The NHS cyberattack: tired staff, and where leadership has to come from
Hour five of the cyberattack coverage, live on Sky News: the fatigue and opportunity cost of staff working extra hours, why safety has to come first even if care takes longer, and why keeping systems secure needs leadership from the top.
On the day
By noon I had been on air every hour since eight, and this last briefing was the one that looked past the day itself. The immediate risk was fatigue: staff were covering the gap with extra hours, and tired clinicians make worse decisions, which is why I reached for the comparison people understand, the exhausted pilot. The deeper point was about how a thing like this is prevented. An organisation the size of the NHS makes a lot of decisions locally, and that is often a strength, but keeping systems patched and secure cannot be left to chance hospital by hospital. It needs leadership from the top to make the safe choice the easy one.
What I said
The presenter’s questions are paraphrased. My answers are my own words from the recording, lightly edited for reading clarity; every turn has been checked against the recording.
Stephen Dixon paraphrased, from 0:00
The presenter asked what difference the attack would make to the people on the front line: the staff who had worked through the night with patients coming through the doors and no access to records.
Dr Kishan Rees from the recording, 0:25
I think we have to be careful, and it will make a difference in terms of fatigue. If staff are putting in extra hours, there is an opportunity cost in overtime, and the longer it goes on, the more tired those staff are going to get. You wouldn’t get on an aircraft with a pilot who’s exhausted, and it’s exactly the same in medicine: you don’t want to be operated on or treated by a doctor or nurse who is tired and can’t make good decisions. So we need a resolution to this as quickly as possible.
Stephen Dixon paraphrased, from 0:53
In terms of patient care, he put it to me, presumably everything was going to take longer, and fewer patients could be treated as a result.
Dr Kishan Rees from the recording, 1:02
I think so, yes, because safety has to come first. If it means we are treating patients safely and it takes a little bit longer, then that is just the price we have to pay as medical professionals.
Stephen Dixon paraphrased, from 1:14
He picked up on the effect on the front line, and pointed to the infrastructure: out-of-date computers and software, patches not applied where they should have been, an infrastructure into which vast sums had been poured. Was this not, at bottom, a system failure?
Dr Kishan Rees from the recording, 1:16
I think people on the front line are sick of being failed, in the sense that the NHS has been used as a bit of a political football. I know everyone says they don’t want to do that, but we have to be mindful of it. The NHS is a complex organisation. It employs a huge number of people; I think at one point it was behind only Indian Railways and the Chinese army as an employer. In organisations that big, where they can make decisions at a local level to benefit their local population, they can also make decisions about whether or not to update their security. What you need is guidance and leadership from the top, to make it easy for those hospitals to make the right decisions.
Broadcast by Sky News, 13 May 2017; clip from the WatMed Media archive, my own upload. Sky News retains the rights in the broadcast. This page carries my own contributions with the presenter’s questions paraphrased, credits the programme, and I will amend or remove on request.