Author: hte2022

How healthcare organisations can check they are defended from cyber-attacks.

In May 2017 parts of the NHS were left paralysed due to the WannaCry cyber-attack. The NHS was not the only victim of the global attack and it wasn’t a specific target, however it cost the National Health Service £92million ¹ and highlighted weaknesses in its digital defences. This disruption to patient care highlighted how vital cyber security is for health and care organisations and, importantly, how the NHS needed to make security improvements across its service.

Two years on, Phil Barrington, HealthTrust Europe’s Director of ICT Solutions, looks at what management steps health and care providers should be taking to protect themselves from similar attacks.

WannaCry scrambled computers’ files, demanding payment before they could be opened again. It spread to more computers than previous ransomware attacks, hit computers used in hospital trusts, and had a bigger impact than previous attempts. However, cyber-security isn’t just a technology-based issue, it is it is often at the heart of delivery of high-quality patient care and ensuring safety.

There are several reasons why an organisation could become vulnerable to hacking activities as illustrated by the NHS in the wake of WannaCry. A National Audit Office report highlights that before the attack, an assessment of 88 out of 236 trusts by NHS Digital found that none passed its required cyber-security standards. The report said NHS trusts had not acted on critical alerts from NHS Digital. In addition, a warning in 2014 from, what was then the Department of Health and the Cabinet Office, to patch or migrate away from vulnerable older software was not acted upon by many trusts, leaving them vulnerable.

Having a formal mechanism for assessing whether an organisation has complied with cyber security advice is important. At the time of the attack, the Department of Health had no such system in place for assessing whether NHS organisations had done this, and it was found that organisations could have better managed their computers’ firewalls.

Cyber security isn’t just the responsibility of an IT department, it is the responsibility of every single person within an organisation. Staff should be able to identify issues such as potential phishing attacks, malware infections, and know how to report suspicious activity. In addition, staff should be aware of the risks of working remotely and using social media.

Eighteen months after WannaCry The Telegraph reported that a Freedom of Information request revealed around 25% of NHS trusts hadn’t offered staff any kind of specialist cyber security training. The request also discovered that spending on training varied enormously, with trusts investing anywhere between £500 and £33,000.

When it comes to applying cyber security measures it’s not a case of one size fits all organisations. As the case of WannaCry’s effect on the NHS proved, it’s not just an organisation’s technology that can contribute to its vulnerability, but a lack of management of how its technology is used.

Looking to your own organisation, a primary step to ensure you are protected against a cyber-attack is to conduct a cyber security audit. This is a cyber review of an organisation and its IT estate. It identifies the threats, vulnerabilities and risks the organisation faces, and the impact and likelihood of such risks materialising. It will examine issues such as data security, risk management, training and awareness, and business continuity and incident management. And with the introduction of the General Data Protection Regulation (GDPR) in May 2018 organisations now face severe penalties in case of a breach or hack resulting in lost personal data. This means organisations need to take the necessary steps to protect personal data.

HealthTrust Europe (HTE) is a solutions partner for health and care providers; led by its mission, the commitment to the care and improvement of human life, it helps organisations source the best value products and services to deliver patient care. HTE works in partnership with its suppliers who can provide a free initial consultation to discuss how they can help an organisation detect weaknesses which would make them vulnerable to a cyber-attack. HTE offers access to a wide scope of products and services across IT hardware, software, service and support requirements, with an emphasis on driving quality, safety, service and price. Its framework is covered by NHS terms and conditions and is fully OJEU compliant avoiding the expense and non-competitive market pricing associated with single tender contract frameworks. It is also GDPR compliant and all transactional activity is auditable to ensure both compliance and governance requirements are met and exceeded.

 

¹ The Telegraph 11 October 2018 https://www.telegraph.co.uk/technology/2018/10/11/wannacry-cyber-attack-cost-nhs-92m-19000-appointments-cancelled/

 

As the proposed EU Exit draws closer, HealthTrust Europe (HTE) is poised to support both the NHS and commercial health and care providers in the UK to operate efficiently and continue to deliver high quality patient care.

HTE has been diligently preparing its mitigation plan to address risk resulting from the UK’s proposed exit from the EU over the last 12 months. The organisation stands in readiness as a trusted partner for the NHS and commercial health and care providers, and as part of an international healthcare organisation can leverage over 50 years of experience and expertise in the face of adversity.

Alongside the Department of Health and Social Care EU Exit risk mitigation plans, HTE issued a questionnaire to its supplier community back in 2018 in order to assess potential risks to continuity of supply so it could pro-actively work to support its customers.

In February 2019, HTE held its inaugural supplier evening; setting out its direction as the UK faces leaving the EU, to advance supplier engagement and to outline how the company operates as a bridge between healthcare providers and suppliers.

