GPs share patient records in Word documents within days of solving cyberattacks

GPs working in emergency care are having to share patient records on Word documents as the fallout from last week’s cyberattack continues.

First highlighted by Pulse, parts of the NHS 111 service suffered a “total system outage” last Thursday morning, following a ransomware attack.

The Advanced system host, which was targeted by the “financially motivated” attack, said it would be able to gradually bring services back online in the “next few days”.

An update sent to Liverpool GP practices, seen by Pulse, said appointment information will be sent in a “Microsoft Word document via secure email to your practice email account”.

The update acknowledged the situation was ‘not ideal’ but said it was more of a risk for GP practices not seeing patient information from interactions outside opening hours.

He said: “We have agreed that clinical consultation information will be sent as a Microsoft Word document via secure email to your email account.

“This will allow practices to review key patient information and choose how to record that information in practice systems.”

He added: “While not ideal, it is considered a lower risk to patient care than unseen practices in after-hours interactions.”

The update stated that “111 services in the North West are not directly affected by this issue”, but that “the Merseyside GP out-of-hours service provided by Primary Care 24 (PC24) has been affected , as well as many others across the country.

While PC24 has “operated effectively as part of business continuity measures”, it “recently raised with us a concern that clinical interactions with the service are not communicated to practices while systems are down”, indicates the update.

He added: “They were able to record consultations and activities electronically, providing the ability to share this information via secure email.”

“All practices [must] ensure their email account is checked regularly for receipt of records,’ the update says, and practices will be notified as soon as there is ‘a clinical system recovery allowing the resumption of the normal transfer of records”.

Meanwhile, the 111 system host said normal service should be in place in the “next few days”.

NHS system host 111 Advanced’s latest FAQ said: ‘In terms of the NHS, we are working with them and the National Cyber ​​Security Center to validate what additional steps we have taken, how the NHS will begin to bring its services back online.

“For NHS 111 and other urgent care customers, we expect this step-by-step process to begin in the coming days.

“For other NHS customers, our current view is that it will be necessary to maintain existing contingency plans for at least another three to four weeks.”

He confirmed the cyber incident was a ransomware attack and said he believed it was “purely financially motivated”.

Advanced said: “This was a ransomware attack by a malicious actor which we believe, based on the threat intelligence provided to us by authorities and our expert advisors to date, is purely financially motivated.”

The company could not confirm that patient data is not at risk, although it said “we found no evidence that any personal data was compromised”.

He said: “In terms of potentially affected data, our investigation is ongoing and when we have more information about potential data access or exfiltration, we will notify customers as appropriate. In addition, we will comply with applicable notification obligations.’

Urgent Health UK said: ‘Most of our members are struggling but have used their business continuity systems to ensure they are able to continue providing emergency care and other services to their patient populations.

“One of the consequences is that GP surgeries no longer receive contact reports the next morning. To address this, organizations are trying to send reports by email.

He added that it is “very frustrating that this vulnerability has been exposed at this time, especially when it was only recently reported.”

Urgent Health UK also called for “national and local messaging to local people” so that “people can understand what is happening and take extra care to use services appropriately”.

First revealed by Pulse, the 111 outage meant GPs in London were warned they could see an influx of patients reported by the service.