Data – shared 24 June 2024

NHS England continues to work with Synnovis and the National Crime Agency to respond to the criminal ransomware attack on Synnovis systems.

Synnovis has now confirmed through an initial analysis that the data published by a cyber crime group has been stolen from some of their systems.

We understand people may be concerned by this, and Synnovis are working at pace to carry out the further analysis required to understand the full scale and nature of the data released and patients impacted.

At present, Synnovis has confirmed there is no evidence the cyber criminals have published a copy of the database (Laboratory Information Management System) where patient test requests and results are stored, although their investigations are ongoing.

As more detail becomes available through Synnovis’ full investigation, the NHS will continue to provide updates here and a helpline has been set up to support people impacted.

Investigations of this type are complex and can take time. Given the complexity of the investigation it may be some weeks before it is clear which individuals have been impacted.

Local health systems will continue to work together to manage the impact on patients with additional resources put in to ensure urgent blood samples can still be processed, while laboratories are now able to see historic patient records.

Patients should continue to attend their appointments unless they have been told otherwise and should access urgent care as they usually would.

Cancelled tests – shared 20 June 2024

Synnovis will be sending information to practices to update them on a significant number of cancelled tests. All unprocessed samples received since the cyberattack were stabilised and stored in laboratories. Due to the volume of demand and the capacity available, Synnovis have been able to undertake Full Blood Counts on some of these samples and, in those instances, the results will already have been returned to practices electronically.

Regrettably, some of the remaining samples received that haven’t been processed yet are no longer suitable for analysis as they will have degraded, meaning that tests cannot be undertaken reliably. Synnovis has cancelled these tests and are very sorry for the understandable upset and inconvenience this may cause to you and your patients. Practices have started to receive reports on these and will do so in a staggered manner to ensure access to rebooked tests.

The reports will arrive to named individuals in your practice from two possible email addresses – Karen Ashworth and Kiran Hoolsy. We recommend practices use the prioritisation guidance when reviewing these reports.

Mutual aid arrangements

As part of our plan to restore services, we have been working across London with other pathology services. All boroughs now have mutual aid arrangements in place from Monday 24 June; these mean that all practices now have access to critical and urgent testing. These arrangements have been established as quickly as possible. We will continue to work to develop these arrangements as the impact from the incident continues.

We have been working to minimise changes to existing arrangements as much as possible, but there are likely to be some changes to testing regimes, test catalogues and reference ranges that arise from the change to a new pathology provider. We will continue to provide guidance as these arrangements develop.

In this section:

• Prioritisation guidance
• Potential harms monitoring guidance
• Medicines guidance
• Financial support
• Accurx fragments

Prioritisation guidance

To continue to support practices to prioritise pathology tests, our team has updated the guidance issued last week. You can find the updated guidance here.

The guidance particularly provides more information about pathology around cancer treatment.

Potential harms monitoring guidance

We have developed and updated the guidance for raising quality alerts and patient safety issues after constructive feedback from primary care and the LMC. The pack has been updated and on page 3 of the pack, you can find a link to the form where you can raise quality and patient safety issues arising from the Synnovis Cyber attack. The guidance is here.

Medicines guidance

To support people who take medication that requires regular blood tests, the medicines optimisation team are working with GPs and specialists to develop clinical guidance that applies across primary and secondary care. This is being released in batches as it is developed. You can find the current guidance here.

To help communicate the impact of the incident on the care of your patients, the following may be helpful to use when asked queries by patients: “Your regular blood testing for prescribed medication may be reduced or paused as a result of the cyber attack in South East London which is affecting blood testing capacity. Any reduction or pausing of blood testing will be considered by your specialist or your GP on an individual basis. This will ensure people with the greatest need are prioritised for testing and that you can safely continue taking your medication. If your regular blood tests are delayed, your specialist or GP will ensure you are called for a blood test at the earliest possible time.

If you have any questions, please discuss with your healthcare professional.” 

Financial support

We recognise the impact that this will have for our practices in relation to capacity, workforce and provision of care. To ensure we support practices as well as we are able, we have secured financial support (20 June 2024) for practices.

Once Synnovis has communicated the cancellation of these tests to general practice, general practice will need to undertake a clinical review of each patient to ascertain the impact of the cancellation and the follow-up actions required to minimise risk to the patient.

Accurx Fragments

We are aware that practices have had to inform and notify patients of the recent Synnovis incident which may have involved utilising Accurx fragments.  Please continue to use this method of contacting patients if appropriate but at the same time record the number used for this purpose during this period for future reference. A local template named Synnovis Incident could be used. Click here to access the webpage showing how to create the template.

In this section:

• Printing of pathology labels
• Recording pathology needs for future routine testing for Lambeth and Southwark
• Ardens templates
• Ardens – manual blood test template
• Cyber security – heightened risk

Printing of pathology labels

Synnovis and mutual aid providers have raised issues with the quality of printed labels on samples being submitted. To ensure that no samples need to be returned over the coming weeks, we would ask practices to help by:

• Only using Brother ink cartridges. 3^rd party cartridges often contain lower quality inks which degrade both in the printer and outside.
• Dust the printer drum. There should be a slider inside the machine to dust the drum. Move this backwards and forward approximately 15 times to dust it. The dust is often caused by lower quality inks.
• Leave the label for 30 seconds after printing. This reduces any smudging.
• Checking your DPI/resolution print settings. It should be set to 1200 dpi but many are set at 600. If you have an issue with this, the ICT service desk can help.

