• Majority of NHS computers not using Windows 10
  • Old versions can be a security risk
  • NHS to receive extended support from Microsoft as hundreds of thousands of devices are still on Windows 7
  • One trust says its migration to Windows 10 to be complete in April 2021

The NHS has been given another 11 months of support for a decade-old version of Microsoft Windows, while about half of its computers are still running the softfware, HSJ can reveal.

This is despite NHS organisations having been ordered in spring 2018 to migrate all their devices by today (Tuesday 14 January), because Microsoft was due to withdraw its support — such as security features, technical support or software updates — for Windows 7. 

As the migration has taken longer than expected, trusts, clinical commissioning groups, and national NHS organisations have now been given until December to move to using Windows 10 on all computers and laptops.

Under the revised deal, the NHS will continue to receive support from Microsoft until 14 January 2021, as the migration has taken longer than expected.

The latest figures from NHS Digital, shared with HSJ, show the majority of relevant devices in the health service are still using Windows 7, which was released in 2009. 

NHSD said 1.38 million devices in the NHS were licenced to use Windows software. Of those, 587,531 devices — or 42.7 per cent — are currently operating on Windows 10. Another 7,775 are running on Windows 8, which will continue to be supported by Microsoft until 2023.

The vast majority of the remaining 781,004 devices are currently operating on Windows 7, although HSJ understands national IT chiefs estimate around 2,000 devices continue to use Windows XP, which is no longer supported by Microsoft.

However, the migration has presented several challenges for NHS trusts, such as spending money replacing old devices incapable of running Windows 10, finding time for staff to update their computers, and incompatibilities between Windows 10 and trusts’ existing software and applications.

Reviews of the WannaCry attack in 2017 highlighted a lack of investment in NHS IT infrastructure — including slow replacement of Windows XP — as one of the reasons the NHS’ cyber-defences were breached.

An NHS Digital spokeswoman said: “Migration to Windows 10 is a process which will differ depending on the specific needs of the organisation. We are on target to complete this before the extended support period ends.”

Mixed picture across NHS trusts

The rollout of Windows 10 licences to trusts has been done in two waves.

This left some trusts waiting until August 2019 before they could migrate their devices to Windows 10.

A snapshot survey by HSJ of a third of all NHS trusts found just three of these had completed the migration. These were Greater Manchester Mental Health Foundation Trust, North East Ambulance Service FT and West Midlands Ambulance Service University FT.

Twenty-six trusts told HSJ they were on track to migrate by the end of March, and another 18 said they would complete the project by December 2020 — the NHS’ final deadline. The remaining trusts which responded to HSJ’s survey have deadlines or plans to complete the migration prior to December.

However, two trusts indicated they would not complete the migration before Microsoft’s extended support for NHS trusts running Windows 7 ends in January 2021.

Cambridge University Hospitals FT said it would start its migration of 9,950 devices to Windows 10 in April 2020, and that it would take “at least a year to complete”.

The trust said it had spent the last 18 months focusing on “safely transitioning to a new IT infrastructure service support supplier, which successfully completed at the end of 2019”.

Meanwhile, East Suffolk and North Essex FT reported working to a target of March 2022, although a spokesman said the trust is ahead of schedule and is “looking at ways to complete the project sooner”. The trust has 9,077 devices, of which 3,493 have migrated to Windows 10.

Individual organisations at risk of sanctions

NHSX is following the migration project closely.

The agency has the power to intervene or sanction any organisation failing to meet their agreed migration deadlines, although it confirmed to HSJ no organisation has had an intervention or sanction yet.

However, at least one trust has been told it could have its Microsoft licence revoked if it does not make enough progress.

According to United Hospitals Lincolnshire Trust’s risk register, NHS Digital will decide in March whether to revoke trusts’ licences if the licences are “not fully utilised”. Trusts whose licences are revoked will not receive the extended support from Microsoft.

NHS Digital’s decision depends on the “overall state of the NHS estate in England”, the board papers stated.

The trust’s risk register said this could lead to a cost pressure of up to £1.5m. A trust spokeswoman said: “We don’t believe that we will have to pay this as we can demonstrate a robust programme of work. Difficulties upgrading include available financial and physical resource to replace legacy equipment (with much of the equipment requiring replacement due to age and ensuring it is fit for purpose), and balancing disruption to clinical services.”