When Steven Flockhart joined NHS National Services Scotland’s Digital and Security business unit, it was two weeks before the lockdown began. As the Director of Cloud Engineering & Digital Operations, he has a remit to oversee digital engineering and operations, and build a centre of excellence to support NHS Scotland’s digital infrastructure. However, this suddenly shifted to helping NHS Scotland respond to a highly infectious virus that quickly turned into a global pandemic.
Flockhart's team is responsible for a number of digital infrastructure operations that underpin NHS Scotland. His particular NHS Scotland board - National Services Scotland - is a non-departmental public body that provides advice and services to the rest of Scotland's publically funded health system. It is accountable to the Scottish Government and in total supports 14 regional health boards that vary greatly in terms of size and need. "Things smaller boards may want to do for themselves but may not have capability or capacity, we provide for them," he says. This ranges from IT equipment to the provision of things like the Scottish Wide Area Network, a public sector ICT initiative in Scotland that aims to establish high-quality IT networking and communications services across the country. "It's the backbone of the Scottish infrastructure that connects all of us together. The education, healthcare, police and fire services all get these services from us," Flockhart says.
Flockharts team are also supported by expert consultants in the NSS cyber security centre of excellence and from the clinical informatics team. These teams work very closely together on securing the NSS infrastructure and services to ensure that NSS is protected from both external and internal threats and that any clinical use of software, infrastructure or services meet with both internal and regulatory standards.
Scott Barnett, Head of Information and Cyber Security at NSS, comments, “NSS have committed to providing cyber security services throughout the development lifecycle as well as monitoring these national systems from the moment they go live.” He continues, “With targeted attacks on the health sector becoming more common, there’s a focus on strategic partnerships across the NHS, academia and third-party service suppliers to build a national cyber security capability that’s scalable to support our evolving national infrastructure”
Dr Brendan O'Brien, Chief Clinical Informatics Officer at NSS, heads up the clinical informatics team. His team have developed an NHS Scotland approach to clinical safety assessment for major health IT programmes. In the past year this enhanced and directed the clinical safety of the national contact tracing solution and national vaccination End-to-End digital solution.
He commented that the team's approach is "based on international best practice such as ISO 14971:2019 and sets a new benchmark for clinical safety assessments in Scotland."
The COVID-19 response
During the pandemic, one of NSS’s Digital and Security’s first tasks was to stand up a centre for the contact tracing service. "We had a huge amount of work that we needed to do on the engineering side to enable lots of different applications to talk to each other", Flockhart explains. “This included cloud telephony and a case management system”.
Flockhart’s team was responsible for making sure that the infrastructure that underpins the information capture systems was in place. Information from this system such as COVID-19 infection rates and deaths, was the critical intel provided to the Scottish Government daily, informing the daily stand-up’s by First Minister Nicola Sturgeon. Flockhart explains, “The data has to be provided early each day in order to go through further processing and scrutiny so the availability of these systems is of critical importance to ensuring that information being given to the public is accurate and verified.”
During the rapid establishment of NHS Scotland Track and Trace, there was rapid recruitment, training and enablement of several thousand ‘home-based’ contact centre staff. Flockhart says, “We had to ensure staff were connected to the case management system via the cloud telephony deployed onto their desktop. Quite often, we would be looking at very large numbers of agents coming on board at very short notice. There would be hundreds of people on a Friday that would need to be enabled for a Monday morning, so a lot of work for my team would be making sure that all these things were in place and functioning properly."
Later in the response, the team moved to supporting the national vaccination programme. Flockhart's team pivoted to support the rollout, playing a key role in making sure an efficient scheduling system was developed and rolled out quickly and safely.
As vaccination delivery accelerated, they swiftly moved on to supporting NHS Scotland’s efforts in running mass vaccination centres. "Initially, the focus was on provision of scheduling capability, but this expanded to the need for boards to run both mobile and community clinics. Therefore we were asked to equip boards with tablets and supporting security software so that they can efficiently and effectively administer vaccinations in any setting and run clinics that don't have to be in fixed locations".
For Scotland, this is crucial to be able to deliver healthcare equitably, as the geographic diversity of the country means there are many remote communities to consider. "It's been a real help for NHS Scotland to have mobile capabilities so it doesn't have to depend on office buildings. 4G capability gives them the ability to use mobile technology."
The digital journey
While their focus over the last 14 months has been on the national COVID-19 response, the team's vision remains the same: to provide high quality services that deliver best value, and are as integrated as possible to make them simple for users right across NHS Scotland – staff, patients, and public.
Modern technology will enable all of this. NHS Scotland commenced its new digital transformation journey in earnest in 2018, with the aim of using digital technology to make life easier for Scotland's citizens as well as healthcare services. This can and will benefit a broad range of services from screening programmes to the provision of services for GPs, to national platforms like the Community Health Index (CHI) platform - a unique ten-digit number used to identify patients across Scotland.
COVID-19 has provided an opportunity to accelerate the digitising of more services, and has quickly enabled patients – particularly those in remote communities – with more ways to digitally interact with healthcare services. This even includes the ability to have virtual consultations with doctors. "It really did push us down some paths much quicker than perhaps would have happened through a traditional programme of change," Flockhart says.
"I think some of these services will still exist going forward and will evolve to serve more than one purpose in the future. If we look at things like vaccinations, there's no reason why we can't run that vaccination service in a similar way to our flu vaccines which creates an opportunity to provide a more consistent and simplified approach on a ‘once for Scotland’ basis, for example."
