London Eye: The first cyber attack death

Hanging onto the cash

Well, hello again, North West London health authority (incorporating North Central London).

Many years ago, there were three health authorities in the capital, broadly responsible for commissioning/organising the bits that were not hospitals – and it may well go that way again soon.

The news that NWL integrated care board chief executive Rob Hurd had stepped down ahead of a vote next month over whether to join with North Central London ICB is widely interpreted as an indication that the two will, in fact, merge.

The number of ICBs in the capital would fall to four.

The other merger, much rumoured but as yet unconfirmed, is of South West London and South East London. Former SWL ICB CEO Sarah Blow ended an eight-year stint as boss of that five-borough commissioning organisation in February. Other figures in the system were said to be keen on a merger with SEL, and this might have been a factor.

The fact there is nothing officially planned does not mean that it is not the trajectory. If it were to go ahead, it would take the number of commissioning organisations in the capital down to three.

The 13-borough behemoth in NWL stretching from the Middlesex tip of ULEZ-hating Uxbridge to the farthest reaches of Barnet, Hertfordshire, would cover a population of roughly 4.5 million. A SWL/SEL merger would have 11, leaving north east London with a petite-by-comparison seven.

It is a good thing, therefore, that ICBs are officially not going to do any performance management anymore: NWL struggled to do that over even its current patch. London Eye reported last year how Hillingdon Hospitals Foundation Trust got promoted out of the lowest category of the NHS England tiering process against ICB objections.

It was set to be promoted again – despite a very worrying Care Quality Commission report in the meantime. Its accident and emergency was rated “inadequate” for safety, and the regulator said: “Leaders had not taken effective action to address concerns raised following our previous inspection in 2018. This included concerns around clinical oversight of waiting areas, medicine management and provisions for mental health patients”. The report was published one year after the visit, but full credit to the inspectors who spotted a patient who appeared to have sepsis that staff had missed.

So, if ICBs get left to do population health and long-term commissioning, hopefully they will be allowed to actually shift some resources around to do that. Newham and Barking & Dagenham will have more than half their children classed as obese by 2035. The figure for Richmond upon Thames will be 22.6 per cent, according to data from the Royal Society for Public Health this week.

Whenever boundaries change in the capital, the London Eye is reminded of a Richmond GP who, when Hounslow and Richmond’s community services had been combined in one organisation, saw her job as stopping her wealthier borough’s resources being sent to the needier area. The argument being there still was need in Richmond, and the new organisation would ignore it to focus on the more egregious problems in Hounslow.

How resources get divided across a vast North but not North East London ICB will be complicated, at best.

There is already a big London-wide cash redistribution job, if the NHSE’s figures on specialised commissioning are correct. South London is overfunded by around £200m, NWL is underfunded by £122m.

Overall, NCL’s finances are a fair bit more healthy than NWL’s. NWL also has some very strange stuff on their books that it refuses to explain. No wonder the Treasury would not allow novel capital borrowing shenanigans, when NHSE’s new chair oversaw an ICB whose 2022-23 accounts did not get signed off until February this year.

So why the merger?

Senior managers tell London Eye it is simply overheads and that neither organisation can afford to stay separate. The logic of that points towards a south London merger and also raises some interesting questions for north east London. The argument back from those patches – particularly South East – may be that their trusts are more amalgamated into groups/collaboratives, which require less tinkering and can take on more functions, so the ICBs themselves will be cheaper.

‘Evil’

This morning, a London trust confirmed what had long been suspected – last summer’s pathology cyber attack had resulted in at least one fatality.

King’s College Hospital said a patient’s long wait for a blood test result during the system outage was a “contributing factor” in their death.

When HSJ broke the news of the attack last year, a normally very measured senior contact used the term “evil” about the attack. It is now clearer why.

There were heroic efforts by the SEL pathology system on workarounds, and mutual aid from south west and north central London. But staff should never have been put in that position.

The NHS’s cyber security (trusts’ own systems) is pretty good, it is the suppliers (like Synnovis in this case) that are vulnerable – in this case because they did not have multifactor authentication.

The Department of Health and Social Care’s cyber security officer last month issued an open letter to suppliers, saying they must comply with basic standards. It had to be an open letter because no one in the centre knows how many suppliers are out there, or who they all are.

Trusts themselves know who they pay, though – and the more proactive ones are already throwing slow or recalcitrant suppliers over the side. Every trust can and should do this – suppliers that refuse can be referred to the centre.