

 

2012:

XP: 87%

IE6: 25%

 

2013:

XP: 83%

IE6: 16%

 

Declining, but not quick enough. The usage of XP and IE6 isn't just a problem for official security and support as far as MS is concerned. It affects us in terms of feature development and maintenance, and our partner company who handles support for end users. Some of the IT systems use a form of remote desktop, likely on under-specced machines, and so doesn't perform as rapidly as a native browser or application would.

 

 

But having said that, it's almost a testament to how good XP has been in general, over the years.

[MatthewL]

XP is solid as a rock, look at NT that was around for sometime it had double the service packs XP has!

 

Interesting fact, Lotto terminals use Linux, had to reboot the terminal in our village shop the other day because it locked up. (I help them out a bit when the manager isn't there as used to work there years ago!)

[FN-GM]

Interesting fact, Lotto terminals use Linux, had to reboot the terminal in our village shop the other day because it locked up. (I help them out a bit when the manager isn't there as used to work there years ago!)

 

Panasonic In flight entertainment systems do as well. I saw it rebooting a few times when flying with Singapore Airlines. I do believe it uses LTSP.

Edited February 18, 2014 by FN-GM

[burgemaster]

My local GP had two machines/monitors on his desk. One XP and one Win 7. He tried to do something on the Win7 machine, grumbled and went back to the XP machine.

[free780]

Good testing by IT there.

[FN-GM]

Was watching the BBC news tonight, noticed in the background a Windows XP login screen..