Recording pathology needs for future routine testing for Lambeth and Southwark

Following the transfer of the urgent pathology service to HSL we have been asked to clarify how practices can raise their orders for non-urgent/routine tests and the link with Ardens template.

Non-Urgent Tests: Practices should use the HSL T-quest link to order the routine tests and print off the form and give to the patient. However, we would ask practices to ensure that patients are advised there is no current service available to undertake routine testing and that they should wait to be contacted before booking/attending for phlebotomy.  Practices will need to record the due test delayed using the Ardens protocol indicating level of priority which will then be used at a later date to risk stratify and recall.

Ardens templates

We have been working with Ardens to set up two support tools to help record delayed tests in SEL due to the cyber attack.
There are two main components as follows:

• Quality Marker which will add a code with associated free text to notes automatically every time a patient record is loaded and will record that this interaction occurred at a time when a cyber attack prevented pathology services from being readily.
• Test Delay Protocol and template – enabling users to record a specific test has been delayed along with the priority level of the test. This will enable you at a later stage to run a search on these test priorities and contact patients at a later date once pathology services are resumed.

Here you can find some initial guidance and further information from Ardens on the updates.

Ardens – manual blood test template

It is important that any test results, manually added to patient records during this period, are entered consistently.  It is therefore recommended that you use the following Ardens template: “Blood results (v17.9) (Ardens)”.

Cyber security – heightened risk

We want to remind practices that as they have been directly affected by this cyber attack that they are at increased risk of being targeted. This could be in the form of further ransom demands, phishing attacks (to try and gain login credentials or sensitive information) or others. Please continue to be vigilant and report any phishing or spam emails by sending to spamreports@nhs.net or via Outlook the Report Phishing button. Any other issues or concerns, please contact:

Email: ICT@selondonics.nhs.uk, SEL ICT Tel: 020 8176 5400 or use the Self Service Portal: https://nhssel.haloitsm.com/portal/home.

You can find some tips on how to increase cyber/security awareness in your practice here.

All phlebotomy appointments for clinics which feed into Synnovis services have been postponed. We have split the arrangements below out by borough.

Under mutual aid arrangements, for critical and urgent tests, patients in each borough should go to:

Lambeth

Gracefield Gardens, 2-8 Gracefield Gardens, London, SW16 2ST

From Thursday 13th June: 8:00 – 17:00

Last patient entry: 16:45

Southwark

Tessa Jowell Health Centre, 72H East Dulwich Grove London SE22 8EY

Friday 14th June: 7:30 – 15:30

Last patient entry : 15:15

Bromley

An urgent blood test request pathway exists via the Community Phlebotomy Service run by Bromley GP Alliance (BGPA). Urgent referrals should be made via email to selicb.bgpa.phlebotomy@nhs.net. BGPA will manage the booking and contact the referrer and patient by phone with the appointment date and time.

• Beckenham Clinic: 14 The Crescent, Beckenham BR3 1DU
• Orpington Health and Wellbeing Centre: 19 Homefield Rise, Orpington BR6 0FE

Bexley, Greenwich and Lewisham

Patients requiring critical blood tests can visit the following sites from Monday to Friday. Please ensure you have typed ‘urgent’ onto their tQuest form before printing it and handing it to them.

Bexley

• Queen Mary’s Hospital (8am to 6pm)
• Erith and District Hospital (8am to 2pm)

Greenwich and Lewisham

• Queen Elizabeth Hospital (8am to 6pm)
• Eltham Community Hospital (8am to 2pm)
• Waldron Health Centre (7.30am to 11am)
• Rushey Green Group Practice (7.30am to 12noon)
• South Lewisham Health Centre (8.30am to 4.30pm)
• Sydenham (8.30am to 12 noon)

Media approaches

Thank you to all practices across south east London for your help and support with managing the media messaging on this cyber attack. If your practice is approached directly by a media outlet on the Synnovis cyber attack and ongoing incident, please contact media@selondonics.nhs.uk for advice and support. We can help to manage the response and the query for you.

Communications toolkit

To support practices, we have updated the GP communications toolkit. The toolkit has been produced to help support consistent messaging to avoid unnecessary confusion and anxiety for patients and staff. This contains:

• Statement for practices to place on their websites
• A script to follow in case of queries
• A short paragraph to share with partner organisations
• A telephone message for practices

If there are further materials you would like to be included, please contact us at communications@selondonics.nhs.uk.

On 3 June, Synnovis, a pathology laboratory which processes blood tests on behalf of a number of NHS organisations, primarily in South East London, was the victim of a cyber attack.

NHS England has been made aware that the cyber criminal group published data which was stolen as part of this attack.

We understand that people may be concerned by this and we are continuing to work with Synnovis, the National Cyber Security Centre and other partners to determine the content of the published files as quickly as possible. There is a page of frequently asked questions which can provide more information.

As more information becomes available through Synnovis’ full investigation, the NHS will continue to update patients and the public here (guidance on cyber security is also available through this link).

The attack is being investigated by law enforcement agencies.