Trusts need two years’ extra XP support

Trusts will need an extension of Windows XP support for up to two years in order to migrate safely on to a newer operating system, NHS IT experts have said.

Microsoft is due to end support for XP on 8 April 2014, leaving system users open to cyber-attacks as there will be no more security patches, software updates or bug fixes for the software. But experienced NHS users say that rushing through an upgrade project would do more damage than the risk posed by hackers.

Despite the support deadline looming, research by EHI Intelligence, published last September, revealed that 85% of NHS desktops were still using the system.

NHS IT directors told EHI Intelligence at the time that they hoped a national solution would be found for the NHS. This had seemed unlikely, but EHI reported last month that the Department of Health is working with Microsoft on “a migration plan and extended support” for the health service.

Head of IM&T at University Hospitals Bristol NHS Foundation Trust, Andrew Hooper, said news of a national extension for the NHS came as a surprise. The trust will have largely completed its migration off XP on to Windows 7 by the time support runs out in April after starting the migration three to four years ago.

“The way we did it was the best and easiest way because if you have 5,000 PCs and you migrate them all to Windows 7, you are talking about a massive amount of work and the pain and agony that would go with having to do it quickly,” said Hooper.

The trust’s support services manager, Simon Jones, said the trust started the process by replacing old machines with new PCs running on Windows 7. Both agreed that larger trusts that have not begun migrating would need up to two years of extra support.

“I would like to say a year, but for those trusts larger than ours you would need support for one to two years,” said Jones. “You need to do it in a very controlled fashion, you need some sort of plan of what to tackle and when and even then it’s a constant battle.”

University Hospitals Bristol had to deal with hundreds of different systems in use at the trust, many of which were very old and not compatible with Windows 7.

“That was a challenge, working with suppliers to get them up to levels that would work on Windows 7. You could do a lot of damage doing it too quickly,” said Jones.

Hooper said it was frustrating to hear of trusts continuing to install XP on their computers. “All they are doing is prolonging the agony, making the pain even greater,” he added.

When asked whether a national migration plan would be helpful, both agreed that local knowledge is essential.

“If you are undertaking this kind of work it needs to be undertaken by people who understand the organisation; all the systems running on the devices and the geography of the organisation and personally I think it’s only something you can cope with in-house,” said Hooper.

However, they said trusts that have been through the process can provide some useful advice and work to upgrade national systems to run on new browsers has already been done.

Robin Arnold, director of IT at University Hospitals Coventry and Warwickshire NHS Trust, said it has plans in place to have migrated to Windows 7 by November this year.

A six to 12 month extension of support would therefore be “really helpful” and trusts are keen to hear the details regarding the DH’s talks with Microsoft.

“It could be helpful to have a national migration plan across the NHS, particularly for colleagues who are perhaps some way back on their plans. It could be a very useful back-stop. The challenge is always how do you do that quickly, because the NHS is a vast organisation,” Arnold said.

It is not only the NHS which is struggling to cope with the end of XP support. Internet measurement company Net Applications estimates that nearly a third of all PCs worldwide were running XP in February.

Head of EHI Intelligence Karl Grundy said a major issue that is holding individual health organisations back from buying new licences is their lack of revenue versus capital expenditure.

“Licences need revenue, especially if bought through the cloud, but transformation or change management projects that are not yearly can tap into the capital pot. As the move from XP for many is not just a case of buying a new licence anyway, a transformational model that incorporates licence upgrades over a period of two to four years would make sense,” he said.