HTE also updated its standard contract terms and conditions in October 2018 addressing the supplier’s obligation for continuity of supply of products and services along with compliance to the new GDPR regulations.

HTE’s updated contract terms and conditions ensures three core benefits for the NHS and commercial health and care providers:

• fixed pricing for the term of the contract with any delivery cost increases being the responsibility of the supplier;
• contractual protection to any risk of late delivery, and
• confidence in a robust contract which explicitly excludes “Brexit” as a force majeure event.

In the UK, HTE serves 148 acute hospitals and 140 non-acute sites leveraging its circa £1bn purchasing power to negotiate cost saving opportunities and best terms for its members.

HTE operates a unique Group Purchasing Organisation (GPO) providing a forum for shared best practice and peer discussion including EU Exit mitigation plans.

HTE continues to closely monitor the political and economic landscape in the UK and is taking every step to support its partners during this time of uncertainty.

HTE has a dedicated Customer Care team and is encouraging health and care providers to contact them by calling 0845 887 5000 or emailing customercare@htepg.com for help and assistance.

The challenges of Brexit and healthcare staffing shortages continue as the latest NHS staffing level figures (November 2018) reveal a shortfall of 41,722 nursing roles, alongside wider doctor and allied health professional vacancies.

The Cavendish Coalition, an alliance of 36 health and social care organisations, estimates that as many as 51,000 nursing staff will be needed in 2021, when the UK leaves the post-Brexit transition period. This means the equivalent of 45 hospitals’ worth of nurses will be required to fulfil the estimated shortage under traditional deployment models.

The NHS Long Term plan, which outlines its strategy to improve patient care over the next ten years, aims to address the problem by increasing the NHS workforce by training and recruiting more professionals.

This will include thousands more clinical placements for undergraduate nurses, hundreds more medical school places, and more routes into the NHS such as apprenticeships, as well as efforts to support improvements in retention. Meanwhile, the Nursing and Midwifery Council (NMC) has proposed an easing of the level of English writing skills required of nurses from outside the UK to encourage more overseas staff to work in the UK.

However, faced with complex challenges caused by staff shortages and Brexit, it can be difficult to support your overall workforce aspirations and strategy. We have put together some key actions to help mitigate some immediate risks:

1. Retain your existing EU staff

In the run-up to Brexit, make sure you are talking to existing members of staff who are from the European Union and the Europe Economic Area. Make sure existing staff have applied for residence under the indefinite right to remain which is offered by the British government. Reconsider the pastoral care you offer employees and find out if they are happy at work and feel reassured that there will be a role for them post-Brexit. Check if they need help and guidance to feel settled, such as setting up a British bank account, and ask if they are in regular contact with family back home.

2. Improve your recruitment strategy

Start by looking at how well you sell yourself to potential candidates, for example do you highlight the benefits of working for your organisation and any prestigious specialisms you offer that will appeal to potential employees? If you use a recruitment agency ensure your recruiters are fully briefed about the benefits of working for you so they can convey this to potential candidates.

Have you considered international recruitment for key worker vacancies such as doctors and radiographers? If you are looking to employ overseas workers, ensure you set your recruitment suppliers clear deliverables and ensure these are adhered. Measuring your recruitment strategy will help you evaluate if your recruitment tactics are effective at converting your contracted workers to substantive posts.

3. Use IT to improve your recruitment success

Creative use of IT can help you improve your recruitment processes. Developing something as simple as a database of healthcare workers who are available on a flexible basis could help you avoid using expensive agency staff. Rather than contacting an agency as soon as a staff shortage is identified you would be able to consult your database of known workers to help you fill your vacancies, helping to keep your salary costs down.

A lot of time and money is spent by organisations merely scheduling their staff, however technology can help you improve your workforce planning. Rostering software can help you produce optimal rosters that meet safe staffing levels, quickly and easily. They can help your managers oversee flexible shift patterns, provide a real time view of staff on duty and the skills available within the workforce to drive performance and control costs. As well as enhancing care quality and safety for patients, rostering IT can increase productivity and improve staff morale.

4. Manage staffing agencies better

Most trusts rely on agency nursing staff to some extent. Whilst agency nursing staff have an important role, they are normally more expensive than the equivalent permanent or bank staff. Approach staffing agencies as a last resort. If you must use an agency or agencies try not to leave staff requests until the last minute because you could be forced to agree less favourable terms. Also try to save money by negotiating lower rates of pay for nurses on longer contracts.

If you have to rely on agencies, take control from the beginning by setting performance targets based on quality, safety, service, and price. Check if your trust has a clear policy that it will not pay rates higher than the rates agreed via a framework and stick to it. As already mentioned, using e-rostering services can help you monitor patterns to forecast and plan for staffing shortfalls and display visibility of purchasing

5. Don’t work in a silo

Pool your resources with other trusts within your region, sustainability and transformation partnerships (STPs) or group purchasing organisations (GPOs) to reduce silo working. Significant savings can be made by working collaboratively, and this can also be done across wards and units, for example, by sharing staff banks or agreeing prices for some agency staff.