Supporting the workforce
When the pandemic began, Flockhart's team assessed the capabilities staff would need to do their jobs from home. A small percentage had laptops and mobiles and were already using Teams, albeit in a limited way. "The first thing we did was make sure all of our staff could connect to the services they needed. We had to take a very close look at how much traffic we could have on our network and how many people could log on to the VPN at any one point."
"We had to substantially increase our bandwidth, issue a huge number of VPN tokens, and a huge number of devices had to go out the door to staff to make sure people had the equipment they required."
Office 365 and Teams were rolled out within two weeks, which staff embraced. "I would say this was probably the single biggest success we had in terms of enabling our workforce to be able to operate outside of the office environment," Flockhart says. "Yes, it comes with teething problems like anything else. But the ability it's given us to interact with each other in a connected, common, and consistent way has made a huge difference to people working from home. It's certainly one of the areas where we've had the most feedback and where people have found it the most helpful."
Remote working put a strain on their helpdesk as people needed assistance with their equipment. "We saw call volumes go through the roof more or less overnight," Flockhart says. "I think that's a cultural thing - people think something is broken much quicker at home than when they're in an office environment, where the person next to them might usually be a quick point of help."
Moving into the cloud
The team provided the core infrastructure required to create online portals for vaccine bookings, which also allowed people to reschedule appointments if they couldn’t make them. "They're able to do it all themselves online. It's a seamless process," Flockhart says.
Separate portals were developed for unregistered carers, i.e. people caring for someone in a home setting. "We worked collaboratively with the Scottish Government to create a portal for them to register to get their vaccines as a priority. That was stood up very quickly."
These are secured thanks to the cloud, specifically Microsoft Azure. "We put a front door on our portal, so if you're not in Scotland and you're not supposed to be accessing the portal to generate an appointment for yourself, we will block these attempts and will be alerted to this. This type of technology is much easier, secure, and efficient for us to use than it would be for us to set up an on-premise environment."
"Making use of Azure gives us the ability to be really safe. Once the data is in that environment, it's not accessible to anybody outside of that subscription. Humans don't necessarily have access to these types of things, as their security protocols are machine-driven rather than by individuals processing and moving data."
"The dashboards that produce all the COVID statistics have systematic access that extracts information from the case management system. We're not relying on people to make these processes run; they’re automated. And because they all sit behind that firewall, it's a very secure environment."
"Our Azure subscription consumes information from our on-premise environment, done through a single connection which is secured", Flockhart adds. "This is monitored very closely because we need to proactively make sure we are ready for any issue. We've recently seen ransomware attacks elsewhere, so there's nothing to suggest that NHS Scotland wouldn't be a target as well.This is where our security team really come to the fore with the skills that they bring to the table. They are experts in this field and work continuously to provide us with a safe and secure environment to operate within.”
Valued partners
As well as Microsoft, NSS Digital and Security have critical partnerships with IT security firm Check Point and giants 02 and Apple. "Check Point is our primary defence barrier, both for our on-premise and our internet-facing services. They also provide us with equipment that supports our internal networking needs."
The partnership with 02 and Apple is around the provision of equipment in vaccination centres. "Through 02 and our relationship with Apple, we procured a very large number of iPads that have been deployed across Scotland for use in the vaccination clinics," Flockhart says. "They can be used anywhere from a mass vaccination centre like the Conference Centre in Edinburgh to a community hall in Dumfries and Galloway. All 14 health boards are using these devices in the centres. To be fair, in a very busy patient-facing environment, you want to very much minimise time being taken away from care (or in this case vaccinations), which is where the ease and efficiency of systems really come into the fore.”
02 provide the telephony, while Check Point provide the security software for the iPads. These relationships have been vital, as Flockhart explains: "Apple were a key supplier for us at a time when iPads were very much at a premium. We leveraged our good relationship with Apple and 02 to secure those devices just before Christmas when there was very high global demand."
To bring this to life, on one occasion Apple chartered a plane to bring the devices over from China. "We were able to use our connections through the Scottish and UK Governments to speed up the process to meet the needs of the vaccination programme and get them through customs. The lead time for getting this stuff through customs is normally four weeks. However on this occasion, we got them through in 48 hours."
Learnings from the pandemic
Flockhart believes that a key lesson from the pandemic is that things can be done faster if necessary. "As somebody coming into the public sector for the first time, I think we can be far quicker to react to things. We must undertake tasks such as clinical safety assessments, cyber security assessments and penetration testing, but some internal processes perhaps could be revised to enable greater efficiencies and effectiveness."
Another lesson has been greater collaboration. "When you start to work with different bodies, there's always a bit of clarity to work through who does what, but one thing the pandemic did was focus all of us on one specific outcome. It's created opportunities to work very closely and further develop relationships with organisations, like the newly formed Public Health Scotland, who we've worked with to build dashboards and reporting of COVID statistics. Also with NHS Education Scotland who developed the vaccine application which is a key part of the vaccination process."
"We have all had a strong ‘in this together’ momentum, moving in the same direction at the same time. It's been great building some of those relationships and even sometimes breaking down barriers as well."
The same goes for NHS National Services Scotland. “It’s a vast organisation of a wide range of services and the COVID-19 response has even accelerated and created new connections for how our own organisation works even better together for the benefit of stakeholders” explains Flockhart. "I'm immensely proud of what our board, and NHS Scotland have done throughout the pandemic", he says. "Most of all, I’m naturally really proud of my team. There is no doubt in my mind that without their skills and commitment, we wouldn't be where we are today."
