One NHS IT director describes it as “terrible”; another says it is “like a very long and slow train crash.”
Both are referring to the large number of trusts that have yet to create plans for migrating away from Windows XP, six months after Microsoft ended general support for the operating system – and six months before the Cabinet Office’s emergency deal for the public sector comes to an end.
“What are they going to do?” asks one IT director of his colleagues in this situation. “If I was in their position, I would be terrified.”
Old, but still going
Windows XP was first launched in 2001. After a long period of warning organisations and individuals that it was going to end support – and running a ‘countdown clock’ – Microsoft stopped providing security updates for the operating system and for the Office 2003 suite on 8 April.
However, a lot of organisations – including shops, the banking sector, the police and the NHS – were still using XP at this point.
So many public sector organisations were dependent on the operating system, in fact, that the Cabinet Office agreed a one year deal with Microsoft to provide support and security updates for them. However, it warned NHS trusts not to use the deal as an excuse to put off migration.
However, it seems that a large minority of trusts have done exactly that. EHI recently ran a short survey about XP a couple of weeks ago, and found that of the 99 acute trusts, mental health trusts, and primary care organisations that responded, only 19% had migrated before 8 April.
Since then, another 18% had moved off the OS. But more than two thirds of the respondents said they had still not migrated off Windows XP. And rather more “terrifyingly”, one third of those that have yet to migrate have no plans to do so.
An all-over issue
The survey suggests that the organisations that have yet to tackle their XP issues are evenly spread across the country; and no one type of organisation seems to be doing better or worse than any other.
Of the 57 acute trusts that took part in the survey, eight migrated before 8 April and six have migrated since. Acute trusts without any plans in place to migrate are found London (five), the North (four) the Midlands and East of England (three each) and the South (two).
Of the 13 commissioning support units, clinical commissioning groups and individual GP practices that responded to the survey, three migrated before 8 April. Four have migrated since, three have plans in place, and three do not.
A long job
Trusts that have managed to move off the obsolete operating system, or that are in the process of doing so, have tended to find it a long job.
Richard Hale, chief technology officer at Yeovil and District Hospital NHS Foundation Trust, says it has been working on the migration for 18 months – although, unlike some organisations, it has approached the move as part of its routine programme of work, rather than as a one-off project.
“We have been doing the work on a gradual basis; as a PC has needed some attention, or replacement, we have done it. So now we have just a couple of hundred machines left,” he says.
“If you tried to do this as a one off project, they you would have to get to all these machines anyway […] and approach has meant that we have been able to spread the resource involved over a couple of years.”
His view is echoed by Rob Gray, projects development manager at South Staffordshire and Shropshire Healthcare NHS Foundation Trust, which has migrated just 140 computers so far.
“We put a lot of time and effort into planning and preparing. Now it’s time for the doing,” he says. “We’re planning to be done by the end of March 2015 and are doing it in batches.
“It’s only five months but [Microsoft System Centre Configuration Manager 2012], makes life easier because it’s less manual work [the software allows large numbers of machines to be managed across a network] – and we get better at it with each batch.”
Lots and lots of machines
One of the challenges that many NHS trusts face is the sheer number of machines that they run. Gray acknowledges that one of the issues for his trust has been to identify just how many machines are in use, given that it has a mix of desktops and laptops used by mobile workers, some of which will only connect to the network occasionally.
“When we haven’t got an accurate record of how many are out there, it can become difficult, so we had to do an audit,” he says, adding that he now expects to upgrade around 2,500 devices and replace around 250.
The cost of buying new PCs came through in free-text comments on the survey, with respondents saying their older machines would not support new software, that securing finances “has meant delays” and that “there is no money to invest”.
The cost of new Microsoft licences also came through in free-text comments and in comments on the EHI website. Several commenters suggested that the NHS should look at open source solutions, particularly for staff who would never use the full Office suite anyway.
However, almost all the trusts that took part in the survey are moving to Windows, mainly because it was covered by the Enterprise wide Agreement between the Department of Health and the company that lapsed in 2010, because it causes fewer compatibility issues than other options, and it requires less staff training.
Windows 8.1 came across as a popular option for mobile. However, Richard Hale says his trust “cannot go on upgrading everything every three or four years.”
“We are trying to talk to Microsoft about [the cloud based Microsoft Office] 365, and whether they are going to move to more of an Apple model, in which they just squeeze out smaller upgrades, instead of issuing huge, new operating systems releases every few years.”
Even more systems
The really big issues, though, relate to other software. One of the reasons that the NHS was still so heavily invested in XP when the April deadline came around was that many systems were built for XP, or for access through its browser, IE6.
The IT director of a large, integrated trust in the South of England, points out that this applied to national systems which, he says, were often “slow” to declare compliance for Windows 7, which inevitably delayed trust migrations.
But it applied even more to administrative and clinical systems. “We have had plans for a long time to move off XP and onto Windows 7 and Windows 8 for mobile devices,” he says. “So far, we are about half way through.
“We have done our community services, and they were relatively easy, but we have only just started on the acute side, and it is incredibly complex because of the diversity of systems in use.
“We have identified that a minimum of 300 are being run, and tracking them all down and moving them into the new environment is just incredibly difficult.”
Like many IT managers that EHI has spoken to, this IT director said that even at the end of the process there will be systems that will never be compatible, and that will have to be run as terminal services.
Indeed, he praised his staff for coming up with creative ways to “fool” some systems into co-operating. “We had one – admittedly home grown system, so I can’t blame the supplier – that needed .NET 1; and Windows 7 doesn’t even recognise .NET 1,” he says.
“In the end, we had to do something as crude as rename it .NET 2 to fool it into running.” This system will be re-written next year.
But in the meantime, there will be plenty of other headaches, including Java issues (with the national Electronic Staff Record and Oracle Financials package throwing up compatibility issues) and printer “pain” (with some printers, for example those used for trust wristbands, lacking modern drivers).
Just not compatible
The general point, that a lot of systems are just not compatible with Windows 7, that it takes a lot of effort to make them compatible, isolate them, or restore familiar functions in unfamiliar browsers, is reflected in many comments on the survey.
One respondent said that systems that “will not work natively on Windows 7” and another that “even current, ongoing deployments” are not compatible.
Comments on the EHI website say the same thing; adding, as a complicating factor, that many departments have been allowed to buy their own systems – so the IT department may not even know about the problems until it gets to them.
What next?
Even so, trusts cannot run an obsolete operating system for ever. Indeed, some respondents to the survey were furious that so many trusts were still on XP with no plans to move. One suggested that “trusts and IT heads that have still not migrated should be named and shamed.”
But more respondents felt that trusts struggling with the cost and scale of the task ahead should get help. One suggested that the DH should work with Microsoft and other suppliers, including Oracle, to offer trusts plans to migrate.
Another suggested “co-ordinated IT strategy and practice to ensure compatibility and secure communication between all aspects of the NHS on current, fit for purpose, equipment” to help with the compatibility issues.
However, a spokesperson from the DH told EHI earlier this month that trusts are not required to submit its migration plans to it and it is the individual trusts that are responsible for their IT services.
“Trusts are responsible for developing plans to update their IT systems. Data security is vital and we have recently written to trusts about this and are considering follow up action if necessary,” is the department’s line on the issue.
The spokesperson added that The Crown Commercial Services and Microsoft Account Management are both available to trusts in an “advisory capacity”.
Where does that leave those trusts that are struggling to migrate, have yet to start, or yet to plan? With six months left of the extended support, there isn’t much time left to find the answers.