Finally, review your workforce practices. If current systems aren’t working, explore other systems and adapt your strategy rather than applying methods that you have found aren’t suitable for you.

Click here to learn more about our Total Workforce Solutions

Pressure on vital pathology services is mounting as populations age, chronic conditions increase in frequency and services become constrained by staff shortages. Against this backdrop, outsourced services must evolve to meet the needs of an increasingly challenging diagnostics landscape.

In its latest survey, Meeting Pathology Demand – Histopathology Workforce Census 2018, the Royal College of Pathologists, highlighted that only three per cent of histopathology departments said they had enough staff to meet clinical demand. Added to these pressures, there is an approaching retirement crisis – a quarter of all histopathologists are aged 55 or over and training places remain unfilled.

The college identifies that the cost of staff shortages is not just financial but for patients, it can mean worrying delays in diagnosis and treatment.

HealthTrust Europe has developed the UK’s first OJEU-compliant framework agreement for pathology referral testing and pathology reporting services, to help address these challenges.

The new, free-to-access framework is designed to enable clinical and procurement decision- makers in the NHS to call off time-sensitive pathology services.  It addresses bottlenecks and delays – caused by staff shortages and peaks in demand – in a timely and cost-effective way.

With increasing pressure on diagnostic services, the first framework to be OJEU-compliant has an important role to play in meeting the ‘model hospital’s’ aims of providing the best patient care in the most efficient way.

Daniel Chapman, director of diagnostics at HealthTrust Europe explains:

“listening to, and consulting with clinicians and suppliers, was critical in developing the only OJEU-compliant, easy-to-use, pathology services framework.  The end result addresses all the major concerns over quality, consistency, efficiency and value for money.

“As we all know, pathology services are critical to meeting targets in the NHS – both in terms of diagnosis and treatment.  As a key pillar of the NHS Improvement programme, pathology services are under rigorous scrutiny as the drive towards network integration and improved operational and clinical efficiency continues apace.

“As a healthcare solutions partner, we understand how imperative it is for any pathology framework to provide consistency, quality and seamless integration.  Those qualities ensure the framework adds value both clinically and operationally.

“Pathology services are facing several challenges while having to meet an escalating demand.  Every year the NHS carries out over 500 million[i] biochemistry and 130 million haematology tests; over 50 million microbiology requests are processed; over 13 million histopathology slides and four million cytology slides are examined.

“It’s not only important that the process – from taking a patient sample, through to testing and reporting – works seamlessly and effectively but also that it adds value by relieving the pressure on healthcare providers and reducing diagnosis turnaround,”

said Daniel.

HTE’s Pathology Referral Testing and Pathology Reporting Framework draws on expert providers to include full coverage of tests and reporting across five lots. It can be accessed either via direct award or mini competition.

The lots include routine and esoteric testing with electronic reporting of results, consultant-led cytology testing and screening and histopathology reporting with clinical support and interpretation.

“The framework is the first of its kind and must be reliable and efficient to ensure it is trusted to add value to pathology services. With this in mind, we have worked hard to offer immediate access to compliant, comprehensive and cost-effective solutions. These eliminate the need for time-consuming tender processes, reduce the number of SLAs to manage and offer flexibility in the availability of electronic formats that will integrate seamlessly with cloud-based and laboratory IT systems,”

added Daniel.

“We are acutely aware of the time and cost pressures these services are under but also on the need to deliver accurate and reliable services that meet patients’ needs and that can potentially lead to improved outcomes.

“The OJEU-compliant framework has been designed to remove the administration burden and human error from transcribing test results into the laboratory information management system (LIMS). It also facilitates the consolidation of all SLAs into one agreement to support quick and easy outsourcing across a comprehensive portfolio of pathology referral testing and reporting services.

“To further reduce the administrative burden, the framework provides one point of contact for the entire end-to-end process. In addition, all of the logistics are taken care of within the contract price.  This eliminates the need for additional logistics arrangements, the hassle of managing multiple logistics providers and transport legislation requirements.

“Having a broad pool of specialists available, the framework supports the 62-day cancer turnaround targets while freeing up admin time.  This allows for an increased focus on other activities that will help improve capacity and performance such as training or systems integration.

“Ultimately, we understand that optimising services through utilisation of the framework relies on trust and, to that end, we undertake comprehensive and rigorous vetting of suppliers to ensure they follow best practice guidelines.  They are also regularly audited to stringent KPIs to drive continuous performance improvement and excellence which includes ensuring validation of clinical registrations. To reinforce protection of patient information and ensure confidentiality, we have also adopted 100% GDPR compliance.”

Learn more about our Pathology Referral Testing and Reporting Services